d77b1f80cbbe5e09449fe29198bac0057c7f02cd0ef12b882e0d507c8353b373

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 8.5MB
Sample260707-e62rmaez3m
SHA256 d77b1f80cbbe5e09449fe29198bac0057c7f02cd0ef12b882e0d507c8353b373
MD5 30f325af37b27a8928986bb3558f4d84
SHA1 ca2304fdc866cf472de9100163daf8713306c360
SHA512 677360acaa26bcccb73e2d8f83f9989345bb7a904fd04ca94461fa3c9c46320511f9701c17c018ed5e380bf0f5f2525ec2f026393d6674e0c6c1f51abfb42015
SSDEEP 98304:lglKxaIeL0n7m3M8amABTESw7+mD/zupf7qjFxiSKXHOCC7wRGpj3:lglzBem3HxdSwSmTzuUiROCmF9
TLSH
T19596AE5373E941ECE0BBC179CA968963D7727C550332AADF0290997A5F23AD04E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
5132	elevation_service.exe
356	elevation_service.exe
5824	maintenanceservice.exe
2408	OSE.EXE
1936	PerceptionSimulationService.exe
4072	perfhost.exe
3752	ReFsDedupSvc.exe
1472	SensorDataService.exe
5680	ssh-agent.exe
2400	AgentService.exe
2796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e44d433b2468fd14.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f692424ca0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{C64EB056-FF72-470B-B8EF-200930125F11}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{B718091A-7A45-430A-8D4C-4B8D8CCF2A04}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4752	explorer.exe
4752	explorer.exe
5132	elevation_service.exe
5132	elevation_service.exe
5132	elevation_service.exe
5132	elevation_service.exe
5132	elevation_service.exe
5132	elevation_service.exe
5132	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3752	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3752	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2400	AgentService.exe
Token: 33	2796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2796	SearchIndexer.exe
Token: SeDebugPrivilege	4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeShutdownPrivilege	4752	explorer.exe
Token: SeCreatePagefilePrivilege	4752	explorer.exe
Token: SeDebugPrivilege	5132	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2320	sihost.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe
4752	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
4504	2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
1460	StartMenuExperienceHost.exe
3104	SearchHost.exe
4752	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2924	2796	SearchIndexer.exe	98
PID 2796 wrote to memory of 5560	2796	SearchIndexer.exe	99
PID 2796 wrote to memory of 2992	2796	SearchIndexer.exe	100
PID 2796 wrote to memory of 3124	2796	SearchIndexer.exe	101
PID 2320 wrote to memory of 4752	2320	sihost.exe	106
PID 2796 wrote to memory of 4816	2796	SearchIndexer.exe	113
PID 2796 wrote to memory of 916	2796	SearchIndexer.exe	114
PID 2796 wrote to memory of 3892	2796	SearchIndexer.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_30f325af37b27a8928986bb3558f4d84_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:356

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5824

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2408

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1936

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4072

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1472

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5680

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 3004 3008 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 2580 2576 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 2580 2576 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 3004 3008 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3892

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4752

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3104

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f076d9f2783bc94308cbcf5fef628ffd37d93c396b9c22eaa69fc579b1542ff2
MD5 822520422aa231b9335e8e1bf1c328e1
SHA1 7d3619c414b2f0c3b2a55c9ece9dcfc0d3e61762
SHA512 cafe1bcd3d20ab11eee3281fe01e723405a57bde73ded673057b387ff905ecf2ea1f11a385b0be8617f1a49f94d9503f9c7d0c4c37fb5bb2e3144c8be38a51d9
SSDEEP 49152:6b+632BuPkFKRrdE6ohdstBhuXjfS4LWxn9LNiXicJFFRGNzj3:s3q6mjBG7wRGpj3
TLSH
T1ADD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 f493b65badaf139ab5ab4c480683f10d378d4f725fa971322a425b70765bcbe3
MD5 ffbc9b24b6ed970aa546ac25cf73f38a
SHA1 7fb66f3072087a19f387fb4b3d53f92b3ac7bd7e
SHA512 127f7b95653aa5d620f37bb267e287d19827ffea128abe91233b59c32709b94d6f9ca4f9fb98ff2de1a3736bad72c29a80075118663c5e918c745191f7897d17
SSDEEP 24576:3XYfDtczAa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:itc7LNiXicJFFRGNzj3
TLSH
T14B85012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 d588442b3b21afc308cb96f12091f450d0d22f560248c2bbb3ca5ac9a88d9b0e
MD5 28e325bf2e71f923f9910659323e19fa
SHA1 71a47ba3faed6907a7e2620c9aa50efd2b626915
SHA512 0d41c061b0b752bf94a1a14aac9811264ed1306633ebc1debf0ed3e80d65a6b830499fee89c19c09856aa3da7b4d0914853f38094c73f4aab3ec2c91b29842ad
SSDEEP 24576:60Le5ji0hmxErMF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6Pji0AGELNiXicJFFRGNzj3
TLSH
T189A59E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3d4758219520c614fb6e72d3df386b67bbaa0a7da4fdd1aaaf078a65eea4fe46
MD5 48eb0bd6b40c18f553d1e6cdd15194fc
SHA1 3e0460c75b4c5b964b569cc2f6f6cac625ec6739
SHA512 856b8a902b13ff4ad39f3b30695cf6433af62e574573f478c626aec6e659891fe0170c65be8053d97b574c7e618b5f4585af2a505fd955f458ef8ceb061e311c
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWj6q8wyur/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:d/ezSC6vUzPv+HjyILNiXicJFFRGNzj3
TLSH
T1F8756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c1ce0fa5d19182079a95450e6173d9d42ed8b6e4e1281cf4bca3cc6e26c2c04a
MD5 68c5fb9442900b31d874bd91d0d27d26
SHA1 fbd7688f815ff36eb9f2d5b17247540eb10e6292
SHA512 539e4b63f984b95bdf2a86a4f35a1385d2c176cc8c6b5d494353ee4e6ebcbf666c4a2adaf61affacfbffe8b178395f29d3b97fbb0a96413048471d53291885fe
SSDEEP 24576:XVbqPb88hv/l+B2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XVO88hXl+kLNiXicJFFRGNzj3
TLSH
T10E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 3c22941e54de69f0bb48233861718def3ce2b2c82e37b1756569d10b3a9f350f
MD5 f868a1ea483ed58283ea76f08347ebe1
SHA1 5e238cca8c487a522158c9561961d247212d4f30
SHA512 1cc0f4a1a2b11cc370fd1dd5a5d58782b811fe0f1d55eb41892a285282bf04d56a1500f88b8a62266a0929dd62e19e3276bd61a9c61385aa9783f9b82f4efcaf
SSDEEP 24576:e0h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9LNiXicJFFRGNzj3
TLSH
T1827523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 69fad7fdd1578f16ee6af9c3f08ce62eb86418f38788ef4307893b1b2c7470e7
MD5 66a2c2caa603dcc8e822aca6f3f02848
SHA1 05b77f254188a429bde75af02802b987d1fcf747
SHA512 fbea61d2ce7d0d2a6b9af24778a54cf3bb93766e80eb21e436f74d1051c8bd635c21b0f8f5a6c1e07facd4f9bd9f97382a5e7c0e842025570ca02d8dc878225f
SSDEEP 24576:1JIUe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1JIUeLNiXicJFFRGNzj3
TLSH
T12885CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 520681d07dcd221092f7a11dcc76bb9167afecb2ec20b1f2ae71a78805e0c31e
MD5 b7d420d512e5401004b99bf5748101e8
SHA1 270d6b8d96007dc6de10aa8b930106d84befb681
SHA512 8d82f25381b808ec9b08f51707f81979eb822b9ed6bde398ec0e59556c64f8f7f04d9e02172793e5f9dd650b7ab36680620573d7f56aef55e11f9895ad53bfdc
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THg:xQvGAdlCEL8c/WRNw5Cb7wRGpj3
TLSH
T1D4266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 e514b528034e9e85cddc85511f02531c448d8e04640c4433fe95d63d24b3b338
MD5 512cd8e781977735610895dcfe64177b
SHA1 d00cc30973fdcbbc2447ce816bf0596b6cf19c58
SHA512 158b99da892be55c439ed6f516348607a94714ca90277f59cd4e61eaa8f6e12d60f94b14612d7f3bc425279e2cbdefa77a3e967ac37077383934d6df03e059c6
SSDEEP 24576:hwewsAj0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Klj0LNiXicJFFRGNzj3
TLSH
T1E595E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 992a6270eeeff3bef7d398627e27041e00e5acbea91ca211cf48a92d80acd889
MD5 06815a4a332254707fc1c6601f527ee0
SHA1 0c1a837bc7fef2f0c6782505b5801356133ee6fd
SHA512 c8e7e22907a6bcca678cc7be1f82c76c4f84ec93192af7ac82aeb5d1cf1439e52e469a47e7884a9f01baa6913a51df914e2fe713b45237edb3899296e0b5d4ae
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHoF9:OUEtQevvqc2W1cpV20I32c9
TLSH
T1B4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7ca631b65f8da42778c75f4f6c940ed020d33ce2e0e8f81a6fa7f71334e583be
MD5 3ceb4d4cc7936f2fbeb3ba7af35596f9
SHA1 a5919c1f8d14fd2fad884c50dff8e962a909f1a9
SHA512 d220042eadeec67ea8e929293e9754b11b1d72445cca1ddaafe82cab8718c19eae23119199a66cdaa667a05c1ec144238a4f1518e6a509de7406dcb9a760b94c
SSDEEP 49152:iCbRquA/m2yL5zLfFiV+XenmE3/zULNiXicJFFRGNzj3:noq2Vjnmv7wRGpj3
TLSH
T15CD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f3e075fb107c2d086f80a14bba5f9b9e79c5e5bac1a8b61163f2299971e0e6a6
MD5 2150ec0729a2267b702b96f5647c0b4a
SHA1 d1a75bab3559c20fe3631f3d6f354beb3601d689
SHA512 70f6b104f51c8c22d7d8e684bb5724795acd5d33ca02a8eb7098d254c2d11765f0f11924dfd455906fbd847bccd6ae98c1708e52b930caa2f43cec0b1bf44da9
SSDEEP 24576:AAhGL6IFoiwtA5l7S53P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AAM5Foiq5fLNiXicJFFRGNzj3
TLSH
T138359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 045ae613825fc615d3b64b33cec3c933aa4decefbeb00b97667d4e822aa4cfbd
MD5 738599551afd0a3da885e7e29deecca5
SHA1 f768d085322eabdacf19902d5ba9eb6f7a251dfb
SHA512 679bfa7cd10229ce5c2c55581249ec03076091e898f59513258cbad88d3b29db1a62c8954964da07bd43569199d8cebf42246de6ebcaf7074d95f0b55359fb45
SSDEEP 24576:LwuoOWo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Lw7OzLNiXicJFFRGNzj3
TLSH
T15885F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 739e99cb0391e3e3cfa307453a46cb154f8bbd813ef124cacddce9a3c884dcb1
MD5 8cb23dcab87ecade247a7451ea286776
SHA1 7cbf99a528b1a19d31e24e6e6a4ae78c17b6010e
SHA512 f37956be6eb1b1f54d01e55cbfdd9a89cffd9f5532c750c077fbe0c3d1e0e50e87556cdfb66afe934dbce84a69eb8681e5214fef78764cc606ba76a1257fdde0
SSDEEP 24576:yZut/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NLNiXicJFFRGNzj3
TLSH
T10F75129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b06e8c0118b91e4483e489e573c8a50066bf634378d6236655b24f6fcc68c387
MD5 34132599ee304df466519f42ccb5c5c2
SHA1 361b8c49e983a4e833999cf7c7724ea31c51bb07
SHA512 7c09b79476d28ee5f0171a87d230b2bc6d531db09bfd9fddf10f7b2c94ae74b0cf7699801365e0f7c124f06724fd0e1915219eb180858f26366b3b76236ae957
SSDEEP 98304:eQRQyi36YOcPDLvw2gAf+PN3C7wRGpj3:FQyiKanX+PNWF9
TLSH
T1F0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 120f8e99a7e28604a43666f8045c3391e1c1b3cc8fbca2c1d997a3cccc1dc8e2
MD5 e8bec9792962b6e6a5042586aeaf4b7b
SHA1 b049921939c0641a6159ef823963874e13a2bc50
SHA512 dd64e573c4fd1989653ba18a8b77575ae51791aaddc7013dd908b24d76d8a4241f3d4c2b3874e44020496c9b2cd99af7e1742d0ed3fe37dc889e2e77a4a061c4
SSDEEP 98304:jQRQyi36YOcPDLvw2gAf+PN3C7wRGpj3:yQyiKanX+PNWF9
TLSH
T1FD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6e44a12317e5a1f766dabea5bd2bfc5fe1d64fb88a8c3802cb9f72b0bfa43ff3
MD5 1b7df04237dec0f2ea03a3200ec258ba
SHA1 cc2f7af4db0cf70adc7d12d1266f9a0569369ae8
SHA512 33476040aaecc081d7c2f68c7ca5462ac6a2e2b8c08fb6e6d2b15623e632c6d0c3ebc0e08e4986299edc622916bfb1ffa6ba14e88ee57fcf6e9128868a307578
SSDEEP 49152:j68Qg55nhkeWu7PNU3/ELNiXicJFFRGNzj3:dthTRc/E7wRGpj3
TLSH
T179B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 646a28b061a7f3fdac9af598f41881b53e259f0016847f833e70d99eb01e5759
MD5 204b409a5cd79a21f3c500dbd3f4eca9
SHA1 af358f5a9c366c9258da5bd51e84ff2fe32cb693
SHA512 4efb4647922a91d8678fd043f76ed4b9abc15106a9542c1f713267ad70458707775a7b60949f7ad802697372f14d8e58a722ac67ef32bdbd6eeacb6f4c7fb181
SSDEEP 98304:Py5112gYy5azzVvU69nLKnhZh7wRGpj3:CLIHRWhbF9
TLSH
T1D7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 47aa196ef5df0ab821c13d5fb900f4066d34763c4d39abb8849179a505fe26f8
MD5 76d95f1fbdec61de5d38174368dc2749
SHA1 a89162303619faf599b1c091a275906b1b8a0a88
SHA512 979665de3495a1500e6d6c347d758806385b8b8c8910f13ca7309e422b4b3cd61ce66af2df7598b9fd42418b1a1c9c67a9b0bb3f50c9da5be28a03c32ce0cfdd
SSDEEP 49152:gB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glqLNiXicJFFRGNzj3:6u6JmIxd2dq7wRGpj3
TLSH
T14AD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b13fa36d61d463b09e88b67879f4c073cfd50d929dab62e42bad24c9dd0d9182
MD5 5ee89d6d689b71c134ba1ebfa45c504a
SHA1 de4baabd755e080a2da128b638defc238867c773
SHA512 54bbd6e920b41a92971d18cc46367569e7d7fe733b2f3b282065e03b22623498f0147e1b829935ac828d8dbbfd6937f0002e3e6c7df199a4115a82a78a6ec3cf
SSDEEP 49152:y1hpsNoJpF1A67U44CwH7R4x+LNiXicJFFRGNzj3:ymifPqRv7wRGpj3
TLSH
T122B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 943cbbb2d1bf8a473757c328c047c962b2b439cf62c7241253e643d457805204
MD5 9a0ae56080d6df6fad80c35d5a913dbb
SHA1 ade237a9dc81c0855f59c8f85f78b532568094d0
SHA512 1aa7b78c05b719abcbcdcd7dd6bc9a24b05287f021bc25e96b505c794c61f8dd9377d49e2bbf3cbc03f74b180b0caa7fa20219298b5ea7359d65463f5adf7d37
SSDEEP 49152:+SuZQIY0Be2KkRVtOnks6NMHqtLNiXicJFFRGNzj3:Q5dKqi61t7wRGpj3
TLSH
T18DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d6f1a282a34da3c95412bab9bec5b78f255bedb5dca0438d4abf1f03a8f8c17d
MD5 35f298bded7f730dd92f19d8d14af6be
SHA1 c880ca2eb958bebcd8fd6381afad360e36bfa9dc
SHA512 d9783082d77b09cf289c5ce019a9105bb2d6da55ccefdca67391543a9bca858c73d4f5b47f469686ac5c59f2b0025d9261734f048eb556f4d98d0ea02b161b83
SSDEEP 49152:ShtSn8EApI0figjgiDn0AP5waLNiXicJFFRGNzj3:TX2iWphT7wRGpj3
TLSH
T12795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 accf4d5c890726134b67f0f6a50ad8e9f13da0d94393fc1e0a123f0e3645c9c7
MD5 210642ad4fb2646a750744a19b6be01d
SHA1 c299b16125046128733876912f5a9213947e294d
SHA512 97f9bc1d220eed34dae4371d81a0c63c4f96c82dd5acf3e85ee5437b99dfbca653fec2e8a982361cd3ac97a02a18656e227fdf0a20767770acf0864b5f430ce1
SSDEEP 12288:EFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CC7523D255C955B1FAFC0039C6794428F5881E2DEB5618E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 15c55ac3f163f147ada1b7e6f3e499ee572efbed9c8488a04a369f65518f1713
MD5 16f472f815fbc6a4cd030e1312043857
SHA1 7157baab7024d96dde133541efd15358df3323fb
SHA512 9229281169f6f2038d0a50147a7cceb4f3918b2c1859f7d40de25112c51757aa9d1bf7ea0d4703338eb41c7751e64cf251dcd6a5edaf25e3cf81f45ff4c4ac3f
SSDEEP 12288:aWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ag/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C7523D3558955B1EBBC003986794428F5881E2DEB5618E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 cd898bdcf33addca8266a7d2e36e1acc5db3abe644fe489cb3b44b0e4ee7af60
MD5 81997887d7cfc9d3cc80068725dab164
SHA1 6bb76c1e933dc9cf746ced3d8d6bc229c2b0caf2
SHA512 279eb98ce6eb2cc9dcad092e3a61a15d9a9e248bec79b3ba36ad5280399105bd10046b1c9bb9ae0f34463b473d451bbd525e972646c585e3512d0a6593048e36
SSDEEP 12288:J8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1907523D2558955B1E6FC0039C6764428F5881E2DEB5618E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 daaca7cc90bff77c3f7844e498d27d58f1fc847fbb8d0dc6d32a3cbdd4f7ee9c
MD5 f64a1609e94bc162ab1ef77027943c41
SHA1 f16107701f24c280abdbbefb67f2638e5a4faf21
SHA512 71874a79bda88a45e3243cce58c1083e7d610a55183f8679e6cc8189d562cdec0a7dcc5547b73de12e890149de50088dde4e1b01d520ac26049a9c5153a593eb
SSDEEP 12288:2V7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10C752392168900F1EAFD8039C6764424F2A47D6CD7325AEBD3003D1E5674FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 761ad2e8d4798fa87203c88149eb9c465546fabb8017f428bf453eee04357f20
MD5 3e4c20f8a981ebcada666730e2cac16e
SHA1 b747d6f7a41895bf57064704f71c053493f59f7a
SHA512 fc4a0361fa8ae8ed45a5e4aeb42eebb9400ebba9a17cb0308bccb63f85bb065e26cd76ef69b53b71d8d06518e354ae572a4c5e0d7d5aa2ac92b846ba4f2d95bd
SSDEEP 12288:LTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ln/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B7523D3558955B1E6FC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 ba762300c47ca157ee3d8ac760659f0f9082da455b06171e7a4fcec8b80fd6ee
MD5 dc5992a51f7a18c65463002036ef0a4f
SHA1 a5839e21b034db20c0392c1b85f4a5426dd87d61
SHA512 e10c69a46cff043f7211928b5a0ad6ee98f185c3ad932c7c35b84b08d3d8fb67e7d456f008a981f6f65c9f3ee9b3729635dbf8d9781a86d8d7496a56f42ca7f3
SSDEEP 12288:h6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A27523D3558955B2EABC0039C6754428F5881E2DEB5658E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 1f27cdf834f739e8a18cef4db0714ab68b85fe597d66924e86540750310ae855
MD5 961bc2662c6b1a2ab221e0bad9df2b56
SHA1 9e8acb3950d0b5a2e2e2b7a29030a7bc5173761e
SHA512 d7868c8f701c541810ecf5ba915f3ed3918fb900c3c3984543690e1e2ec0143e0ede0a7ed44f1c35eed5797f1a5a607e3abe265a57b6926df0c92d7ebe84db63
SSDEEP 12288:OOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F7523D2558955B1EBBC003986794428F5881E2DEB5658E3E2083D1EE27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 f10cbe3e1e5f052574fb53962de94f6c536ffc7097fe5fec27efbb8845779b83
MD5 1e69b27cee5b8b49a3a05bb89c4a68ed
SHA1 353e23a849d8abfa3b0df8c96eb41ccafda00bc0
SHA512 fda5c20f2bb066cc6ff096315e9794e5e9debfd6cc446faaa974be37cbbaa271b88b911e2f9cf08d892ad102bbd63ec9a6c8d8779ce7db3c63e015a9519b2598
SSDEEP 24576:gZMEzFVSOA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gZMEzfMLNiXicJFFRGNzj3
TLSH
T183850295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 9cbc95fb78476d18549377700970027507a961e51fd7cc4aa1266445f4c3b1fe
MD5 9bf4a14cd9d0995216e93f10b8472482
SHA1 577960305c4ddf8d8e0d24e978e15995bba4ec67
SHA512 69766b186f416e09783b98d49b9097c174309599488f5fcf7cdbdcf1898562aebc8e36bf2381969c1b404ec7b0774ab567763b2cf1a91a88497048a2a5fe427a
SSDEEP 12288:5RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F57523D3558955B1EAFC003986794428F5881E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 9bf9870428c987cecfea6b1c5acecd2eb867150fc476b1101959d7a7e3d1b312
MD5 e5f671be6545f05d539fd1fc0df717dd
SHA1 74b4645d4cc202e7330e47fa27613c473d9df0da
SHA512 ac04bcb7fbbbf7b2aa2e5234b62ba8f181006519b4cd37c6a63f1cff0f0dc56f0017fb66b3c595b8035ac7532ebf6a53e516d145fdf00349cbe4e02f88960660
SSDEEP 12288:wNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F97523D3558955B1EBBC003986794428F5881E2DEB5659E3E2083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 030c86a94190ad6e03f3d601783b45bc9add40227b4f323d5ec02d0ce5504be8
MD5 19b497fe9ab6dc6cab7e3235850323c8
SHA1 603dd6ef5a45c61af5c5953ba5a7882efefe9c0a
SHA512 3a282ecd43376c11a35b4d2bb0410ad11ea1a179ae63900a93f43ddd85515d5eedb272a1d473fa059da38ce6807f226075122b5f3823464761e358e2d44241ac
SSDEEP 24576:czyk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cTLNiXicJFFRGNzj3
TLSH
T190750247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 8916222047205d5078edf32212e20bee6e046360c7bee33c83cc43ee7b65d974
MD5 eb5e002690d204a9c34539815f11f653
SHA1 cc01827cebe0d2f7603e6210e8a65ade1b14ea17
SHA512 c31891f6a7c67794bdfd13d61e4f18239dbe7b91b09b4acc5c1b9dc4e2417975ba3e7a6c64639426624c0487f48f3764ecddb09719aa4c67e7fdcba9279ab113
SSDEEP 12288:3RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1737523D3558955B1EAFC003986794428F5881E2DEB5658E3E2483D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 4a28ba3ede3ac9ae2e1807410104f4ad0dfa602b6646a48a382a5d85b9db2e22
MD5 c35f5022841e0230d309fd3003631d99
SHA1 250594b8125c7c1196b3524ab8fbb979288ef8aa
SHA512 b5b6067384fcea27dba0d018cefdb9f2a173d92b920f112b60ccd8cfa40a4b711e39b0f14b9dd53bd1f066fca101d19f44745d9b18a8b27342ef9617a9ed3a35
SSDEEP 12288:uRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ud/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA7523D3558955B1EAFC003986794428F5881E2DEB5658E3E2483D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 3a95859891e5179a36b13ff3f6c802e6878ed1d8fca8e26d3097c5f8c8150c81
MD5 d9caf15be8cd616ced57fad5f38d36e5
SHA1 0c4ee87ad0579606e510eed7baced3898e9f8ffd
SHA512 28e4e699f00abba3ae2b0a163121abf7141dfab01963ab4ac8ce28bc5e3ce9c146239b043565a09765a1618a58c770c1e35a8ca6648ad6bfab945e96acf45cc2
SSDEEP 24576:Zzyk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZTLNiXicJFFRGNzj3
TLSH
T1F5750247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 20fa6922d88f80b7eb1e574dcf7d5b9ed2b85e49107d965d861568cc07d6337f
MD5 50a5f8e4bd577a3d62c8d759afc2f993
SHA1 44fa831304166ce3335f14355c722824a7dc39d1
SHA512 e85db01d1140986c089b1ae69c0bf0498193742ee41edb0b752efdbb49e16289cf10cbbe487fd71e77e5aad97795df80130429bba6302fa5c042eb3bf0f7f39d
SSDEEP 24576:XTRaLl3z0zDW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XTMLljrLNiXicJFFRGNzj3
TLSH
T1A08502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 8f3ddf9a354d612c540e5ccbee16615a43c6e9a54b7c06f11a44cf740b709c73
MD5 db6070fdbc668598aff15d21afbd8d02
SHA1 d11f9534ec395160b2f5c32ca33e90665d78c7dd
SHA512 a5941b7d706e1aef45a85699ace3c02d51e434f94fe98ec726d6cfb439d4b90bbe8a1c8ee64f4d1919cb14dd9cdcdff068a9491d4380ab6eb4216b77719bf07e
SSDEEP 24576:E3Bd9CHKy7GZi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OBd9CHKyaMLNiXicJFFRGNzj3
TLSH
T17895CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 ddc641749f8ea5174dd11606aa26feb7d7c39c13775af017b38bd7cd372d51c4
MD5 e04de3edd318343bdc0296e108fa2a89
SHA1 6847ab4380235ef9cb17385ac3714755b6f7e3b5
SHA512 e995a5097b97a694ee3387c04890a8f3a15f014924a07b26625cabf127f5d111a08ef51c1ba81cc58d7026f621b0b35e8f983562ab1fd93ad665b63408d77260
SSDEEP 12288:7ciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7m/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B67523D2548955B1E6FC0039C67A4428F5881E2DEB5658E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 16593addd043ac617fdd8db2a3565b691f87d34c11ec23dae70682bce752cba4
MD5 ed83a97fdcd49cca52cd3e4d0416671a
SHA1 6c266db18518016449d012b964c4dbba837abc7e
SHA512 25d75d6ea3b9ae0f0378141006fd57c62b4ddaae27696ab2c07d427989e661763ac5de996e4f2403d15c5e17d00383a31079b0e0b0630b2acb84ad99059b6e82
SSDEEP 12288:0CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B7523D2558955F1F6BC0039867A4428F5881E2DEB5619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 47672abfc88ee7c065a75b9c3e753de8b3508de2273d1637406b6bfb5d7d1b25
MD5 42dc8cab698e237cf1cc78284d932f0c
SHA1 752d5fa634dc75ead41ee6c40ab98aa5856d9887
SHA512 9ce58cdbcbf18d7447a9c7e0c8429816ac260945b30ef6596ddfedbbbeaf9c662338b333d76cfebaa94658f5c8395b8b87bd041300a1fbab625d7ffc7d4d1097
SSDEEP 12288:u3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1227523D3548955B1EAFC003986794428F5881E2DEB5658E3E2483D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 39b9ce48d4b618482232e02a2b3ef5e7e3263753fb0e1685e77e40631614d4d4
MD5 1507f21315cd4f4df56d9b158a2a9e13
SHA1 14eb6e76e337bd07b3b734e299d425a638c77de3
SHA512 07ce597a5d7d477d0e43b4e6cec5c9f7955bf033c9538ccfc4e22ac5e2b7e20246f47cce2097f73c8c809dfbe6fa0e4d8af87491b421cdd661a9d91b920b1740
SSDEEP 12288:vRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1787523D3558955B1EBFC003986794428F5881E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 5ab8dd2f4b2a11c7cfde9ff1cb91b4f2c1d1ba23f002c0ba76d63ebac80d400f
MD5 139956df6dc483369e65348be6ec5cd8
SHA1 b1cfad1db258cb20c97101f6700aa58936701acf
SHA512 8785f280c81adeb8b26d7a141484a712ee171a6268532ae4589643e0eb7ecd384f144d2fb62f1463968fca69a17e300d56204a31e43b52a4dcd2e39ad5c7e6c4
SSDEEP 12288:YciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ym/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AC7523D3558955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 acfdad4b7702c0938039c07aa5ee5ff47dffa937620e9584b7171e7c724c757f
MD5 3eae3f77d05a52d3f1fb31933495974d
SHA1 7349cc5f542701072b43c3d70955b7596b6bf3f6
SHA512 c4819d355fc11451946f6e9f86a73641e6b00c2bb13e8c0b6e33f2fe0d5eab190bb892f92356247cbc7106fb9d1ecc23a15e127eaa6082ff9b23ad3bcdd98ca8
SSDEEP 12288:MJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1877523D2548955F1EABC003AC6754428F5881E2DEB5659E3E2083D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 b920dda1bae089c365ad5083c12f278ca9852fb1c23ccfb223049a9315cf96f9
MD5 4fe8d9f05a74b4e58c413280b9cdcdc5
SHA1 424420d6cc1d06d09fa58bf542f7b0889ce93d0b
SHA512 fec191f9193b5f4e2c3b6a48966b2a358c4b8eed6fa22dfebf3d6e6839338a06a7271f735a8bfc1e2df524397db52f5eff2d02451bec013cdc0e44da2e1c4b7e
SSDEEP 12288:zTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1487523D2558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 afe07160a83b15f9214278a1b97c89c94820f60ad96b00d722e7e5b2faef5aa4
MD5 b9f16a8e77c0ff1e4eb102461499cb76
SHA1 1e794d22f9c7795634ec6c211d4d1a752be11f34
SHA512 e2bf50bf0d62aee3e79b0ecda42c961baa55e6552c4df49d718d24258f461694ebffa3183f3b51aea81ac79efb53c9fd9782dc6c664ec376f10d4f2a63532d15
SSDEEP 24576:OfwvKk9RX6wkyAIB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QMnYIBLNiXicJFFRGNzj3
TLSH
T1B595DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4620756649abaee48a84650e26c28ab011fd445d7ae152eb1514c464d8644e37
MD5 4ea4d3d5a5a1ce783ffba7c6fb8bb902
SHA1 74ba6ea00f3a6ca98b23910b0938ba1638133c8c
SHA512 107efcb8fe0324111c14fd6ab1d8dfa38befdfd770a1211d0ced638752168f40b63acb454b932febf4fbe31062f63e41433737bf03cb880ba1f0e476defe5011
SSDEEP 49152:7YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06LNiXicJFFRGN:GySzPi7wRGpj3
TLSH
T1CD066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 499c21b47a27cd264b9a71ce572d08c8f3d0bf2a25c93a4e14e302c71ec77f96
MD5 52206770cb2453a68b91caac0946b5b5
SHA1 7013441714ed72c865ebc742388dddd191372a2c
SHA512 a3bc4ff73c248446d8f215a320b00b9331909eff0fc48376ebb6d7ca168b2b8135607684c91b13599aea860b43bab5b9413cf819bac0391f6daa527d23a4380e
SSDEEP 24576:N47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:N47JUQjqirIhCnDHUPfF/qLNiXicJFFS
TLSH
T14A65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 96045ce1ed9c3982bea2ea96a89f9d93773f856f5de56a85769b5442aad2fd5e
MD5 8c564cc0d2ae611d5df299c038444874
SHA1 9a0bf20f99ddd1aca485f5869877e44ddfe8e92b
SHA512 2b21df05c931972b60428b46704d8aa55036e9973b2cf093d7b4c88645964a6fed27f10812058c9db340539c94ad282bef9cbfe157737b0f0b1b7fb62f202b3e
SSDEEP 12288:1SsfBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10075F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 fc1493bfe1f1e7e50fd5e4b6315d4d16de0dcb073ca04f597b63a1b72d3f0afd
MD5 880fea42ff538fd41381371c72b2c731
SHA1 e7d859385a81a70af82d15acfe7be636ac38a08f
SHA512 569c4f6692e0846674d9ed3230d489b71a67b169733fa09f8efd0249dcf3668ec8a1ec123018b2a54d9e48c0d1dc7421fe61b54323ae9d39ae22b89a865fd923
SSDEEP 6144:4sBC2naW/Ak19IX53KAotMxpMXFv0T6IFwBkOO6lI194/J4oxpN4RYqKs5KF/32H:5RuOI6oyJ4bRvJ5Z/h+21yrxu9VYZBc
TLSH
T1D64517007666C75FC66D40725E33D5CCAB707D82EE05AB0772CC8B3FD576658BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 4563252b0cf9e9769018b39ad80455b996bd26580c62727c22abeced6123e654
MD5 fd41cd5d9310364abb89a9b65df9044b
SHA1 a3d518d4ae18ebd417d2d6fde41584aa09b89804
SHA512 6e931ee16491c351ebcdf0eb46c0cee1024ac130f7f58d88fcbe2e7252479018e07e796a56c4a858ab01aec00b5cd118c75144f6ca80fe240cb7819dd24e7a2e
SSDEEP 6144:WKEsX8A9sAJsdV355vVBsdeXYI6qrrkzd6x7ciNh+In8Oh3iP1xbK5tMxqKGXK6X:Pj/kX1XYI6wr7z80PdYi4J0C2d
TLSH
T11F65E9405536E38FD2F760B207369B4DAB64AC47B705AF26738C443ED86AB55A0F83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 38f682d4eaa562ee21ec516d3ca0a37f9232b3fddd9add4f373fe67930cc0ab7
MD5 86ed91d30eeafa5f6303ecbf5d179860
SHA1 3503dcba25b8a1f4aaa26b9d3401927fdacfe60b
SHA512 27d13b44f916428ebed0ae9a162811cc34720440a5bb1b8740432eef9db5aab9b4f3b127d35a13de7dc633cb747567aa0fce9e10f58d37713947b8047f41e5ab
SSDEEP 12288:7L75iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A07523A3568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6a571354a33e1fd0dfb8eb8c05a69d213933255e76035b66d316a0846fc3cbf6
MD5 35e69228866b347f193bfb5215247ab0
SHA1 b5395f6b75dc576b56887eff59d4ff8a9e4b2543
SHA512 db04da5b3177cac042575c986808741b211ce891d9f1afaec4686adeb40e2bbaa99ff2195085d04b42af518737b3438c3700d428a496af0aa7d065ef60b76c56
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Qgb4mBIBhGFwLNiXicJFFRGNzj3
TLSH
T16765AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 5bc17a6c321141944765bf95f7156a9c92fe2c1171b95564f229ebce5d8fbac0
MD5 0597ab0fa2a45c2e0d74258f2a602902
SHA1 a752ab4019a8cd605dd3784ab33d8bf90d971181
SHA512 74a8ab1fcd42294e0fdd078bc96c543b85eeae4a2bdafcddb28d44384467204d75d4a4c9bece23341ca867a6cfdb167af1d86a830a75b2088f7c9c6d6567e9d8
SSDEEP 24576:fG88u8FpJqH16zria7/mA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:u7ZFPqVFa7/jLNiXicJFFRGNzj3
TLSH
T19EA5F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 7551d986761659355e1878382c53789cab3488f8b5a1e77b60b45a7e7eff3ec1
MD5 109479cea984d82cbd49da4132731f29
SHA1 80c9843deeb29b6cc85a200f0469564cb0a8303f
SHA512 08eb35aa0cf027e71df1bafc21bfe258f21860d298ee28f4a9469b100c796dd1beb8702e2a6fc5de23071687de1ca324c7b0cde709cdc925ed228daf0522c6eb
SSDEEP 24576:qPUr+NQM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qJQMLNiXicJFFRGNzj3
TLSH
T13C85F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a5de77f2e3ef20859a23d1a5134cb7ec549540d576cadcb67d60468713b5b280
MD5 ceb6c0ba887cf65948c63ba1c6bc9971
SHA1 d0ef92ff0d9b83172dc412c4d3a8580e738fa675
SHA512 77ccc7bd3fedbb0fbc74217aa024252da17737df18dc506dca51e68e46c87124e24097c442bad9c2e95fe999c5a7a45ec3902ac06e5d849f67d20e8fee347297
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcLNiXicJFFRGNzj3:OG05lO43b57wRGpj3
TLSH
T182D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7ff50c1be4539baafc2636eba5de6b52327c0201361eff295ce8081e8a1c1f33
MD5 6922e70a805f82c7f12f3561cfa156f5
SHA1 c25e6dd272a7b175f656ca5c6c74c065be5e213a
SHA512 bd168c3a22921eca5041da35501acdfc15a50fd14fced18998d00575dc998be99a0e1ba1ba8f8d8eb2cb1ce8bd9085f61f905745ae5b20bd4161e5f57ea37015
SSDEEP 24576:Bfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn6/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ba5POZ3lJt2pasx2+mELNiXicJFFRGNf
TLSH
T14B65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5fe25ac5c534fffcb469ca00ff4e8987656ed207623ad97b5b73a177311c6993
MD5 736c5ff1030f5b13d7a0c3ff2a0d7641
SHA1 eb4e5702ffe43eaa8edd9f14b914ba415dcfb8b7
SHA512 8f11c3f36f8641d975ce806764d98a423ef9ae409f34a1a2cdfa590c19320e9cef7f87349c691f56da065fa3af4fb9c2042c855aff82f765ac89ef2dd8dbabc1
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4Nc/zEOVHFDLNiXicJFFRGNzj3
TLSH
T16E858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bbc64e4919b9408068ce45cade5f5567665722388af509a4e440767de06592c0
MD5 cba6c696ccc895972166805f8c592d49
SHA1 87e78c666b78c6019294377b21d5ba6d8d80f1e7
SHA512 ae0bbc5996fb2e7c8de145827e896ef85610c093bf3b8767c442ec18fceb24c21bcec1a8763a9ad83b1ae9d702223150af18768344a3652afb5d2b931ce8bdb9
SSDEEP 24576:6zkNvNnaFeYhJNtmZBmO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6zMwBtOmOLNiXicJFFRGNzj3
TLSH
T12155AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 9fa0e3c7f24391f0ab68c705c5a55e68597a157653ae6c735a19f82530bddb24
MD5 67580f15d7d41974b0ff9efe0cc54b4a
SHA1 a2756cd2acfe49d2b67faddb3d0fda3b54fa5d35
SHA512 b8a5384f468998a94b42f591b1a81d3ee68d6f1ac0a711a24195c20815fa53f6aa74cf78685e162359d2565a891b0021b1043f21a56fe536619885ac4f2973ea
SSDEEP 24576:OD3FHshBIYQgAp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ODVHeBIAApLNiXicJFFRGNzj3
TLSH
T1B895E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/356-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/356-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/356-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/356-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/356-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1472-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1472-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1472-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1472-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1472-314-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1472-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1936-65-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/1936-73-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1936-291-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/1936-67-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2400-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2400-137-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2400-132-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2400-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2408-55-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2408-61-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2408-54-0x0000000140000000-0x00000001401BB000-memory.dmp

Download

memory/2408-268-0x0000000140000000-0x00000001401BB000-memory.dmp

Download

memory/2796-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2796-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2796-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2796-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3104-361-0x0000024786AA0000-0x0000024786AC0000-memory.dmp

Download

memory/3104-352-0x0000024783120000-0x0000024783220000-memory.dmp

Download

memory/3104-350-0x0000024783120000-0x0000024783220000-memory.dmp

Download

memory/3104-362-0x0000024796CA0000-0x0000024796DA0000-memory.dmp

Download

memory/3104-382-0x0000024786AC0000-0x0000024786AE0000-memory.dmp

Download

memory/3104-396-0x00000247970A0000-0x00000247970C0000-memory.dmp

Download

memory/3104-351-0x0000024783120000-0x0000024783220000-memory.dmp

Download

memory/3752-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3752-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3752-95-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3752-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3752-518-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3752-516-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4072-83-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/4072-309-0x0000000000400000-0x0000000000583000-memory.dmp

Download

memory/4072-77-0x0000000000400000-0x0000000000583000-memory.dmp

Download

memory/4072-78-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/4504-8-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4504-87-0x0000000140000000-0x0000000140893000-memory.dmp

Download

memory/4504-0-0x0000000140000000-0x0000000140893000-memory.dmp

Download

memory/4504-1-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4504-7-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4752-519-0x000000000DAA0000-0x000000000E31B000-memory.dmp

Download

memory/5132-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5132-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5132-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5132-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5680-313-0x0000000140000000-0x000000014022A000-memory.dmp

Download

memory/5680-122-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5680-113-0x0000000140000000-0x000000014022A000-memory.dmp

Download

memory/5680-115-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5824-46-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/5824-39-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5824-40-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/5824-52-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5824-50-0x0000000002370000-0x00000000023D0000-memory.dmp

Download