Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 00:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
- Size 3.9MB
- Sample260708-a7tp7agy3z
- SHA256 b55d22c23e6d74120ad1df306b2012b0bd5cfccd0c71f58e4a71538fa41f93b5
- MD5 bfe2c74394aa2cfd5677e3cc6eda76c9
- SHA1 317d7aa99242fe4d90703b2c56b16aff82d86392
- SHA512 f6afa51a1943515d526dc857b77619974adc3ddbc2de51a6f8b4667f91b0d6df8f389f55566022eac92dddd24e7e43fad7bb0348a58408749180bd3686212f82
- SSDEEP 49152:J618HANVYU4rctjqS6Dq8M/fT2DBoMWhy51oX+UP8Y80i/+K6bxW:xgnyqd/fT2cOoXhEYu/+K6b
- TLSH T12B16AE4A329002F4C4AFC0BDCA5A8513F77574542360AADB12E886792FA3EF55B3F716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 11 IoCs
pid Process 5652 elevation_service.exe 5836 elevation_service.exe 1152 maintenanceservice.exe 3048 OSE.EXE 4244 PerceptionSimulationService.exe 5296 perfhost.exe 3500 ReFsDedupSvc.exe 4800 SensorDataService.exe 692 ssh-agent.exe 5448 AgentService.exe 2776 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\951c6b3c3cd8d80a.bin elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b16edffd730edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000886452fe730edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000029903fd730edd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea3e17fd730edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aefc3b3d740edd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079b6abfc730edd01 SearchProtocolHost.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3575702013-381963388-2545377694-1000\{DDBABE03-3744-4B91-A30C-FAC3E9EE67BB} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3575702013-381963388-2545377694-1000\{A8551A8D-AD59-4BC6-A32C-44FCA8B5F30B} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe - Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe 6124 explorer.exe 6124 explorer.exe 5652 elevation_service.exe 5652 elevation_service.exe 5652 elevation_service.exe 5652 elevation_service.exe 5652 elevation_service.exe 5652 elevation_service.exe 5652 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe Token: SeAssignPrimaryTokenPrivilege 5448 AgentService.exe Token: SeBackupPrivilege 3500 ReFsDedupSvc.exe Token: SeRestorePrivilege 3500 ReFsDedupSvc.exe Token: SeBackupPrivilege 3500 ReFsDedupSvc.exe Token: SeRestorePrivilege 3500 ReFsDedupSvc.exe Token: SeBackupPrivilege 3500 ReFsDedupSvc.exe Token: SeRestorePrivilege 3500 ReFsDedupSvc.exe Token: SeBackupPrivilege 3500 ReFsDedupSvc.exe Token: SeRestorePrivilege 3500 ReFsDedupSvc.exe Token: SeBackupPrivilege 3500 ReFsDedupSvc.exe Token: SeRestorePrivilege 3500 ReFsDedupSvc.exe Token: 33 2776 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2776 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2776 SearchIndexer.exe Token: SeDebugPrivilege 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe Token: SeDebugPrivilege 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe Token: SeDebugPrivilege 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe Token: SeDebugPrivilege 4972 2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeShutdownPrivilege 6124 explorer.exe Token: SeCreatePagefilePrivilege 6124 explorer.exe Token: SeDebugPrivilege 5652 elevation_service.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 2988 sihost.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe - Suspicious use of SendNotifyMessage 42 IoCs
pid Process 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe 6124 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2420 StartMenuExperienceHost.exe 5892 SearchHost.exe 6124 explorer.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2776 wrote to memory of 668 2776 SearchIndexer.exe 100 PID 2776 wrote to memory of 4692 2776 SearchIndexer.exe 101 PID 2776 wrote to memory of 5356 2776 SearchIndexer.exe 102 PID 2776 wrote to memory of 4968 2776 SearchIndexer.exe 103 PID 2988 wrote to memory of 6124 2988 sihost.exe 108 PID 2776 wrote to memory of 1680 2776 SearchIndexer.exe 116 PID 2776 wrote to memory of 5284 2776 SearchIndexer.exe 117 PID 2776 wrote to memory of 1772 2776 SearchIndexer.exe 118 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_bfe2c74394aa2cfd5677e3cc6eda76c9_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5652
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5836
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1152
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3048
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4244
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:5296
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4800
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:692
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5448
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:668
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3575702013-381963388-2545377694-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3575702013-381963388-2545377694-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4692
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2972 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5356
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4968
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1680
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2972 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5284
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:1772
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6124
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5892
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2420
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 91dbb1600cdc4fd4589fad85bd8e6605f8935b57edb468a3879a937faff96a76
- MD5 f31f20d76ed97cf813761c0609439e3a
- SHA1 0f2d723b5e9bdca447c8932e5a603f7ea6e96404
- SHA512 b8e019fbeac1fc2fda9ad0e588ed18422c69e8500c19643f418bd7ad3752227927ce85b46f5ff063dd3a6fa105e0064c908fd8078c63b0495061163c4862362f
- SSDEEP 49152:Ob+632BuPkFKRrdE6ohQstBhuXjfS4LWxnK0i/+K6bxW:Q3q6tjBR/+K6b
- TLSH T19FD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 ed9bf75fb84c4ab02a26c4393f182a58aac9d8207e9b977d71eb1a0889d1cb2a
- MD5 6bce3506d0f65109bbadea0d09486cf4
- SHA1 6e4de95eead0e1a155d4f9f5a657c6863be5bef2
- SHA512 1a9b6f720b6623bb8f24fc93aa85a078e77962ddef6b5763e180bfe32d5cac20899ef38b3c41f97c024bb2c22ad40d13a140aba0ceba74d349c0bf9ea82bc6b8
- SSDEEP 24576:LXYfDtczAZ051dckw+1MCO6Wm/zLPFGn8W:Otcw0i/+K6bxW
- TLSH T1C905012877D008F9DDA78239CCA18501E772B8A54770E79F03E49A6A5F332D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 835591441b6334593793da6f18636b2506fd001c9735fd0b16b98b6e4015e770
- MD5 a8c9469e25a4544b06ac4ade7e247d09
- SHA1 a01f7c32fb403b401652dfb40ae300764641fa53
- SHA512 faaf31642b0859877d6a9ca7015e736dd9d4acad9a3efe9efa22d51be7f7737690cb22993d813de19ce6f66a89cd6a2808d3dd061f918008934fdff5e72879be
- SSDEEP 24576:d0Le5ji0hmxnrMi051dckw+1MCO6Wm/zLPFGn8W:dPji0Axj0i/+K6bxW
- TLSH T10735AE16F6748731D073C0B9C5D2A68AEA7130865B308ACB4286D77C7F67BE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 7b53dbf14d5659152b729b97acd8a33725c270f72e0c44d98f8603101a897739
- MD5 351029b39a1e50b9142e9dbe97e80c3a
- SHA1 7a923da0da779523cccc0b2863284bbb6b0370cd
- SHA512 a83dc324b749d4eb410bd21b294fa570d2c052180ae6bb2c57a279aea358844c25391e048e5d3657aa627b7f91f213126f5476e34ba649da493375e9c604abe9
- SSDEEP 24576:/a7/ezSC6vUyDZaqgrvWx6q8wyug051dckw+1MCO6Wm/zLPFGn8W:y/ezSC6vURPvMHjyn0i/+K6bxW
- TLSH T16A756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 85975f975ea85e51f3d98d5b6950d5053c2702b2e41bd670a0d288a4f2c02972
- MD5 595ef6c15933317ba098176c172a5be1
- SHA1 e62747b4b22f32a6439c04eea16bf0ef35895fc0
- SHA512 e6ae8e40737f9098209cc7684f1b6f778c1adc5cfd32dbc2fda42d8968628b9d716f1b9b2db3a769e3b8e7cad11a5688b7835d409bfc2fe893e614b6fd7d8fff
- SSDEEP 24576:vVbqPb88hv/lV7l051dckw+1MCO6Wm/zLPFGn8W:vVO88hXlVB0i/+K6bxW
- TLSH T142559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 2d8863446cbc8f0c5445144f6bce479f88afeaf75ff182a3aeee2d9f91e34787
- MD5 47310ec2e6cc90938e1cbec02610be1e
- SHA1 e3e7d8cdaa3ea9439babd456a168e154ab72d2c5
- SHA512 02dec13d6d119918b076ff949fae8c00a10d0e7367f00b8bbbaf4efb991596e44b7f501d12a3274b7d3d586e61fed6dab20ea4a67703cc43b47de5c7c62a53f6
- SSDEEP 12288:zGYTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:zGO051dckw+1MCO6Wm/zLPFGn8W
- TLSH T142C4230A9F060961CBEB8A320C78BD813394CCBD5979563F0D69BF8FA37D93A8502755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 312334d02a1827a3ae7ded6ce56cbe4d7e763c7501b2f4b9578b29a3bb4c6ed2
- MD5 0d5a1c9edd0f9329c0836845fc311d6f
- SHA1 69519428481404678ce3fc45e3917a66c62dc332
- SHA512 c2aab1ea33a2a56ca550afc2bf634fdd9c9f14a3a8a4246bbb7f99633d756d4e701298a894351ac5f369765a6638234d34b729815c740d731aec578c4336d3fb
- SSDEEP 12288:yeBNUbTVO86UtTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:yJIUd051dckw+1MCO6Wm/zLPFGn8W
- TLSH T17C05CF3BEE28ECE2C27A8D795A918600E77278704B61A3CBD175C30EDE235E15E75C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 5475b13ed474051158fcfa3165a42db25a15df78588f598cddbaf2d5e5372d73
- MD5 e88e2931f21ed8359e76ce7b9d295593
- SHA1 c8d8c4c90fa97b2d566606d313867d6d163e06d0
- SHA512 342d45eb650227bfd1066c4a2d439ba001fc5336903551ac8f2e6ecf012cc1216644197d5d84415516db9ccdd01fabe7ab56af280ca53bef4682e92901f93609
- SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THv:MQvGAdlCEL8c/pRNw5C6/+K6b
- TLSH T11D266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 c3ffddf5f08ec848e8924b39f45455920f99f69489bb043bd354fdbb9674ac6a
- MD5 bc53a094733ea4a0b0b2a831264c58ea
- SHA1 8a200cd401786e1db7d6dc00bdeb5641cf803827
- SHA512 7789a4acc323d8835cdbd7e51517576c2bfd45805f5a05fad15ea86e829705dda63ab12ba21c2d84c52eeaf41c2f926132e63f79f650329844cfc135a05793ea
- SSDEEP 24576:wwewsAjT051dckw+1MCO6Wm/zLPFGn8W:JljT0i/+K6bxW
- TLSH T1C515E031FE75D432C7BF0DB21B35D716246CB9604B611AC3E3A89E8E5A342D22376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 93e74ef587ca69e587ed42165d68a776d232e4a37f53e8d953155c7388469488
- MD5 c1a1ba2df2e0676f183b74fed55ada97
- SHA1 aac17243f35d1a0da91ab948796699032d6f2877
- SHA512 3857db3b0ec60fcba522286a3fd25dc966f95d4444a60be876ff81eb2ca74abc82a391dd5d2569a4015de91b6ac6b0fb36f2c5a3fd82e7a3d7bbae2e12f16679
- SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH3+Ks:cUEtQevvqc2W1cpV29I32
- TLSH T137474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 ace64275435f622af3f669d2ab827a3ece6a45d8ff4bee6cd33f2f41dac413b0
- MD5 e8197eddc25240c44e227549058c0f3b
- SHA1 f3e485febdc365b72e8754a7a1e2c4fefb5efc29
- SHA512 870de65c48ec7429fdeec583b6f4b776c4a9299873b55d052057357b67dd3a3acb2043bcb42c9513ec439fde1aceab926cb9109d0acb882a936fea9f764d6456
- SSDEEP 49152:eCbRquA/m2yL5zTfFiV+XenmE3/zz0i/+K6bxW:ToquVjnmm/+K6b
- TLSH T1F4D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 b95bfa4ef28ca6232f8985fff61ccff4e6dd56bdb5be1098933ebccb3e1a2b47
- MD5 e6056360ff68d34d68f49f70d63a331e
- SHA1 df2e73717ae26cabfc98e6eed5b3ead9f590abda
- SHA512 6d44ff0432d175a1fe49092bc3168e435311dd071bb7429befd57afb32eafb53309c594817415be3c38f3e67e1c691d802225da386a58d2a82af16953364e5a7
- SSDEEP 24576:SAhGLmIFoiwtA5l7S53E051dckw+1MCO6Wm/zLPFGn8W:SAM1Foiq5U0i/+K6bxW
- TLSH T10A359D81EBF945D4F5F3AA7899B59570EA76BCAA5E31C20F1160D10F0E33A509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 f468b85a0f0a74df07e636626b898a0f874ae276094db2f250254fcf9bbec10d
- MD5 0c9fe4d2ef9665eab4d151fd014749c5
- SHA1 d0b35b5bdb19d17c903b3b5918f6a6ed9d2bba3e
- SHA512 e266a30af4aec60592353baea7e98a946d39873694ca3cf2c725b8a0449f6966f2bc9cc8676f8778d11af63bf1dcf1573f388c79585795c9cea2322082aad38b
- SSDEEP 12288:Tmw5HEjsChNOBFgl0WDm+C+TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNo:ywuXOWH051dckw+1MCO6Wm/zLPFGn8W
- TLSH T1DD05F10A77A40CF9E9A782398957C532F7F2BC152A35D71F0760C65B6F37221AD29B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 fa41b64bf6c268e1be1a7f6556494d6219c9ac00524b9e57be77a8ac3d95e50f
- MD5 f333c6612c1c958ec24d7a359d9feaaa
- SHA1 ce828d57b10e912c2e5315c0a876fcdfd471bec9
- SHA512 4df0605f7a84875d37c19363fe8ebb7ea026278e3109115db2671455b8b39a75da725e7cff3cbec27dd7568ac9a6e9ec3c7adb14ec7ae03f3593d8d0a6411e05
- SSDEEP 12288:vbZ1Iy3TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:jZu6051dckw+1MCO6Wm/zLPFGn8W
- TLSH T140E4120A379410F5C6E786398CF45A01E3B1B8B6233643CF0A65579E6F37AE64E35722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 313c04b451f0965a5cd52bf668dbdffe0073f1927e690a47229c8f436086c715
- MD5 8cc041ee5edfb1590842763d3ba038c0
- SHA1 3d09dacfbf7c6221bdf19ec0746a41e5fc187c48
- SHA512 647448c6dc3361a67a0774305393aff437919c76f9815b880d53f7ae85b037bb3351965360057920478da1c980572c94e7c8b18725d51b4c5c48523acc07e21f
- SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U7:FQRQyi36YOcPuLvw2gAf+PN3F/+K6b
- TLSH T1F5667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 6a256aa4254e6f4faa62d9bec2188f1ccea46652056c8d1cb015a14ef3c7e272
- MD5 cffaef7469d37185e2a937acf3deeebc
- SHA1 d89075d33bbc6d664c8badda831f5e557f59b98f
- SHA512 359336d78f039afbc83f9abff37f2f114c92822b4c61a65d5b21adccdedcbb55366ae43c96d4b924df23dacd546543ebd7eb82cff92eb801ac61a24094efb12e
- SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U7:0QRQyi36YOcPuLvw2gAf+PN3F/+K6b
- TLSH T111667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 e1586d2643a6195170611075a5c7f27cef0a66720bee58f1dfb6499cfe31b164
- MD5 0a7e65e217c43c4d0cc16ab347010ce2
- SHA1 73e1cff7b8f39c64547c6b38082a290a8638c9ae
- SHA512 3dc057cc1c10aae1ec032489932cdb7cd6e270e01b979262d80b09b2c6e968e57f5adfde6c862a283fbfe0b76423b46b88f9629f4363c3709f034b150d4166c1
- SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0K051dckw+1MCO64:368Qg55nhxeWu7PNU3/j0i/+K6bxW
- TLSH T1B0B55933B2F200A9C44DE1769F4A973196D17C758FE0E3DB8515720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 da7f8ea1d2c8c45e820f4c25e9da37e5c7b6b0dc810e22e2a8a9f4a68ed5270c
- MD5 86a280a06972bec05949bd34ec7e1574
- SHA1 3280175b620475fa15f3fecfc5567ad277196137
- SHA512 26c085f0065eb2459aa8a7133f45cced273fc49cae80bc854779526942b4caaf9bc348177f1465fe7d1320f313f72192d7645e10330d5e6ef640b6fc129567a8
- SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk995:Wy5112gYy5azzVvD69nLKnhZw/+K6b
- TLSH T13E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 eaa183a36b8010ad64c7e6888fdf83172329d1199b214e50d0e61d5a209317f1
- MD5 ccba3dfbbf9ba9de7ac27554d47f9f22
- SHA1 23f7569a0b154a68dacd8cf56329de872c3b30c4
- SHA512 3b48620ffa9f78177470467214d79c87d606484a6630be73e7915f7167c6c61693ce7837fa32fc926a5cb4f9c0e1451e960aebd72ca7ddc6108a919befe8b820
- SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glp0i/+K6bxW:Nu6JmQxd2dN/+K6b
- TLSH T1FDD59D13F1DA01E8D05ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 e4c7604b226ccaf28a3d441e9b2550cb3b0946ee11d93e00d1dd4beeed62388a
- MD5 1dfbde5e574cfaa12d2f6ef14c72c017
- SHA1 1848e83c00e42f0c6eb4c3c239aea02bece117b6
- SHA512 bddd7fd67650227d3bff4fcacc54939776dc40c149783be9a4ce2964185c874b948f2a1f7052a4c7fa9baa4d8f88d3d4276854d915c504dfde7957a6d2c1d6fc
- SSDEEP 49152:+1hpsNoJpF1A6yU44CwH7R4x90i/+K6bxW:+mifPVRm/+K6b
- TLSH T1B8B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 be110d9c13728845c3dc86ea22f2f1b7d69a86fa2933d3d6aac9e92f7208ffba
- MD5 0e0faab02d077a6a2e74daf9cef5616a
- SHA1 eacaaafa8cb66ea63b147716f56ad78311fb2eaa
- SHA512 a782bf37d71af8c0c6879f0192732320e74416039e7d2b17f0b8a8246986d889ea9e8d75fcb1a34b15ca7a1835d20ab59aba58dedff410d52d83a8958d91acd9
- SSDEEP 49152:oSuZQIY0Be2KIRVtOnks6NMHq60i/+K6bxW:y5dKOi61k/+K6b
- TLSH T18BC5BE03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 af5ad99052881a3fbb96983357f7e8f0457891fdcd89471b49878c0932ae5728
- MD5 f53b932c72dfc22ca694f678905369a4
- SHA1 976df21c0448348c1826d477e4c1b1eb62ae6ced
- SHA512 ec7cea8d81dd2a52e222bf1889108dc45a0870a631c9e0b70d3823bdad57cfd619d71556f066ccd6f063db66453ff75c03ce427945efc6dd8451a6e4f688644d
- SSDEEP 49152:khtSn8EApI0figGgiDn0AP5wZ0i/+K6bxW:lX2i/phy/+K6b
- TLSH T1C495BE13F2D900E8D05ED174C7568632EA62BC160B39A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 2d7ce223a76d7087e00e15f61155ace23be74945b1aacb6a1dc3f1f5b9e21912
- MD5 0a72f65d02712197180df5652e65f29c
- SHA1 81889a0ee8cad4652254499ec81367740f056759
- SHA512 c5b14713473aeefa79a121196fb2d642e68089d2b18dac64bb8f56116faa9b1d054055f0c4c3cafced393035f85c4b796c43b7e32d838e92d3c7008395a9a335
- SSDEEP 12288:TwTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Tm051dckw+1MCO6Wm/zLPFGn8W
- TLSH T18EC4230A9E470A65CAD7CA324C64798073849CFE667E117F1E6EBB4FE37993B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 e5f4fba6958abe78d423f7a899d8bccfdf3cf3d48d90b17da335197576f98e55
- MD5 03d1f92ae893236bc4849b3ada4fc2f9
- SHA1 c5333251a5ba2a2d478a90dcd9493ea300df42dd
- SHA512 5b9eab9473b8c848bb36bf130951f2253d062b84337fb6c3d72cfa20af6251eee10333afc735e2bdae78fb262aa1444e0b672c8444de0825594507994b678a2b
- SSDEEP 12288:MzTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Mv051dckw+1MCO6Wm/zLPFGn8W
- TLSH T16BC4230A9E470A65CAD7CA320C6479807394DCFE667E117F1E6EBA4FE37993B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 74f9ee16cd3717526a914cb7ca4bfd21dd093e639f721fd1ce4e8ac38998933a
- MD5 7a3e03dee8beb77961fdb0675259d47a
- SHA1 cdd2f075555a70c90ceb5c8360e7fb51b0ea6255
- SHA512 57f685599a4a0c85bf28d24ce770fc86a534f7e9edd3abb94ac87901cd5c65685b084bcbfc0fc6a2fd482fcf497b10a985bf9adc42f3503d7cc7ba09063ceb88
- SSDEEP 12288:nFTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:n1051dckw+1MCO6Wm/zLPFGn8W
- TLSH T17CC4230A9E470A65CAD7CA320C6479807394DCFE667E117F1E6EBA4FE37993B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 404531833e79385034318e05c2c07ef54414a83a832166619e24ef9497ed55d3
- MD5 984698f1eb49bb0b48dda90737f7a32e
- SHA1 d0090bf06dc43ba606ec124b1061903c0dc6dc21
- SHA512 24c4f9a39d35c19ffd54d44daec036095aceadffbccbaf79a43afa2860a66d7a394e4897083c6f33e0302a6083f243fba6b1c6a3b9fca39caf13a7690a4e7974
- SSDEEP 12288:bVyTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:6051dckw+1MCO6Wm/zLPFGn8W
- TLSH T104D4230A6F5605E1C9E7C6328C74A840F3A0FCFDA73A13BF0E156A4F5B7667A4910B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 07363906c2f063f085995ec97972dffa05b60f08e85982e692007de0e41651e7
- MD5 6a1d30154ae8b7750cfc9bb157bed14e
- SHA1 9e0b65904591a3f1ed738248e63536c37752a4c0
- SHA512 f1f812716ea9a67a8d1bdc885b51ef883816345e552dd01b3578084a0ced3d86b0b81a521bb6bcef3ec085e606d71d8bb8bfd1b6070cc518d8b7a590cbb14fe8
- SSDEEP 12288:2aTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:2s051dckw+1MCO6Wm/zLPFGn8W
- TLSH T147C4230A9E470A25CAD78A320C6479807694DCFE667E117F1E6EBB4FE37D93B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 fd61b4bc6f54ae3516c927599eb6bfdee35e0be08793eb4761b450f6bd726378
- MD5 51007f595345616297bb214294ccf8ad
- SHA1 1fc71105212ff707d79da8ffe02954270de0cd6b
- SHA512 c328ca0b5f904cba91f7d069237c9960838492a2f34bc02ed307c742ce1b0c8b2dbad9142dce8d7fc6e52b4afdbe197a73ee7deb8b772028c02a1c435217d723
- SSDEEP 12288:B/TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:BL051dckw+1MCO6Wm/zLPFGn8W
- TLSH T135C4230A9E470A65CAD7CA320C6479807384DCFE667E117F1E6EBB4BE37993B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 17138ce0142ee55537e452ba4d79fd3d355b4a04adfac047ca6826abc3ec7ad4
- MD5 c0aec6c26063990c82ac4646564476dd
- SHA1 d28b280e4e5555fe87439fa6a282f723d1dea882
- SHA512 43a4b3fc7fd83df9ec698d428d5ceeb90ac97bb79ccf10befa2fff9f687322998116008ea2d89ed69feb49252608af49857067c662c12a50717bb8533856b0df
- SSDEEP 12288:w7TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:wX051dckw+1MCO6Wm/zLPFGn8W
- TLSH T170C4230A9E470A25CAD78A320D6479807394DCFE667D127F1E6EBB4FE37993B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 9d34f8205b68c02fc08cbac3aa6ff2e21b80e1e4882b56b19c1bce21454dde2f
- MD5 a57d485ca1a559716b0d7ca404dcb04d
- SHA1 5a534e68a830ee8e04f01dd11cdd011662af6939
- SHA512 fde7e406912498442415eeeb5e3dd6bc6f075ca5d7ea0da8ecd7cffabc1a0d78b5ec8938f3125415ca4c8f93eb4ec9c749758dc7c03a3669e49a0b2ab1305bf3
- SSDEEP 24576:iZMJzFVSOP051dckw+1MCO6Wm/zLPFGn8W:iZMJzf70i/+K6bxW
- TLSH T126050155B35008F4DCA7823ECD659901E2B2BC6A0B70C61F07B8366B5F773A11D2EBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 cd1fc5936c3099c976ff29ec03d1b3d4eeef1a1653756aebdd5c1a3fc2fc09e5
- MD5 de16deebb957e143ce0336b7622bca1a
- SHA1 a7952826ddd85a6c594d307d55cca2ed7cc47749
- SHA512 b44ff1101bea01abe701cb707498b859c2a91e41b1cbc0ee7934354b8c016011495dc1b940b6ecb7cd548f80e7870adf083d7167db189079b8e82ff4d214c659
- SSDEEP 12288:5ETauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:5q051dckw+1MCO6Wm/zLPFGn8W
- TLSH T14FC4230A9E470A25CAD78A320C6479807784DCFE667A117F1E6EBB4FE37D93B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 b7cd9962fcf645f1e86bd1e4b5fea5a475f27e7d04f050bfdb3799cd0fca2543
- MD5 a4f91597484a8af6130bfc96ab16ebbe
- SHA1 800da57d60c6a11228007ac59aa13245e6f54ba0
- SHA512 e67c8e06f9ded5589af4bc4a7401e09312205aec103fed186cf07eef6e3e5d0d139247987fddb93a0512d32d00e416c69f0c9525cf2de3ec07b125b18490c86f
- SSDEEP 12288:doTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:d+051dckw+1MCO6Wm/zLPFGn8W
- TLSH T176C4230A9E470A25CAD78A320D6479807784DCFE667A117F1E6EBB4FE37D93B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 ed19c503a16382619596bb6bcfc7168b1b2e775994f27e5b47224b464247061d
- MD5 8624d53dd6e509de815c27640fb37fc6
- SHA1 f05bae8fcd2428e26b2f75d26da2b70cb0bf082c
- SHA512 3d0d7adab7036861d33fd4208368f3ba1f5cf011abebce65e4700a96eac7f3193f1d06b52db208efe646b37acafb3c20d3fb69e7f2d203e219a6d6be78ae10e8
- SSDEEP 12288:/yPz5L83TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:yzyD051dckw+1MCO6Wm/zLPFGn8W
- TLSH T17EF4120B77A220F9C57782358C611E01F3B1B87607348AAF17A4577B6F376A15E3AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 c075c0b0e018e84f3dc93d80de275bb110f12066098aa5596dde79c6042da4e5
- MD5 b84cd5bbd1a5f8cc16a770ee87f07e75
- SHA1 7053a703b51b77f2e451e3e10bcf780e0a2b97c1
- SHA512 f312f957b03c15eac62a350c718a70c7f5f5b455673ab8638b557d47e9aadb89dbb38a6d0a7e69244233b9f94a0985850e75cd66fa16e4cb7405ed2d4de5e7e0
- SSDEEP 12288:pETauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:pq051dckw+1MCO6Wm/zLPFGn8W
- TLSH T10BC4230A9E470A65CAD78A320C6479807784DCFE667A117F1E6EBB4FE37D93B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 962baa1bc78b48bae2a341c38334f2efc1ada2b51ba26d0321b305c6a45b892a
- MD5 4432336e2ba5c856603bbaf5eda3b892
- SHA1 1008d643006e9e864beee1c7d1ce85ae998a36c7
- SHA512 5a58d5e8b6c377bac8429f8c16685025eaf6960b36fc8a038621b072295798b64004f36a2a8bc8ab543c85b303c35392304e6c342adbfd9040f842c980603450
- SSDEEP 12288:vETauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:vq051dckw+1MCO6Wm/zLPFGn8W
- TLSH T10BC4230A9E470A65CAD78A320C6479807784DCFE667A117F1E6EBB4FE37D93B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 0ef295f64b5925d094fccf0671f0a5f15d748b25121d8ef451c645201e434117
- MD5 07430e105450845bb79cef80cd172a12
- SHA1 d1e89d38b494b36bd003bac003e3d6a62841519c
- SHA512 20975d098e5c05fcb821216461e41b0c77ae681906d927fab591b19ea6b3fcbbc064eb3d3ebe6fcd968a3eca03a5301facd18fb9c959827e19f287eb3427ffb3
- SSDEEP 12288:dyPz5L83TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:UzyD051dckw+1MCO6Wm/zLPFGn8W
- TLSH T178F4120B77A220F9C57782358C611E01F3B1B87607348AAF17A4577B6F376A15E3AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 204d8977abb5880440f63688e0817e61ab8796b197f06bc8657803b231fb656d
- MD5 feca4faa74fdab3b4aa29bc210e7d90a
- SHA1 01b6152d5ef41bd902182acbf21958422838055d
- SHA512 b3639dad2300eb5786b8fd90fce16d3b0d49b92feb4ba7683ec777d1a2b1f1e8c64acd36eb355a4208c853682e079ca42bd7cb9ed67ee040bcc866b847dd32bf
- SSDEEP 24576:3TuaLl3z0zDF051dckw+1MCO6Wm/zLPFGn8W:3TdLljg0i/+K6bxW
- TLSH T1E6050195B3500CF8DCA7863ACC659902D2B2BC6A0774C61F07B8366B5F373611D2EB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 be070b0e75aa319c86fab26a628042a7ef0b3ba59fec6f069e18abcf77ce2c2e
- MD5 26eb2a635ccf97e2363a604fdf5a5b4f
- SHA1 2986d4650b11d8b5103a608f78600fa1079749b3
- SHA512 903dfbace862f06179a93e3a36230d95d7099d60988b02705f77516a9ecc56e9bb6ad5ccb065a8ae10caa970b5ff602fa8652bf40a45f0bbaa09355918d3cc01
- SSDEEP 24576:c3xd9CHKy7GZx051dckw+1MCO6Wm/zLPFGn8W:Gxd9CHKya70i/+K6bxW
- TLSH T1BA25CF90F3E414E4F0B7CA358D755511DAB67CAA1B31DA8F03A8661A1F33AD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 8328a8fd53b8c2d7590e9cfebe64396243646558341ba7399a363f0fc75c7a3e
- MD5 eb9528c1213fd58329db07471d901517
- SHA1 a9b2204cea33b3723e1ede6104dade534daac0fb
- SHA512 fad4b04b81377a79b5a047c22b529106772f0308b85a7e5245f706cbe114b1298c1a1f6e187e0a4b918fa0d3d05223bf9ec4f4f430c1d54ac8724866fb9dc396
- SSDEEP 12288:NlTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:NV051dckw+1MCO6Wm/zLPFGn8W
- TLSH T101C4230A9E470A65CAD78A320C6479807394DCFE667E117F1E6EBA4FE37D93B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 329fa1e64c9b734b816c1b42a6ed86d3cad937cf5d65a01cb9288ff0c4dd407b
- MD5 bea2a012908bef9e15c6118e91ac2c2b
- SHA1 f924dd5862ea4d0942e4d72a3c514a9b8c33eef0
- SHA512 a2916aa4ac4223cd48594c651f1b24c1bab5cc0901c1eef39e89044d91bd3b7c335fc6dcdec27979ae86af5d3cca47c21496a1d6fb89eeaf99cbc2c6c631e3b7
- SSDEEP 12288:UXTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Uj051dckw+1MCO6Wm/zLPFGn8W
- TLSH T1CBC4230A9E460A75CADBCA320C6479407384DCBE667A127F1E6EBA4FE37D93B0501794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 6c690c7fa190323fd719d0b81704ccdc9d31d99c0b537ede3b1a86d1bd2306a6
- MD5 cdf8dfebdc79e2e75ac09cc3e22dd2c8
- SHA1 7343cf3259dd692a704726dfef78406859e4796d
- SHA512 049a3625f2083a5ffc1a7f3109cb3cb31dc3b22ad12e4f207601a224948224f0e6ce1f53bc37842e13c487b670b8f4e99279672bc4139b88f8e864c97c16ae37
- SSDEEP 12288:8mTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:8o051dckw+1MCO6Wm/zLPFGn8W
- TLSH T126C4230A9E470A25CAD78A320C6479807694DCFE667A117F1E6EBB4FE37D93B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 786138222406910385986eaf228d6258fcb695d7229c95834aa6ef5c961e92ff
- MD5 0545d08a0995f9aebf8644b17900dcb3
- SHA1 80b057f1d498ad1e929c8cded94a7da6a13dbfea
- SHA512 e3488da03031f5fa633c09d7aff966b4ddc9d726204ebc024001c8b269fbf22120eb66d969fbef6df070fbc9fb6433d8b182a5b422b4c57d3ecb71426c290559
- SSDEEP 12288:wETauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:wq051dckw+1MCO6Wm/zLPFGn8W
- TLSH T110C4230A9E470A65CAD78A320C6479807784DCFE667A117F1E6EBB4FE37D93B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 cbea046f17c08de0fa56cffc151c6fb44788969540a6925b3e8d26c2fdffd691
- MD5 2914d891f84b44dc630fbd78e4d9e2f4
- SHA1 bc51def8678cbc666eebb955b4826e19d7e00360
- SHA512 3435fd11511cd2c9e96856c43d91d97f3f7c64f18042e61c41774e1057e53f0334e2f85c84d6a388950ee4447e40183303d837e50dc881bd8906d1eb04da4137
- SSDEEP 12288:VlTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:VV051dckw+1MCO6Wm/zLPFGn8W
- TLSH T172C4230A9E470A65CAD78A320C6479807394DCFE667E117F1E6EBA4FE37D93B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 b31ce2860075e8ec6a97da411ca9922334afd75443ffd68951286e722bfe0f1e
- MD5 7fc3791b36ac5d199ac062c01d214093
- SHA1 09c27ed014d704570daa02edda136fae4c8efd55
- SHA512 1a3ba712605843b51499de6d06e3304c0877d778cac67715014620f0bfd4b553bd35d8e11be3e17ec227a2c3879c59a938bb132a66cc01422db9ad23d43b1929
- SSDEEP 12288:RsTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Ry051dckw+1MCO6Wm/zLPFGn8W
- TLSH T10AC4230A9E470A65CAD7CA320C6479406784DCFE667E127F1E6EBB4FE37993B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 581KB
- SHA256 952abaa8b2105469425f5c4165b6c5862de432a9587595dda476159ecc131999
- MD5 d80f52c032f474c9fa1fee4ecad727a4
- SHA1 3c5bb8d4a041dc7625a79f8fa7356616854485f0
- SHA512 d83a9c57f1577fe7029147a8c3e5211c0047b324d80712a262193e450677695c25e206dac5c6979856591015bd1f74bc471be3fc9fe436ad452c60f40d41bddd
- SSDEEP 12288:TaTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:Ts051dckw+1MCO6Wm/zLPFGn8W
- TLSH T13EC4230A9E470A25CAD78A320C6479807794DCFE667E117F1E6EBA4FE37D93B0101B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 9a33b87aa38e3f667c5ac6b8a1875370d75a42791dab5b787955c611bc83e69a
- MD5 36c371c3577c7363798004bc4b8fab5f
- SHA1 f3e28b087c7c92adf421e5d6c53ae777b050a4d0
- SHA512 4e9ef151c73b93c3be45b4f0e2a9f78df4acc5b01f0eaf181f8e629b4c8781fbe88365fca4c693454a57c18f31be2a0d3838213ef42a5e52feefb41b95eeecb0
- SSDEEP 24576:CfwvOk9RX6wkyAIu051dckw+1MCO6Wm/zLPFGn8W:kMnYIu0i/+K6bxW
- TLSH T15935CF29EBD844E5E1B7923C8DB74606F6B178691B31C2CF025A53AE0E37EE45D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 d88e785d1a2f29eeff0ba354e0229a5a05ce473c045bc806417a1e10ebea6584
- MD5 acc6fd9f43c245151754f8406278c113
- SHA1 f3e2dc9db2c4798f3a78cbf1bab5d052d3158657
- SHA512 135467be1cf0ae871c5273b7829180d7632e6c87ecfe69b797b3fc61138aa538a579c16266f4674eaf8ee168d6ae11fb49285adadaacef6894212b19e98a250b
- SSDEEP 49152:MYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK050i/+K6bxW:AySzPl/+K6b
- TLSH T155066C56A1A801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 013f31c2fa5b8c549d16b3b9df855638d9afbea2d3dd4cf0b2eee4d2b62c3e12
- MD5 2ff01df18005abc5fa44200ed759922a
- SHA1 7afe0638dd67a32dcc6084cea8861e590710ab8f
- SHA512 c08e33e68c12a63b2937a134a900f532f197befe04a75d55c648159e9e0dff352a78727b93641cdbb6dae10b836f3270b8677d2d05261530d0c4296652c59e0e
- SSDEEP 24576:P47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AY/051dckw+1MCO6Wm/zLPFGn8W:P47JUQjairIhCnDHUPfF/p0i/+K6bxW
- TLSH T18965AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 398a39cb20031a74667aaf347d047964ace970e9debcf5980c2efad23cb1c66c
- MD5 e68bbc5a73d3379ef0cc239a1699ed0a
- SHA1 9a130136e525b45b952c1f116f9b170064dcbaf9
- SHA512 3ab855f29928c517672a6c42ebeab13e667e5f1df48a31292cc819c2f2ff3ebda86dd77d5a1a90ac5f99ce8be4da908ddde6157f60db2044a942ae7ad5da2787
- SSDEEP 12288:rksf0TauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:X6051dckw+1MCO6Wm/zLPFGn8W
- TLSH T141E4F10AD25802E8C0AE9235CB555A40B3637C6983F1D3CF16D0F63E1F7A6A55DEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 c2884f903ca31a183625f5cce99248933cc882f7315b020c6f4bf42bd0213cb6
- MD5 dace52c2eb182c0bc4d4c7538bfb294c
- SHA1 8b375104032e54a68b35ea46f78716264a573baa
- SHA512 7a9c45d192383c5fb2f2fa90745158faf4d1a1e0dc178288ba444c9633ae2c19aa7bfff1f3e60c6b903852d336ff1261813e624fe5d2c65c44e9ed4075164c34
- SSDEEP 12288:kyPpd/U3f7KT5PU0kVdnxFNgFd6FpQpAINy/aOKi6hX2FZ:kyhBUP2lPy/xFud6XOAH/aOz6wH
- TLSH T11E4528007666C75FC66D40721E32C6CCAB707D42EE04AF0773C9973E9576A58BAF6282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 99a52a83c8bdb34a4f84b37606774174d84105cba46f6aa5bb08a605a16ed68e
- MD5 0ca94bdf8c529558125fa046c32c9b36
- SHA1 a9052a594c2478cf7580a3b3ec3068e573048d1d
- SHA512 9670e9879c4db73707922b5bd18d6643186d0e175b14260f738cadeba6dfc8643922b48d69ac7814172e3145567945b6402774aa4355347278f05ef0a9e3b695
- SSDEEP 12288:JVlVaTE3qqppyi2DPpraFlZBNw/PXu/nkG:JVlwTEaqryi2zpryZBNwn+/kG
- TLSH T1A865E8419037E28FD1BA50B2172A5B4CB7A4EC07B705AF26B7CC5579D82AB15A0FD3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
- MD5 76b78ed7ff6273215b134d6a6488035d
- SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
- SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
- TLSH T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 dc915673d708e948688eae9b5188a44e71d9ce5060c4847e98cff4fe9f86457a
- MD5 6eec83d00b6f7b06bf5ade80312e1175
- SHA1 45ae7da74fd8acefe0bcaa6d85d8fdeebb6c33c7
- SHA512 a52a1956a3a36912e9859aca5bc3ff5aba510d94d1dfdadae8de744dddd0cc7a483eab95437410cfd1ec4b9073dcb987680691eea6c9c628776e40e97970eb40
- SSDEEP 12288:M07cTauCkevf+0gwavDkEvP+dfetFCCr6H2m/jIYLwmNFGuo8Whz:xC051dckw+1MCO6Wm/zLPFGn8W
- TLSH T1AFD42306DF4A0D21C9FB9A310C68A9103348ECBD5B3851FF1D19B78FA3799BA4D21B59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 9ec353d04147b8761483a3ad048dd33a74191148c81c7d73624d698873198d69
- MD5 c35c762580902f29701635a20cab605b
- SHA1 fcf4efb105a58c2427b9343095b2c28adb1e7cbf
- SHA512 a9ac8c29795260030e105430ad717a856465b2162d72e12324a1d5d03f17c4f5f9eb0ac4db2516101407d1c40222a3da6219953bcd101bdba27a29203adea77a
- SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYg051dckw+1MCO6Wm/zLPFGn8W:Vgb4mBIBhGF/0i/+K6bxW
- TLSH T16E65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 85626b6941a3de3e6eef669c7e580ef30d51f07a0aba655772fe7bb9dce2af80
- MD5 914928cfb613ac489fd6c8daa079383d
- SHA1 5c92fb306b7bc5f36074c66e80536562016861aa
- SHA512 a2225e664b43a9ee8021d344600a41beae4e860ed3746dd95e382a20a5ee1b7f8f6a71d7e8966fed7cbf60ebe90669f3927de426964bbf67a38946859aedb5b9
- SSDEEP 24576:iG88u8FpJqH1nzria7/mP051dckw+1MCO6Wm/zLPFGn8W:57ZFPqV6a7/I0i/+K6bxW
- TLSH T10B35F16577E101F0D47BD13889864663F6B1B8250374EBDF0BA88B561F23AE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 e6fdcf2e5c00b82ead9c8fd936921530ac747b7b97ffb26e2c3c520c7fe83c45
- MD5 c7d874527d8cf9226545cb8842b2be23
- SHA1 3c765e139d4e4342707ae9db11b128fb641a2ce9
- SHA512 c045cdfc3174c0eef43e6be972a5a1e1232a78ab6307021e83f2cc88a40632ae53a3ab19c8487279a484ae789f054c962ae30549da31d57c5182b0334ab179b0
- SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjL0i/+K6bxW:2G05lO43bI/+K6b
- TLSH T180D5CF6A62EC11F9D1BBD17CCAC64A0BEBB23825033556CF02A486A91F27FF4557E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 eeef0bf9f1d9aed1035ab0ce828aa9ac31346aea770af08db7e64c575f16baa9
- MD5 396343cd6a412cf445f0594c16f83d6d
- SHA1 49f7661e50211b99a23863c2a1d9e91a010d4d38
- SHA512 ad45ff7e50a6ef70da7addeba05828e7b4d10e8df408b4e28f0cbf74dcc48d8ce22cf3c5b30d17c9ed50112a7d5630068944342d6b132947524af4288633a2da
- SSDEEP 24576:Sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn5051dckw+1MCO6Wm/zLPFGn8W:6a5POZ3hJt2pasx2+mj0i/+K6bxW
- TLSH T1AB65BF5EA6F801D5D5B9D17DC583460AF5B1342653329BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 415ea6a0e70007c60aeaf568b6f2dc5029de0feb8030450eed5bbc091d11fd7c
- MD5 39ee1a7244d5cf1c3a4eff70c7ad047a
- SHA1 f7cf5e81ac05a8f8feb93265bf16c3eda0ddfa39
- SHA512 bfe1c25fe1122062bd6c1d5e4c1a0aba09144c46c4ec0446fc07a0f1fbc17d648c2a3f25f380a7d6379caf4f9b94db005fb6eefc8971149ac1f86425c958e33d
- SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7Fkn051dckw+1MCO6Wm/zLPFGn8W:/Nc/zEOVHFo0i/+K6bxW
- TLSH T1D0858B1623E901E4E5BBE1BE89779546FAB17869133086CF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 89b6a9fc12e1291f8eb5f02e3d0c977144106e761362d4fec77600530b638291
- MD5 18cd0a195bc4a87204b5a30555c719b4
- SHA1 0bc02e9ee61e8c2cc9d8c0c51e196dd25d06487e
- SHA512 a9292eec22e5e7ae3daed055e1583eb2c61b18a87934f825c8c85a3bae396c289699a39d7ce5218c157590c8bb208f19db3190949603e707086b4e19d0bc385e
- SSDEEP 24576:Y3kNvNnaFeYhJNtmZBmN051dckw+1MCO6Wm/zLPFGn8W:Y3MwBtOmN0i/+K6bxW
- TLSH T16755AF2EBAB806E4D1FEC6758D238512E6727461073293CF5290C13F5E679D89E3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 df9fe0b84385a85210e24e08d14e104aab16d2738585c4e85f044bc73ad0e4b6
- MD5 c78487b45e5b95a653d690b04db4f24c
- SHA1 ee3a7c68611007a317fc3157d8ddd208ca199acf
- SHA512 317929d11e4dc3ae7cd36f55a48bfdf40878aeff01144abcefea6cb09205a114b8a7d05ffe3b16557783bf5864c2113720ae202b1725001b8002325ba9bb2e11
- SSDEEP 24576:GPUr+NQ7051dckw+1MCO6Wm/zLPFGn8W:GJQ70i/+K6bxW
- TLSH T11405F11F66AD1CE5E676E13D89818709F771B866031292DF02E0817E4F67EE8BD39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 9f8890a0f0cc2a60ec86969272888f87cbd1220671cf485a346616c0c9fff843
- MD5 600bd1f45d59d3ed25af4ce954d831a6
- SHA1 589186f3eaa968e817d3268cde68110cd128fe72
- SHA512 32c5f5ab43b3f41e51e5abaf296827da805696b3fdb6d1da464aa88cdc69fe1ea1062d0f5277bdd43a4c6bfcb29b606e27f7310118fa15ff8116c49592320c56
- SSDEEP 24576:xD3FHshBIYQgAG051dckw+1MCO6Wm/zLPFGn8W:xDVHeBIAAG0i/+K6bxW
- TLSH T1A325E13EEA5C04E4D57BC17C8A638A06E77138AD033256DB0694C1BA5F6BEE46D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH