b888a6334a7be25d0baf81842d4dc491c9c212823753c0470328a00a51bcf2f4

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
Size 4.1MB
Sample260718-r2ahssg16w
SHA256 b888a6334a7be25d0baf81842d4dc491c9c212823753c0470328a00a51bcf2f4
MD5 ef66c294d7a6330f41c8695853167f58
SHA1 6c384e1ba4e023e55212747604280f94d46092c9
SHA512 d2ce08c84f61d72472b098cb9488dbb7c45f1bc7915fa9352781a79fda43106189ed93a5b339542af7406375af7d35686a5bb9a6ecd9d33ac659592665d976c8
SSDEEP 49152:6khn6i/dDo2ZPPDsCxX7JzGs/xRAh+HD7c2wX+UPsPbrJKR6sXPHdrV:xyCrzBROXhqgR6sXPHdr
TLSH
T1D916AD4A32A401F6C47FC0BACA5B8507F77574581360AAC716E4866A2FA3EF15B3F316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4808	elevation_service.exe
4588	elevation_service.exe
1660	maintenanceservice.exe
3540	OSE.EXE
2056	PerceptionSimulationService.exe
4680	perfhost.exe
368	ReFsDedupSvc.exe
3868	SensorDataService.exe
5592	ssh-agent.exe
5400	AgentService.exe
4936	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5ea678905387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000560cde79c316dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f388917ac316dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fabec779c316dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b39b679c316dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
4808	elevation_service.exe
4808	elevation_service.exe
4808	elevation_service.exe
4808	elevation_service.exe
4808	elevation_service.exe
4808	elevation_service.exe
4808	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
Token: SeBackupPrivilege	368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	368	ReFsDedupSvc.exe
Token: SeBackupPrivilege	368	ReFsDedupSvc.exe
Token: SeRestorePrivilege	368	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5400	AgentService.exe
Token: 33	4936	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4936	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4936	SearchIndexer.exe
Token: SeDebugPrivilege	580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
Token: SeDebugPrivilege	580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
Token: SeDebugPrivilege	580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
Token: SeDebugPrivilege	580	2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
Token: SeDebugPrivilege	4808	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 5480	4936	SearchIndexer.exe	101
PID 4936 wrote to memory of 5076	4936	SearchIndexer.exe	102
PID 4936 wrote to memory of 1444	4936	SearchIndexer.exe	103
PID 4936 wrote to memory of 3660	4936	SearchIndexer.exe	104
PID 4936 wrote to memory of 6032	4936	SearchIndexer.exe	106
PID 4936 wrote to memory of 3468	4936	SearchIndexer.exe	107
PID 4936 wrote to memory of 4840	4936	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4588

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1660

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3540

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2056

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4680

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:368

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3868

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5592

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5400

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3660
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 33dde45394515f7b887838cc26769cd7bd9f10012e0732ead97acb6821fefec9
MD5 df95227a9d67c7be509a4bc364ba6515
SHA1 2445789d5bdd5d9533a949872d55add6f3210183
SHA512 a0edbf45c047346b911b37b77bd5a5d268eaf19e6ead5449cd319294969e4546f0462e80417a8b50a260e828e99b12835d70e545eb6c278fdbf2376173b1ebd2
SSDEEP 49152:vb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnurJKR6sXPHdrV:t3q60jBbgR6sXPHdr
TLSH
T1DFD59D03F29900E9E06ED178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 921e54fe70ff702b59281320a13abe4f3fcaff0bd14bc09652555486a4d354d8
MD5 e5686b261ea0ef105536907fd6559a2a
SHA1 37e565f3a8c60d57aadd54bd8b4d81133523da7c
SHA512 814f9b5fe0cf92b0fd0b270289cc67b76205898a64c72d34aadabffadb41f3dd2d0a8b023c9e632bc3ed6a798e4367c094a70927128f03e0af1880c23d50148e
SSDEEP 24576:HXYfDtczAUmrf+EKR6HQ4VKXPTzdGqbLZ:StcwrJKR6sXPHdrV
TLSH
T1EB65012877D404F9ED6B823CCCA28502E673BC554760E6DB03E4996A5F332D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f2cb788f9512132bafb3da5c79a7d3a7ef79deba196c4e2f6f36c1f7fcd0ae05
MD5 2d412d0a3b9a165d586be86a5270bb9e
SHA1 dc948b88c72cdb3c70ab81a4516053265b7b9ea5
SHA512 c5769efc85147626b06a8068d870f32cb7b4c6547f0becac676447b7cd1d41b9d90bae5f8f1dc48e3afa462b207c2e27b5e23cfb6ed1ffcc368fcdda564d6bc1
SSDEEP 24576:r0Le5ji0hmxTrMHmrf+EKR6HQ4VKXPTzdGqbLZ:rPji0AFJrJKR6sXPHdrV
TLSH
T18A85AE66F6748331D073C0B9C5D2A68AED7230865B3089CB4286D77C7E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 eba9f0943c1425c9e93d6a6cf6d53f536ac929527af4f68c8e1870107393e35c
MD5 06d0bf8e9c7e9da20346a1fdc43f6e81
SHA1 1048c2c369b2fd40d991538b5ca59ede4c73361d
SHA512 5e3f970e4494a55fdd6b45862ecc38b5acdc7925abade73b8181417d0f28463c2820420d98c2fab0b3e44bd9fa110ad39f6509c1285d24c9f30609a35ef0a6e0
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWr6q8wyuZmrf+EKR6HQ4VKXPTzdGqbLZ:D/ezSC6vUzPviHjyVrJKR6sXPHdrV
TLSH
T12E756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a76a187cf0826eaf53efcfd0fe29a3e11c4926a117cfdc28d0d744b5a3521a7b
MD5 dd32f050700c545d1596a222f737a7f5
SHA1 bf68fd6e534f52e29d9fc9774a0ca9ea0e930c39
SHA512 3d6287f483171dee43763e7705f25b3f3eafeb3a449c5e77a6342a099ec82c283b59b03d1591bfccf0f6076394afe400180019dd70fbeb5c5d1163390d458004
SSDEEP 24576:ZVbqPb88hv/l+b4mrf+EKR6HQ4VKXPTzdGqbLZ:ZVO88hXl+brJKR6sXPHdrV
TLSH
T128559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4b05e77889a2e648d55d0a51728c2a9686e73a8748d730e6f058123bf8fab19d
MD5 bfd97b64de9aae81b5cbc6e561f5b15b
SHA1 5dd31cd40ab0624dc9f4aae2704b55301db2c50d
SHA512 ad9d6fe30dfb930b98c20ffa9904873269cb121782e8dd0c5772f68ffac7c21cb8a274329c7d040321d9843a0da5b417764a76a859a1f4b74aca2befc2382f88
SSDEEP 12288:Q47mr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:Q47mrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1184523E68B1410A6D34EAB75F9EA740350B1BD18985168E371E978CFF0384F5F612B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 aebcfa371fc4313f9f8111f2ecae3c5313a38cc85e7670f34b390f232e39ae8c
MD5 70bb947536eb60305313a4815c291ac7
SHA1 639136c4f8ba087b09ad8ee9b7e6e027accfca58
SHA512 e01209fb988018128302adeaae35ee6c2e85abe04c69276684eb6bcdfef982ecd60822dfc35100dc13239507f96d8a6795b940eb1296d1bc7b0cddd0b566475d
SSDEEP 12288:DeBNUbTVO86UQmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:DJIUQmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T14E65DF7BEE28FCD2C27E9DB85A918600D77278304F52A3CBE165824EDE235E05E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8846f3ebe936553e390823a83de4ef32e69f14fdf47fb50757ed05b4bce21d8b
MD5 60fad283a17b9cc95f880cc4aa8ea9cb
SHA1 1055d8c1d8b3dc807ef9fe69d8f082e9d84029f0
SHA512 13736f01755f9fdbff676a36bccebdc4aa4208c796e8322647423ec30c3be03f6cc9d713a9f4ed6abb84127d430994f4c46c0ec2704d3081d5069a4c3ba73262
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THm:OQvGAdlCEL8c/RRNw5CwgR6sXPHdr
TLSH
T1AC266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1e9b470ddab22bffd24d9cd92ff35882b17ce82374ef7e6846cdf203ca873e3b
MD5 f6b22c6f31fee2aff8f188b0eacd0dad
SHA1 e61103c7ab67a1f8c27515a4e3be626fb8fb7a68
SHA512 8da7bae2be9ab1159871d4dc9e7ba0e60d840e3eb625d61d386a0437c6e950a1694880dacdc9adb87352c64b7f47958b854a38a3bb53cf2da71a0f834ebedb65
SSDEEP 12288:SAwSfxL/2Dc35DLLmt0LDQewsAjamr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbV:XMewsAjamrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T11675E071FA74E036C27F0DB22B66D706147DB9204B5229C3E3E89D8E99341D22776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ffe95e1bc537556fc42b9fc778346b015f7f4926e5b0b898f93618856d789c03
MD5 a62e3ece94347a1f4944e459c4451dde
SHA1 421e2911090770c9e10c6d88a18267cca6e57bea
SHA512 1a903f3a0347f39d0a58668a1fae9a38638e6750edd3478ea606fa38cdd7189cdf5fba414d6246cab7d53858836315bb404bec5d0d3f85b4fc479197f95ad32c
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHRgEs/:lUEtQevvqc2W1cpV2RI322F
TLSH
T1EB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ef83343db107234ebcb9bc65efc0a74a8d4ee55b056d8c9eb994ec51ea05acf7
MD5 e79a8c9e36f935c3c91972b87cb164e7
SHA1 abd231823fa31e139294048d36a2c631f44934ee
SHA512 ff686a08a45754fc50e420521c38cc8136f6f3045cfbb12de0f34c7d2ed964379777a63f9c44578c248df994c9d5ca6276b816c227a981c2bed3220c8016b6ca
SSDEEP 49152:mCbRquA/m2yL5zLfFiV+XenmE3/z5rJKR6sXPHdrV:Loq2VjnmUgR6sXPHdr
TLSH
T133D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 238647755191549fedace75c4ad735c83808ff6d405b7d21d627be26e8237e7d
MD5 02c5cef0985059147ced1da511a89c94
SHA1 c1c35691ed2fcf4986ddeea6da2d8394b3fa2497
SHA512 aa6975d2c914ba35aa2ff96f549c6d003746d5311ea6fddd8c044cc68577178749e61b3e75bddeb3e52dc1f34451a0dce61db70eea347ed1c7dd787249a7fe0c
SSDEEP 24576:MAhGL2IFoiwtA5l7S53lmrf+EKR6HQ4VKXPTzdGqbLZ:MAM1Foiq5srJKR6sXPHdrV
TLSH
T1AF35AD81E7F911D4F5B3AA7899B69171EA76BCAA5E31C20F2150D10F1E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4735fd918926369719389c8c560e18a6d5e71fe545e95d271366b4d07262cbfa
MD5 efc547db5e55ad52db4934f4f035f713
SHA1 4e1a19cc8d804e2fe4f52d72749c7dbdedc677bb
SHA512 83e8f17b1e5c924e352d5caf5275e092b06036cf270b3664a4621dfe2e902098301fa66a414ed0b7a15fc051ce9c9c1a9073a01dbf7627f4042affa0bc8734b8
SSDEEP 12288:wmw5HEjsChNoBFgl0WDm+C5mr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:twuxOWGmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T18D65F18677A408F9E5679239C597D132F7F2BC012A21D71F13A0C65BAF37261BD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 879aec0806abc4198df96f8b60f4cd19dfc3ebf01d2fc705741f9c3eb9b7df28
MD5 08395c1ffaefd3074658a86e669ea595
SHA1 79d054ae857e1fccffe5729f60d1770c4af4286a
SHA512 b23ce8bba1cdf923c47c98d5c0f840d73dd7955b1e6e5aceb8a3c873c836966d8a5efa841e25c77d306286eb0af3bb685c7e471fc6279ad6b575b299af119dcf
SSDEEP 12288:olZ1Iyqmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:yZu/mrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1245512DA239420FAD25B933DDCE15602D3B27C16573253CF22A4659FAE309D16E35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5cfb9ad137155094d8c33e33261015ae9a0c95a5358e61877df7ee3cb3094798
MD5 e63c3d66dbdfd820d1bc6fd4a46f7a63
SHA1 0066c0a67c1fa4a0da6822324c614bade20161a7
SHA512 b8f3d2db59011edbab9941984915ce9d6b6e10b9538e44040c0901683b2ef0fb6bd984536fc2ffee5f9b0fcb01b4e600f3b648de013fa5f28a18a439aa05e65f
SSDEEP 98304:VQRQyi36YOcPhLvw2gAf+PN3XgR6sXPHdr:sQyiKahX+PNngEs/
TLSH
T118667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 85d4e655cff020b3d2ff51c9e5c48268341c553acd54f19f000c65f3670acb52
MD5 54cd2edf682892e004d9f8650a4cff84
SHA1 02c2831ac7ae135c42dde44736ba91f367a9cba4
SHA512 84cbba102f7859e9e82975a799e39616148a6d5e48c253b21760f2f127ce5a0aa8f9f391c575ddb9fc1c32f8dec4969e5271d16a46f246931d1127640980ab20
SSDEEP 98304:0QRQyi36YOcPhLvw2gAf+PN3XgR6sXPHdr:bQyiKahX+PNngEs/
TLSH
T110667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 368ce6792e959b528e5d99b2c9514a321b5bdf416f509e197f161695247e61e0
MD5 1b114793c53eecd814f0a276acc35ea4
SHA1 83295f9de41bc158e5162e8ac6177fa679d4738c
SHA512 78b5ebb97dba69c50f27c06106559b5ce6b98b4b07794e27f53131dd61cda039adddb56e626fd35f366b0e77392da3468a0abcc705eae6d03afccbc432b135ed
SSDEEP 49152:468Qg55nhceWu7PNU3/JrJKR6sXPHdrV:CthLRc/JgR6sXPHdr
TLSH
T117B55A33B2F200A9C44DE1769F4A972196D17C75CFE0E3DB8151720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 80775d50d2d68010c5a32c96a3410c428f28efc542323d611c83459868a59be8
MD5 0aa1b14ca54afecbb19b102a09ab71bd
SHA1 bb38b90991495772eb85f7aa60f4c75b4a22b36d
SHA512 a50eaf5ecf891b4860b642cc2a66f44bafee55a867e7b66fa5adfeaf8821245ad225a239f0a5a5aec6bce9f83f8e026599de414cbbdf0a8bb48d1640bf21cdaf
SSDEEP 98304:+y5112gYy5azzVva69nLKnhZ+gR6sXPHdr:vLIHjWhMgEs/
TLSH
T1E0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bd22cb3312fcdaa6372b43de37bbd1e9d129c8992985e6063b6336ffe5fb0cbb
MD5 6149c24bd782b023a4e8a61a7f2e4740
SHA1 b9e721f30d9e7fed2c839c670fcfa3b7b35cb46a
SHA512 354622f633d7102d53ec86cf7b69c6cbc44743d29c0514cb8a62db045bc31824d9a579ec242c09b5f1ef14da4f44faa75f98c0e57d35863533cca25c3bbbad7b
SSDEEP 49152:oB+taZ3usBWOBr4tEG20bqx0z+n217aau1gljrJKR6sXPHdrV:iu6JmUxd2d/gR6sXPHdr
TLSH
T111D59D13F2DA01E8D05ED478974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 71fd13bfb8b55cd3064a696cf8c2dcd6b58bddb4621daf6238d025712ef5f528
MD5 ca44515dc4cac20bae78ed737a720ebe
SHA1 4cee96ef72a1e8f795c49db33312cef8e31178f6
SHA512 911a89bb9ecb729bfe216d3a0819a04691548449b972b68d30a46a8475f8be9776e0c44797f50844fbfe57b145f2c1acece611cf4900c649762b7f7f5d1633ba
SSDEEP 49152:c1hpsNoJpF1A6BU44CwH7R4x/rJKR6sXPHdrV:cmifPkRUgR6sXPHdr
TLSH
T108B5BE13F2D900E8D05ED17887569232EA72BC460B35B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 855c9900e194f31729b9f86ec7ffdaf319fe7efb091ec0b271a02c81a3f727af
MD5 1a517cf9b0caacdaca846741ec79efbb
SHA1 0b9e9f588d3bb75683dea04d029d74a8b7d705ff
SHA512 90f85268c793dc9ca5346ad68faf146598fffad9b65e0ee8e1e2961600527507bfd4e79f875ea85d16af512d518855975a7e0514f4126b87fad47dc523bc4c24
SSDEEP 49152:QSuZQIY0Be2KNRVtOnks6NMHq+rJKR6sXPHdrV:K5dKvi61agR6sXPHdr
TLSH
T169C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 80ca40e733789b1e321e0b7771e0df68eb4789f6dca487c2122d34e4947677f1
MD5 2e1f3347428a0dda9fb6d474098ae739
SHA1 aa6d6015222edb4bfeba2dba95178a298fc366a2
SHA512 ae0d10486169d7b0ce624d95940006030f1f681fc11f2512a0e37d46bfe78d7837f1fb34a3b250e077dccf3d9c90bbff58b91d3378267f47e1900fd0132d709b
SSDEEP 49152:GhtSn8EApI0figXgiDn0AP5wzrJKR6sXPHdrV:HX2iyphIgR6sXPHdr
TLSH
T1EF95BE13F2D900E8D05ED178C7468632E962BC150B35BAEF0A90B7561E7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 373454b1c405dfc3bf8c1515c30ee64774bf15a6ba87e0e0946e072917ca6995
MD5 95ac29d533eb2425f0905d1179cfa3ed
SHA1 7bf6462ebe5431f2c792ec7fbda74eb53b4fea2b
SHA512 bf3a62ab15237ee6687a2ba6dd22294ef932806fbdc89fb13c82eb3b3a843160eeda0bc6cf92f903b201fcd99c4276448c2ff9e8bf5b3376255e5de4aa3c0c46
SSDEEP 12288:ITmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:ITmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1E94523EA9B1400A7D20DABB2F9D6750360B1BD1AE85224E372DD74CFF0384F57611E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 cf52c8e6d7929a76e21366471bf6b0c9852ad803c363bfc6065257e4625ce8fa
MD5 8ed2f98ad0551cd8ddd51e9671440658
SHA1 de3440eef7463cd38dc9ec3b2577eace35158dd6
SHA512 29ca7a293a1ffa69170619b853b01cd0ec6bbfa0938bd1bcea9ac6404a69e6136274dc00b6de3af8327e07b561b59c72bb6d1f26793fbc335ae03c61caf7217d
SSDEEP 12288:EOmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:EOmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T17B4523EA9B1400A7D20DABB2F9D675035071BD1AE85224E772DDB4CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9c1e0f82201ced9d88095f85499124ad7a939a6ba73f9bc564be09a8ca46bac6
MD5 f21196d431f6e244e6f4692ecf2f924c
SHA1 e85fbef74eefa7b28dd003e6dc32bc0441e50fbb
SHA512 a119df215f5fb01a5cce399e371fcf8f06e9bfdccb749c9b4102303a940914ad5a788bbd72b90cf04b5c71d5883d8ba376bb7f0a56d3228d601b9bc40920be63
SSDEEP 12288:5omr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:5omrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T14A4523EA9B1400A7D20DABB6F9D6750350B1BD1AE85224E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 40442b2cdf27dbe8a791ba0059e689e73cbf15f4f6071005fb7546f65c3d733c
MD5 a693f94fdb8913a06809bcbeaac81f8a
SHA1 0b7bf01b6925d2fb5054fe1cf358ce954e173e3d
SHA512 d54640771e57b7dc69a04618c06e225ea9f65e322260025826e851d7dcf512ce496e3d053a91e2b7c9179585ebdea1c76953e4d3e21189b0ce71cbdcfa83b990
SSDEEP 12288:2VFmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:imrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1754523E65B1800E6D10EE775E9E6A503E0B1BC19D93265EF729438CFE8341E47A31F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b11d15713cf117f376632dd6b5ab0d9d1fd68be22533ec2aa904f69d3c2d0e93
MD5 8310069558c7e05592faa4ffbf95f241
SHA1 781bc034baf3da978cc2690210f60ab514897b8e
SHA512 701d9847806962df5579348b533e370e13166304e2918f26232dfa676eeb37f89536dcf6621fc59440ee4c3db74c3ca5fb9ac7e1f5f8c4ef4a7a77845a6b6ae2
SSDEEP 12288:Btmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:Btmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1954523EA9B1400A7D20DABB2F9D6750350B1BD1AE85224E772DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 35bd510f8e510de53ad70b93f9761648146f84c4796c77153977a9c80ba251ee
MD5 9566df6ffdfbdf519c2df332c8d69c27
SHA1 ae69e8c69f26eeebaa47b7d32eb9ae1a87492671
SHA512 545ec5127f26b9c7d62d346d4db89847682a2eaac1a7fcd4059db186e46bf2e1c162ab9226fe9331ff1e3cb5331f498bda112bccbffad59ddb602091b8af8eec
SSDEEP 12288:zSmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:zSmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1754523EA9B1800A7D20DABB2F9D675035071BD1AE85224E772DD74CFF0384F57611E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f5929408d88bc58e110cdfbbfa04be93159325ffdc97898bb92f771c860cea3b
MD5 af5f5cb935d7422224b322417fa038c1
SHA1 f555c5d1498d476d8c2244c19fe2a88f76b8d3b3
SHA512 0ac445019998f8e6f0a8d6d2b2c9c7bb5f3d7c768d94fab5de223e592c3de8be73963a0cd2e217f3749bcc0488ed3a82e72ce4ebbce787253255391b889f3992
SSDEEP 12288:12mr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:12mrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1E34523EA9B1400A7D20EA7B6F9D6750350B1BD1AE85224E372DDB4CFF0384F57611E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6456fd2de8a3fc0ff61c47168b5348c1984b9767b09e74538890c955cbb43ad5
MD5 e4867a8c0b9006ca8bf74fd8dc46e5f9
SHA1 1a26b3a1c39e5ee8c620ffa5ae02371a150400ad
SHA512 69890e6fee9b37944a4db8f72c58baeef28dea0e2a66a5d4f9be9bc75c9af17a5e30538f5ce7c41fa323f6249b829f9d3b2a541ad764b64d9af20989d91af5be
SSDEEP 24576:dZMCzFVSOumrf+EKR6HQ4VKXPTzdGqbLZ:dZMCzfhrJKR6sXPHdrV
TLSH
T1546501A5B35018F5DC67823EC9559902D1B27C1A0A60C65F13E8366B9F333E12D3EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a1851dad51086787f5ad1a2e43624527e7e66e2a0e57050be30f41214f2ea5f5
MD5 509de4aee2b12be7502b263376481c6d
SHA1 3046bf97fd7b180019c7b9a901bdf4911e704f9b
SHA512 0e253b7405d3257fd201ee9356559c7f869d77fca913459bbaa75b593d3068ed5e9576a6af468baad17d8f4b7fbe6a0f7838741b425b46878da55fe5cdc4f768
SSDEEP 12288:pPmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:pPmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1BC4523EA9B1400A7D20DABB6F9D6750350B1BD1AE85224E372DD74CFF0384F57611E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 455274f59596fda1fc9197ec508c6505ba29fc4e947d23256af4a7e42261b8a9
MD5 e48a95868c2c54f7d830bc61b29d86db
SHA1 be0bd0b66f37c59f67baff66e3fe2d2bacb6b9ba
SHA512 340c0a2722dfc8b1a84d8e1bcd1ded3c8ac05b8bf7bfbc4acce7abc8609853d111b149038bbedb88ee1b770498a41976193a41f5159f28c323fd0cecf4a72a01
SSDEEP 12288:ULmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:ULmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1374523EA9B1400A7D20EABB6F9D6750350B1BD1AE85224E372DD74CFF0384F57611E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4a0d9d0d0a2232f8a527821bbf6fcbb4fb853b9697719326f124a0cff3f88fce
MD5 a037135350cdd4c98234321b0d4795e9
SHA1 d7ba151a7382724f9f52af92109d5fd2baffb5a1
SHA512 f5f94c39382f08123c5c964b161b844909af3b6e7612c303f399322703ba91bc0621f83dfc675362add0116a93d230d6d799e37a414847ac14c62de0b59db3c2
SSDEEP 12288:HyPz5L8qmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:qzyqmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T14B551257776130F9D12B9235C8921902F371BC36472099EF23A456BB6E365E06E3AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a3e68518d37100095b93d357626852f9fb501f5093f2b81febde3170d099c2e1
MD5 ca068d266d93d59624ab7b9f7ff618d4
SHA1 dcadf3364e69a69fa214b5f76464af49fe5a5627
SHA512 4519a59e9ae69dc001d7c9c6c77c20a67564e0a880337f783ae18f83e2cb2e38dd74f4437b022122c1bdbce2e8589fc0036005466d0d9ad556b60acaa4e8e209
SSDEEP 12288:GPmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:GPmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1C84523EA9B1400A7D20DABB6F9D6750350B1BD1AA85224E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 dca423cfdd8290a5300d9ef0af2c29205261a7f54afcacadf303dd3bdf046af4
MD5 16e4dba2927415f9347008604bc1baf3
SHA1 537a45428d99b9c019f36ad64cf1a3ac04a42bec
SHA512 44c122f62ca670901d1aea72109eb94176495e94fc5d37923a4d76e42727b78ea8fcc3daeda23d95b71753688ad63121d597ec9d37acc1c00a56e23a3f51cb94
SSDEEP 12288:hPmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:hPmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1074523EA9B1400A7D20DABB6F9D6750350B1BD1AA85224E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b942c75a8ca5d2851b744e9d0452d9dcba9843a387b74cd451c25d0aaaf14645
MD5 e29c64059fc4cc1df34ee279cfa65c27
SHA1 0996451e985d3a39e0e4307a98da21b792dbb970
SHA512 42728c93e9b332c285873686141d807085dbdb607e0f9939d6ad1316a608bb0ebd74802abda847b032ff6eb6d79877b6d0433653f1bcaccd43a5f82ebda7b582
SSDEEP 12288:ryPz5L8qmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:Gzyqmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T12D551257736130F9D12B9235C8921902F371BC3647209AEF23A456BB6E365E06E3AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 87c8cd364b2ca898ca5a19a8dea2e48ac2a66380701504c6eb5573202dccd472
MD5 7f015b90f8eb822e5d895a209331d4a5
SHA1 c422e440d00d1eb0dd22b9618226a858d831d07e
SHA512 2231140fe75298391f6c2ced856d1c86324a2aa2c05d7665bc2d394df0a005629931670ba6e2c59c583659baa25014c3c6028107a1df9f938ef8979f237f85d9
SSDEEP 24576:tT7aLl3z0zDYmrf+EKR6HQ4VKXPTzdGqbLZ:tT2LljArJKR6sXPHdrV
TLSH
T1506501A5B35018F9DC67823ECD559902D1B27C1A0A60C65F13E8365B9F332E12D3EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 17a87a90c6821f236d83c86a29e11f85a0ba02a37bbbe7ee8d1256b6e2d4dd93
MD5 914f4b47042f79bf5a53a1ce018f0faf
SHA1 a88ff75a6cae0d69992557826b7819a088e668cf
SHA512 2d2794dba79210abce66b786499201c1b77143cdc35184d2ac518477c936090feb92c09027dfb9fe16d6e238fe279cf11761f6156877206bf84183bff6e65388
SSDEEP 24576:p3vd9CHKy7GZMmrf+EKR6HQ4VKXPTzdGqbLZ:5vd9CHKyahrJKR6sXPHdrV
TLSH
T1EC75CF90F3E410E8F0B79A35C9765502DAB67C5A1B31DE8F03A8255A1F33AD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3632181d95ff026bdc8e1ad0c228cc0f93cea7a347ae5fce62c3b46ce7ecd42d
MD5 6176493de84afb15ddad9cd470ba9ff4
SHA1 9bcc642fbd17fce5479bbf837cd4d9a15ed8f776
SHA512 e705ed5912764f51a323b47438a0378a97f437b1ea8f522c544f99a42fc1362e70c9da84bfefb231b8e97608740eead5679077e89c70e4db4c9b9b1bd1d340f2
SSDEEP 12288:RImr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:RImrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1C64523EA9B1400A7D20DABB5F9D6750350B1BD1AE85224E372DD74CFF0384F57622E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0ecdd699aecbfc267a44e1361d5ef2d09652715e97585c794fa1d4e9b9e60733
MD5 b9a854a1eaa7c4e2235059f973dc5d8d
SHA1 dca8fecc30ea43a894a4d834788accc9e45bbad6
SHA512 e9045253939a12d8168ac821369e126b1947cab4e872ff931b3aabcdc55cde5a0d65ddc7ade7d0a7acdbb43beca934ce5488ccdde3e45a282cae3f27f3e59e2b
SSDEEP 12288:UKmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:UKmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T14D4523EA9B1400A7D20EA7B6F9D6750360B1BD19E85224E372DD74CFF0384F57611E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 567a4eeb10d38e86ab02d7dfd2bd2cc51304edd10bacc621fa2befa5419404b0
MD5 d926888fae722c72b8b8cec08f66168a
SHA1 9812f7eca913f2e40a0e3794b0497d12d7f90309
SHA512 707fc53d15489aa3c24e9136f290fa602de77cfd8cfbda9243dbe66d191a18eba280b141362f60c36eef21082d3edb5506278898f017238a72150dfc6500a4a2
SSDEEP 12288:ahmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:ahmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1684523EA9B1400A7D20DAB76F9D6750350B1BD1AE85224E372DE74CFF0384F57621E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9a519e6a677b8a9fc0c78d3b75ad8b677df0d858e1cb71eddd325d421183686f
MD5 9a20140bf9986551f83d59385338067d
SHA1 257938e9ec8792829452bfdddec8d04f5c6a39da
SHA512 29fcd486e02db6a907b61b6df5f08b76565c0ca8d2480de5fa2923ea6d4278e334de51e6e8addc7c6af9c1674bd5d7dc54354638b13c3195d8d268450406f8e0
SSDEEP 12288:APmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:APmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1974523EA9B1400A7D20DABB6F9D6750350B1BD1AE85224E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fd9d23aaf0639de768f13bfd745f68b8053e94455f382a13f913d75f5c83f355
MD5 dc096a28725d7f61b81bf96c35272716
SHA1 0706f05a1c324ac5b70b644b4636cf25d628e0bc
SHA512 23420b2227d798d02612178b8eedc0aac6ab951e2f48ae12f7c0ef919002e3d2547d94512d5ae810c235fed3559164cef94ccb2ce13f3211ab43eef2b0481136
SSDEEP 12288:AImr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:AImrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1034523EA9B1400A7D20DABB6F9D6750350B1BD1AE85224E372DD74CFF0384F57612E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 72998c109db87a098a5ce431b291061a7214d3624f395e01abad71775f7a6f77
MD5 ecd6bdd1d2965e4c78d0e05cfe3e9bed
SHA1 6b7a702b83860dec1e3e40fbf36e4885d0f34342
SHA512 c9b701ea5d003522bf5c6df751646fe0501ab5b238db9a7cc180357603e526bdd611906cb323bec13aefc3439790743413fa1d209dd2eb2e12b907ed9cc53821
SSDEEP 12288:w3mr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:w3mrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1FB4523EA9B1400A7C20DABB6F9D6750350B5BD1AA85224E372DD74CFF0384F57611E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 599f8dc5115388772dd6efe21080fdde2159ea14605618a225cea74378951f33
MD5 cbd53686bd435eff17983d35ecd1831b
SHA1 9134b7b67b7226b33a6442c642bdb77e1468bcb8
SHA512 c9b917429d28d0c90930d8968c6d2ba63bc3a8fb4bccd7ef3a959d9c221ad360107e8d98a58d3b9712b29acba99c59156d436e09764b5a37171ef03e7e63b907
SSDEEP 12288:mtmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:mtmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1354523EA9B1400A7D20DABB2F9D6750350B1BD1AE85224E772DD74CFF0384F57621E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 0e99d039bbe8f050f9496ad1a9f86eda9e63a0ab64b94c873956115d2f85a118
MD5 691aa1d97764e7cb14e1fb2495d48fc5
SHA1 9d639031d528c713208553b305b048504429c058
SHA512 f68b29890fe07e158fb66aef8392620cee9d30a2cfb18ad4f88879fbb63a5d2f7ad0fef9c7712484cb47f1fb4378f87cc207f5268e927e49bd8c7f2614e82390
SSDEEP 24576:nfwvWk9RX6wkyAIbmrf+EKR6HQ4VKXPTzdGqbLZ:HMnYI6rJKR6sXPHdrV
TLSH
T18985DF29EBDC04E5E177923C99B74606F2B178191B31C6CF129A53AE0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c0c6340ca7b29e1a1d4041961d21d21b22ea3c3868c5d0d665a181e6e767a80a
MD5 6fb4526e13839ef1f6e966f207b26253
SHA1 30187b323f125f5b2e1cc070edf74c8e8dcf1333
SHA512 b4e31e64aa20fd615fddf0ca623dda92fd2e92625f5226f3808d400d1fbc79ad25f7f376dc2ed2d5505a8d67752236086364766cb69e5f0a9e2398e929059911
SSDEEP 49152:TYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TrJKR6sXPHdrV:NySzP3gR6sXPHdr
TLSH
T184066C96A16801D5C1B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e8cc86f9a600d4f0efed20246ce6f89d3b4c51f81993e25b73d929e79755ff8b
MD5 d325d8e969db960ec369d18b9d64e231
SHA1 53205ae76be9aaf6172687b1669aad5acf99f7cb
SHA512 a8230b7159ed41503a85e70db8ea7cd859a21f2bceb181d2c1dcf30b2f395934730eb65883f1e2932e7f3525ccd549098534048c0897ef65835aa2db6ad2a830
SSDEEP 24576:M47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY+mrf+EKR6HQ4VKXPTzdGqbLZ:M47JUQj4irIhCnDHUPfF/jrJKR6sXPH3
TLSH
T1EE65AE1EA3EC01E5E1BA927885554A1AEA71782D1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5614d9f6fa1c6df3ebb14a0c65d9b2b6cca2300009df02bdb9bda01860325925
MD5 fbe8e495735f21cec160306a2332d32c
SHA1 c37de1d737143ac8d33ec9cba4400bf51e579446
SHA512 e2e6c5c29fbd8fcdcd144bd300083bb08260adf3e38141c7ab7917c725f69d9868478676a478ed752954a9ff2fdc3f6a2c92b913e3f1d4ee1a3c06dec26a4135
SSDEEP 12288:b8sf/mr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ://mrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T11E55F15AD25801E9C05EA275CB965A02B3337C2587E1E3CB62D0F47E5F345D0AEEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 02d2ebf26cb2c6753741e0fe03aacca97d70a95de970a09905ad21288f300907
MD5 90abfd28078fd6bf0269795ed722777f
SHA1 f1c0bfa51cdcbf1171b3851704c3cc141d4f6e5c
SHA512 0f8e4876efb3bbb3b9cb426d09fb5e7b0d33f0e22c69af9334e0e9ee44efcda47a468fc5ace39e63ecb8df476473baea0ca921381256c02e4d8db191f9e5e705
SSDEEP 24576:Hz/yUPLV0AzyckFqJrRCrmiaGaBjlXmD:zyUDVpzVZRRCCinaBjl
TLSH
T1E0350641766BD78FC6A940321E36D6CCA7607D01EE09AF1773C8873F8576668BAF1281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 72b7c4dc7aedeba1effb18c91a496fcc0a34fbb917ebff2e72d0076181211941
MD5 5bba54e5386d39e23e89209ca71466a0
SHA1 7a56e6d0435f596ca5e89b9ca79493bd45edea0c
SHA512 51d37f023b0673d560688ec7bc2ae7590bfc065e25d475e73f4d34e71c93138f26eba83b80ff8e44d7b65edeecbb4d89e6eacd435f8a50d5e3d2c078fd6b7ad5
SSDEEP 12288:0fs0pQr+tIX7UlGWLotS/0ULKqXvHZavjap+t+NQQoe3ej+fWX2ZhJArdgz:0fs0pAuLiKT2SPMvup+R2bJ0Y
TLSH
T108452A4165B7E35FC9BA90370336868DBB685C06B7493F0573408A3C9867A7EB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 406dde5c7d72fdd1669cd77d76076a29781ddf8ce813629a1a158eb29f654977
MD5 d1db7ff7a82567fef284dafc8483edd1
SHA1 3e0071b6633aacc7c5f57be1f4823c223bc3edcf
SHA512 2a4cd05b884a0f0f76d4b5c2057ca2753dc3edca0fdc02256ad1a5357eef7fd4267f096c97dae4a1893adf73dfb5ef2e880e5ee863a324043559cc4c52b57894
SSDEEP 12288:wH7nmr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:2nmrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T1534523E687180057E11EAB71F9EAA1032066BD299F1164E3B19974CFF0344E5BE31F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9d2e4a095c470b2c1801cb6764b52c61a2ae7cbc0883bf2cf4be06e3a46e6714
MD5 850ef5ad667d00f0f20ac9d77972ea1e
SHA1 fbe47e7ae9165cc188fbfbd50f773703cfd5671b
SHA512 bcf1d53aa8a794e16ce0b10c9b6db94dddea0206ae6075fc16212e2ce06268442ab772e9cb6350d914738c743b8949c07404e9e5c1969cc3a4ab2d55752f1cd0
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYZmrf+EKR6HQ4VKXPTzdGqbLZ:Sgb4mBIBhGFNrJKR6sXPHdrV
TLSH
T1BF65AF1E22EC02F5E0F9E2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 82c662a9cd49a691052b26b425928bd9a591a48524a32c14f57a672bfa3fce82
MD5 c04ef10d1687134f6238bd7ca36fdd75
SHA1 0ea574b161ba2f344ebcf578b6ece76035466294
SHA512 d62b3170dbcdb1aea616784c56a22bef35461ed8bda993368d301b3da3f400b03f51d27e974fce69b88a03d58e123afa943bf0f90187e09803bdcacf12c9c64d
SSDEEP 24576:LG88u8FpJqH1ozria7/mumrf+EKR6HQ4VKXPTzdGqbLZ:K7ZFPqVXa7/orJKR6sXPHdrV
TLSH
T1C185F16567E001F1D47BD13889864663F6B2B8250360EBDF07AC8A561F33AE55B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e194700d4110f536a2dcc78bd9355ce1598d1926169deccac72e064ed3affbc9
MD5 0de7803f7b3cece36ae9c6b12839fce2
SHA1 fd61158f488b4832c18b214c34cf7250e00c0c0e
SHA512 a1aa32678d1a8baf38bb8058d60989ab9ee252deb218d5429916457f8abdd24451fa2771cea602f5d969604457282b71652d42ece1f5549ddd7fb22dbabdaaab
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRrJKR6sXPHdrV:zG05lO43bWgR6sXPHdr
TLSH
T1E6D5CF6E62EC11F9D0BBD17CDAC6460BEBB23815033556CB02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dc471189ed22b75b4f7aeb2b2326cf467d18388beac9fe8e3cc74edfe81cd7c5
MD5 a0a36a009fa22c22f874d404b6507342
SHA1 b5267eee23b11c103a3db6628ac7437c35dad157
SHA512 d9d28e00e574ccba23e1700644d2cf0547b39ef5cee97f330ddbaeba6bc85e33669d5acf3471acc5c9f478df4caeecdf8898cbae53b57245da1ee5809feda709
SSDEEP 24576:/fa5POZ3dpqWVM50JicR2hG0lasx2+47eidn0mrf+EKR6HQ4VKXPTzdGqbLZ:Ha5POZ39Jt2pasx2+mJrJKR6sXPHdrV
TLSH
T18565AF5EA7FC00D5D179D17DC583861AF5B1342653329ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4de2e1e2ca2155f67e1117a2f65253f88f7a5fb2a7ce706c608115c4dbc2bfee
MD5 b8b79bb0999614f52f67c3e4ca65fce1
SHA1 0f7336295a9546f1c2780391d5dad19949794683
SHA512 c4ba0d80a9d6b3f4feef45c0df54a48b5a132b0fcadffe6598e210c1483971c6a6243a1ef4ce835fd0ed40f9a4cbb8c505d6cf2cd3ee315399170a700eee954a
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7Fkmmrf+EKR6HQ4VKXPTzdGqbLZ:nNc/zEOVHFIrJKR6sXPHdrV
TLSH
T1EC858C5623E901E4E1BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d4cd3e6d88d2fc1c88f599a549fc29b7e94ce75a94795c96eb118c07ed1d428d
MD5 c43c8552ba4b8cd2d8dae91efcc07bef
SHA1 399fda7cdf4c2c50d85a23cf81361ccac37e307d
SHA512 44a0ad46d766019e261046e7b35fca25590874f62e314db510643c0e50e8bcadefb76fecbb5ba26f91217b1ff11a436182a7b7512abbfa5d6e603691c451575b
SSDEEP 24576:VtkNvNnaFeYhJNtmZBmgmrf+EKR6HQ4VKXPTzdGqbLZ:VtMwBtOmvrJKR6sXPHdrV
TLSH
T1A255AF6EBBB805E4D1FEC6B5CD238512E6727861073292CB5290C13F5E279D89E36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 801ae00ed200be912eb0bab9a5f539aed60693651740c8246fbfcc5684fdd7ed
MD5 ecdc71ef63bf0bf47a448377defddd27
SHA1 0fb2b15bc6e48a5895c40f253140a08b3138f14d
SHA512 aa284e6f924a009bc65f0268bb72b227b9d703d2e834295a62af8f2fdc8ab145710f376bc287d2f938d9f9be15385af096fd2cf4c5632f47524fd22aafdf9dbb
SSDEEP 12288:/HvUrBFrEjwaQimr7jcvEKuutZ65tS9QML0VrKXPTzEcGZOvbLZ:/PUr+NQimrf+EKR6HQ4VKXPTzdGqbLZ
TLSH
T12965F26F62AC18E5E67AE17DC5828609F371B862171292DF02D0817F5E37DE8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 78d828f4f2373ac5a907195ef56e9e8cf443357ae26535ee0e8204a9a155574d
MD5 dd453b42abc1549f3b611869e1c9b083
SHA1 be78eed5257b9f1a80b2d21b6abe6dd9c9222e56
SHA512 afbdd5d4e8c2cdadd6b7dbbcf6fc7ff8586fa8ee9a9e0ecf2e4f88c6ba5b27d3855b395ee43c30308725fe3d4c82240a9e8ea43ca0c5fc1692bb59504f5b1b64
SSDEEP 24576:hD3FHshBIYQgAzmrf+EKR6HQ4VKXPTzdGqbLZ:hDVHeBIAASrJKR6sXPHdrV
TLSH
T15775E17EE75C00E4D57BD2BCDAA38502E27138A9032265DB12D491BA5F2BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/368-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/368-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/368-329-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/368-97-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/368-91-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/580-0-0x0000000140000000-0x0000000140417000-memory.dmp

Download

memory/580-78-0x0000000140000000-0x0000000140417000-memory.dmp

Download

memory/580-10-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/580-7-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/580-1-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/1660-40-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/1660-51-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/1660-39-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1660-53-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/1660-46-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/1660-47-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/2056-66-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2056-68-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2056-74-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2056-295-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3540-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3540-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3540-269-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/3540-55-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/3660-328-0x00000264594A0000-0x000002645972B000-memory.dmp

Download

memory/3868-109-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3868-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3868-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3868-103-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3868-314-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3868-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4588-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4588-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4588-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4588-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4588-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4680-310-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4680-85-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/4680-80-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/4680-79-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4808-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4808-22-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4808-15-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4808-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4808-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4936-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4936-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4936-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4936-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5400-137-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5400-135-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5400-129-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5400-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5400-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5592-313-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/5592-123-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5592-117-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5592-115-0x0000000140000000-0x00000001401DD000-memory.dmp

Download