588e137ef14724eb7850eca15766592215cf73ba0f48a8819030d9ba51a4f9b2

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 4.0MB
Sample260723-wpvqeshj9z
SHA256 588e137ef14724eb7850eca15766592215cf73ba0f48a8819030d9ba51a4f9b2
MD5 48489753788ad97d9673094d91fd1054
SHA1 505c0b551bb8e57dc85cf5f2263506f914076ca5
SHA512 3e371919c3acc47041fe77becfbe287b9283cc7ea955b43ae03547a906cae9ea00017716291eb638810c4e3e1bd3a0018138530e0a56cea90b986291809b5030
SSDEEP 98304:iZnuomuBBBBBBBBBBBBBBBBBBBBBBBBBBBBU2lKzD527BWG:iZnuomuBBBBBBBBBBBBBBBBBBBBBBBB3
TLSH
T1DB169C97B2B500D8C166C1398742E577E7727C150BA49BCF12E16E6B3F279E20DBA720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4900	elevation_service.exe
3712	elevation_service.exe
5632	maintenanceservice.exe
3212	OSE.EXE
4988	PerceptionSimulationService.exe
1020	perfhost.exe
5548	ReFsDedupSvc.exe
4744	SensorDataService.exe
4160	ssh-agent.exe
564	AgentService.exe
628	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8bf7c44de05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1919203ce1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ae44e43ce1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034a25b03ce1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066db1343ce1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086cdf803ce1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe
4900	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	564	AgentService.exe
Token: SeBackupPrivilege	5548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5548	ReFsDedupSvc.exe
Token: 33	628	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	628	SearchIndexer.exe
Token: SeDebugPrivilege	4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4900	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
4624	2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 3868	628	SearchIndexer.exe	100
PID 628 wrote to memory of 2776	628	SearchIndexer.exe	101
PID 628 wrote to memory of 3492	628	SearchIndexer.exe	102
PID 628 wrote to memory of 5320	628	SearchIndexer.exe	103
PID 628 wrote to memory of 3836	628	SearchIndexer.exe	105
PID 628 wrote to memory of 2056	628	SearchIndexer.exe	106
PID 628 wrote to memory of 5200	628	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_48489753788ad97d9673094d91fd1054_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3712

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5632

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3212

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4988

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1020

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4744

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4160

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2996 3000 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3044 3032 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5320
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3044 3032 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2996 3000 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3ae6ce9a9fccc516aab704a869f16193aa61803a42fb43a386514d69388d2400
MD5 27a2b1196c96149284cd4ccb5f5a1d2d
SHA1 db3ee38935ae5bb708eb42366926f8c3b38b0877
SHA512 8067f6e328f3dcd6db9f538cd68af13be6cffcd395c3c36f956e648c0cf5370021488974187bd41a2ac04999061cd12d320632d0d296ffcd7eacb3f8bdeceb22
SSDEEP 49152:gb+632BuPkFKRrdE6ohrstBhuXjfS4LWxndDmg27RnWGj:K3q60jBmD527BWG
TLSH
T13AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3c10c2d2aab0c22e147a02cced473c11854734dc892602dff21e8deb181e240d
MD5 016a7dd6d4a419686a1216a5a9a9a2fc
SHA1 9ab02bbf50c6142e23505b5faeeb73f92f07aa67
SHA512 37ec9b67483ff5f420b7587fd082b9b88d9d042ac4cd50cec8a50148c9c9da8793f670c31192f26ec32733efd9e5ec367a9aaf97ca830816cf5f8b784341dde5
SSDEEP 24576:yXYfDtczA+sqjnhMgeiCl7G0nehbGZpbD:ZtcfDmg27RnWGj
TLSH
T167650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 b34cf2718257f158d687dc16d94d77c2127f302965e474b4cc77c48b1adc54f9
MD5 32f8f0ead7fdec915d8829e6ce2af3dd
SHA1 dd82b883f6a336964e3ff5c01f61cf1d66126ad4
SHA512 04bfcd8d4b974bda258562d0dafc918c94e69d8711b26435446b2d7a2c8463e86c73a6a4fcad0ff217513d1031e74674fde5fd1eb1a6670f7dd306f6cc931339
SSDEEP 24576:V0Le5ji0hmxNrMBsqjnhMgeiCl7G0nehbGZpbD:VPji0A7wDmg27RnWGj
TLSH
T143859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 44ee0ed0222e18180032868b8fc025be5f4c498fe274d083ff9aef138f09e5f1
MD5 3c0c1de59ac039bde3e8c13558271548
SHA1 3c194728e91c3cf4c5198f42c908a5d7a860e14f
SHA512 9e4dd4f589787db75345e7f5e17cc5f4c8a4199395aa0e47bd1447315da9aa5889f82d1385b960bfc2ff300fb90dafb6f61b8c2ca4a019cb8cb9568162428748
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWr6q8wyubsqjnhMgeiCl7G0nehbGZpbD:X/ezSC6vUzPviHjysDmg27RnWGj
TLSH
T1CE755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5d9884af97cc666357e7637a46fa5638a208dfb504ec5b8c63c3618bfea5313f
MD5 27ef40d886504ce3f7a4e67d0a14df6a
SHA1 392f85b916f98bdf9b4e69a875e5495ede4c5c93
SHA512 7078617511ae1f504e4b1bed1a061cca8cb3cd8f9bf5829bc2587d6b0fd3082e02e0dfb91c005018fb78338a4a987288031e527d1b40563e2d6afcee4087c804
SSDEEP 24576:MVbqPb88hv/l+bSsqjnhMgeiCl7G0nehbGZpbD:MVO88hXl+aDmg27RnWGj
TLSH
T14B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d05fe4db47d22de0cc0fa4bd8382c112520433c6358fd921dce99d1bcfcd7df6
MD5 4bc40fb322c7d0eb286ad1709dfc2f03
SHA1 31cb025931ee6426ec1425aa8b097bcdd111ecf3
SHA512 4944ecec920e57f9a15075fef9fa37220aa0c552660fe6a1c68109c5442488bb3d11b548f5940e6ee83c9119dd1ff5acb8eb5224acdeb93ddc077d48395d401c
SSDEEP 12288:bj1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bj1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A04523BF964C50CAEB7608B5C3E9F11EAC137E56982008536A637DFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e0d9d0a990f9c6fc0ff3f30a16e68212d017c426a8c3915cc2c10533c61a1892
MD5 377f83ab77b84ad778248c151c23c690
SHA1 fa68d2c01b7600b7dbd23160ca122058e52380ee
SHA512 555e786af5cae0a7600c49dd825a5244b7164bdf6bcf33505a8f87a4f27880d4816158a6c4f30a32ab8e4d25311e3b0a15eec047f7405ef19b49caf6de90e9c4
SSDEEP 12288:8eBNUbTVO86UaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:8JIUasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e31b3c619e5bc9925518f9f1b9eb6f257caea3bbb447241c86766e8c344565b1
MD5 fd76fb910917bb27ac34a1bf2df1e6f4
SHA1 03f4c4af620300d925964422949d5d2eb28c7bda
SHA512 e753756288724377a3c34d01c888460122926a1d9723e03b5f3bf4d8396731c4696d5eef97bcff01f8e1ecd5b33e23bdae2c1d82e93396476e04b932b5e6414e
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THd:DQvGAdlCEL8c/RRNw5C/D527BWG
TLSH
T1C7266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 465b9f0d4a712a64137a40e2b5f560660ad566985817879b683a22811154b15c
MD5 318f981829b3f88196115cd169b698b1
SHA1 96f56d3067bac4b43c32fa745df408eaed8c738f
SHA512 26b4adc774a4d714ac47d2ff337973eb666e1216a60bfba90be845e189d4046f88ab911fcb8bdd257b3665735c3a892ae3949fc3b0e1c69bbc32815a76dd4bf8
SSDEEP 12288:bAwSfxL/2Dc3DDLLmt0LDQewsAjEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:ESewsAjEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17375E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 df5f1272c3030266e7c4f68d1d4939ef2595d4835af44f0717e728e460389183
MD5 e6136d061d26794673db68fda0f9d373
SHA1 fc16cfb7bb6ff27f6fcf111e975d36a7b4e61e2a
SHA512 03ae6da20b225123972543f2c4aada5b7993578ff494d7ac64286fb4c81f1c6e43bce231db16b41d5562901658d90f07ab65220261a4eeeb9924f44cce6c6383
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHIVQBWG:xUEtQevvqc2W1cpV2RI32PB
TLSH
T1AF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 95cf5e8988f59cd6b01e1d1b964faea04667fa56b5ed6315179d90e45603053a
MD5 b27695f3ac6269934b03d1ae2f4bb535
SHA1 98a9808085489091cd53394deaf7f8c44ed66327
SHA512 3f3ee72031962c74f4de227ac8aaa1b713af49f4114bfe20958eaa7c89977e440faf6db5920b7b18beb2dce900dbe4a7a2cb442c1e7e91632f7601955b7c5e28
SSDEEP 49152:0CbRquA/m2yL5zLfFiV+XenmE3/zADmg27RnWGj:doq2VjnmrD527BWG
TLSH
T150D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b9f1fadac74598de5067808f30f2b780e983bc1bd8a63a44ca60247e28701d80
MD5 849be8e40a4ee11b76e7ac5a53ab9cb0
SHA1 9c88cc94d56165d7ae3a33bd1b12b2254359c1a6
SHA512 3f8f1dfdbf7f8f243a2993d457fa361bfc7a6a9b2f1b36fe11b9bb7aaa6d419712c64ba75a0beb265781fc26c2833d4f09f6ddba7a3e1f39d19b88bde101217f
SSDEEP 24576:rAhGL2IFoiwtA5l7S533sqjnhMgeiCl7G0nehbGZpbD:rAM1Foiq5bDmg27RnWGj
TLSH
T181359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 13717c71d7846dc6022c82e7fecf96e97600789f9df88286ba452df05b4a7e56
MD5 fda728881d83c11b537df75d6b7931ac
SHA1 bd25978c287768a6f031b76ec26f7bd9d5f93880
SHA512 0427dfbc661364593c437c408a0031375d8fab455f6287f08a51aa0779fb0a27525190cfe1b464d66bb54659e9661da96acfa0fc14ef585cbd06deec66596428
SSDEEP 12288:tmw5HEjsChNSBFgl0WDm+C7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:IwuXOWQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB65F14A76A81CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 523f152a4096e04341481a2a7792c2b595d89b74bccbcdf9c190b9018a130ba8
MD5 b76553e0d36a4990c4b7f484f4b28869
SHA1 b2b35be9a6442bcefe1cfcba5884484f48dffe70
SHA512 1796383946ce3ee772a6e8797f587f5fb1e9477aa89a5d2b0abc692f8e16af4614f969b56f5c90c4d0b1f2dffaf22d18f2260fdc2940ee870f86058eb6f0e08f
SSDEEP 12288:z/Z1Iy0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bZuJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B35512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e10dcd5b7218a85cc10a3ca944ad35da991b36531cc804f0b89abd6a3bdc5eac
MD5 7ed41f0818b3eb90183789d1c1ccdc27
SHA1 5c694459c6bfb5c19b0adc5a1d16fef657680fd5
SHA512 96769a6f77a2f61a5ec0f9d29cd66e9f75349a22017f00bacc8a347004bd160d1e5451d6c54c5391247c52bbfb3f21ce848b519c655f04a4156284feedebef97
SSDEEP 98304:xQRQyi36YOcPhLvw2gAf+PN3KD527BWG:oQyiKahX+PNaVQBWG
TLSH
T105667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 32699b123a0f622cef8c764f27f494cff80ee9d9a458010c598fd8e7789c6e20
MD5 179b84de0157ba664b8b41a4d24f58dc
SHA1 b4e70061aae5d0ffc013e4977a508a99cdcf91d7
SHA512 00ea5d0ff316cd9c84977e1d8db953155538d2398b33a7f2fe5e189fd7bb6a9c08a3d015fca4660867c1801801bb33f3d6cf67d2af8f89ad04467663b9388c26
SSDEEP 98304:eQRQyi36YOcPhLvw2gAf+PN3KD527BWGV:FQyiKahX+PNaVQBWGV
TLSH
T16D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 02dde2872e3dd05452d168a2ebf5c0f2e8af7d2dafd0a60c3fbbf7a4d8dc5adc
MD5 180925e69f87f53cfa1864199ca66bf8
SHA1 efff84a86f404db0c3ddff7ab60ee204029a0cf4
SHA512 f3f78a3076e8f3ff21c39f40b9f08f6e7a758bed3811c89b6308aa9fd2001ed665c4c309cba2f4770e72d467e820c4b4c2cc0c356804f400f09b3d586c8cfa0e
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0ZsqjnhMgeiCl7Ge:D68Qg55nhceWu7PNU3/wDmg27RnWGj
TLSH
T145B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 129fcae12b4778109f26b0c9359a06562dd1e9cb98e907e610b3fa4762156393
MD5 0815e16ca3eb8a5a1fad8ce0d29edd0b
SHA1 8d51f3db5867a08aa96b3b111a1b63f8db30e4cf
SHA512 db0cea4e0cd7dddf7d3face62a32d3602c4487ab1eb75c7c4c6528fcb275279afa557a37df4eb29bffecc0d4edece50d3e6f613427e07ed15fb0536981977f3b
SSDEEP 98304:Xy5112gYy5azzVva69nLKnhZpD527BWG:qLIHjWhTVQBWG
TLSH
T130167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 74568a32e86e53b3240335b66567f631bd6c0e51014b7e4359063736f3923454
MD5 913c00761eba2ec3e0165444f4e9c3ca
SHA1 f891b3480d52738714e824c2600d14aafa4c46f8
SHA512 2626e7388feb9824ed8b51cbe3ebdb48725dcaafd761529ae42cb2b0380d564f7d5e49fbb52e8bbb396bc2957e3c9a7b1e1a92b6141735a9c04a569904e5adbf
SSDEEP 49152:tB+taZ3usBWOBr4tEG20bqx0z+n217aau1gliDmg27RnWGj:zu6JmUxd2diD527BWG
TLSH
T18FD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 18b6614fb2047ff5ebfb88fe6b55c670c05d613f8a3a9e4ff7c76355d310baf1
MD5 ab212297f57b5b5f9f31ecbe15a8291a
SHA1 d0bce7dbac8fe9bd44a6ac8192d578cd0cfa8981
SHA512 78e2e5af199f1a38372e8b3644e394f2f1887b30e5ea9194f49ba574507789752826eae2e6494699d9918e0429dec77ea2357c07fcb243f3d8b7bfa0efdd0c21
SSDEEP 49152:m1hpsNoJpF1A6BU44CwH7R4xODmg27RnWGj:mmifPkRrD527BWG
TLSH
T1FDB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d5c559ba5a3209bdee859550810697870031e224a74f5e4860e60e89bc49f0b1
MD5 73005d66c24c3a7194f4aea7a63ea4ee
SHA1 fab8823837a7a35b9a9c19376366682d62a0b541
SHA512 b7a6b58348546b954e87fc7eba0d37b047116d9d0637fb7ef4a67383adab81f506b692b173ecaf1529cee47b5b15a938d30884bd1e514ff1f7bc52b563f3f047
SSDEEP 49152:8SuZQIY0Be2KNRVtOnks6NMHqNDmg27RnWGj:+5dKvi61ND527BWG
TLSH
T189C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 721b5ee2bde839ad0979bd52c2483c712caa4a5053f8250498272e9eb43c57ad
MD5 8d5d6cedaf4969349c1b2da536cedb0c
SHA1 362d535a269b43b52d6425c1634590d47ea61b77
SHA512 66a44b1e5616dfded1fa7cbead6bf072e3c3ce526783e8f9656e7b5e85836c300a2e39a22dc5de03d1a551701323375b2203105ce83b7bc09e1bdb84b8b85ab2
SSDEEP 49152:HhtSn8EApI0figXgiDn0AP5wSDmg27RnWGj:WX2iyphHD527BWG
TLSH
T18395BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f0badf782c61bb8a7d08db873a982252d40dfdfab02b5a97a66f39c07bec9efa
MD5 64f98d63310364cd4f0f838537964b23
SHA1 c5a32b3aeff3d4237ccd875256a3ecbd356fd90e
SHA512 0aa50af63899e4432d9b991b66eac7d10352591d3906000ae3f515bcc0cd1d118dd92b72def78ae3982050142dfbafbc761ab35c13226b228e1fb534695cdca4
SSDEEP 12288:GdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E4523BE964C41CBE52644B5C3E5F14DAC073E5BE92004937A9B7CB9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b77f5c7e45be99ca56cf23e0aaed9ae0bfd565a45577f148fdefeb9f2c4d323a
MD5 fbd095f2113724662366b1c609333d92
SHA1 fa6ee28276351afb7fcdbb97671edfe5b6fed772
SHA512 ad0c1c2fa9a066cc06dbecb64dcb50b3b4f8db0ea66f78f26c37d54ca67857dae3f6faf9adf715804545bc8346d0b6f255858e7451dcb2c44441887e781b67b4
SSDEEP 12288:QoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB4523BE964C41CBE52644B5C3E5F14DAC073E5BE92004937AAB7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f6cfb90f1057511f80dd41d23cb2d043b814281e1a711de8c4241a04fc48e0e1
MD5 ecb2d804418e63c0c36ae60eccefb3e1
SHA1 07900bf3635c4a3a7ddf0793bbd6e78c48ba4163
SHA512 67dc1ae2553818bf56e0921b4668999df8f802d27fd295c9a1a2a73064b3fbeade17080039d517bcc72e88940f3de20785f09298850900c3be2dec1d59f72e45
SSDEEP 12288:RiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RisqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F4523BE964C41CBE52648B5C3E5F14DAC073E5BE9200493BA9B7CBDF6B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8429dd08bca0e36e187f165866d49ae56a9890f55ee9e3f1334f5e2bea8656b5
MD5 b74b8958e43ea134c24a8b712648ccc4
SHA1 478bc05a6f66e6816cab8b946b074ecf15bc7c03
SHA512 9f7e90a3365f99130145e13aa6f0c02ec6eb7820b730cca9b7116df5628bfbab133c88319ef31032b2af9db3b3e02687b8bafd038899902a4e23b2b0317d7bdf
SSDEEP 12288:BVXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A45237B675C00CAD83285B4C2F5E11DE8277D56EB3005DB6B532CAE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bad372272758f3b9adcf97208c1387153f442bab6df400d062f085b84fa6aa6b
MD5 aefd5a385803e2954597d323921ab2b1
SHA1 b463dfebdd49c2fc38d8b5cf2e09863e2a2f93ca
SHA512 ae87cb18aa2192281315753c4d30ca563aa7aa318777ca817f8ac4a20b8095322d9d010f191ee392add63b28f7353009f8f9ed1ca7831557b05d27773a25da5b
SSDEEP 12288:CPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1534523BE964C41CBE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ae87f644f64c53f9914d63bbfe06aa76c68482f80a1fef1dd5bb724070a0d62a
MD5 47841f60739fa953de8b8fb478cc6685
SHA1 fca47dcb23a00bb29bdfe8e0b08293cff2060324
SHA512 4557372a0c2c654a6e29a38dcbb05f8b598410f89aea2ff6e44cb6194767e50c8d33cc3386b819dfe647d25b1aedaf65ef563605b1cc2b3402983e1e72d6b024
SSDEEP 12288:FMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1554523BE964C41CBE52644B5C3E5F14DAC073E6BE92004937A9B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5c0f5c8e4c568097fd29cc01b2c45b1b60c427b311d58fbc3ddca3fa50c62c13
MD5 e1d04f11ea2134381bddddf358913b35
SHA1 69e236d84b0e0efebefcb011ec903369e48c5a12
SHA512 80ff123cb34fb0ef2e3a540f28e9f47624027bc9f8c2a2d0e1708cb9243f3798f976c46beffdcd53530d2f8ab252dc7fbfa0f5a4cfec4af2f5ebdb8d39304417
SSDEEP 12288:zgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB4523BE964C41CBE52644B5C3E5F11DAC073E6BE9200493BA6B7CB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 51082b7f8e766cb8f93326f48933784a2024da98c1d083a6fae57f60960227b0
MD5 0c8c6b10baafd80a4d9dcc6237acc7ee
SHA1 571eceae75daa6f4820b546d766f8addca6568b9
SHA512 e353aaf6eeb1946f9052f84dfe8473ded48a93821555eb07b521ee576de619305fb11ee4f890486ce95b1f145d55bea17edc32d3c85cb94aa34bb7abf354528f
SSDEEP 24576:YZMMzFVSOIsqjnhMgeiCl7G0nehbGZpbD:YZMMzfoDmg27RnWGj
TLSH
T14C6501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 594d63b3ec7d036fb52c5d71ddc94eb7157d4f09e6bc45553634efd19957f990
MD5 02cc18251e77b3d552086ff6cd3ee970
SHA1 766f6393a823a90e44f685335fcc22118e24bcbe
SHA512 6a5bef33ae3729a1c0600fcde6d325d836c905f6cbefe78ef69574cd867dc9797065f68273dcb2d40af0a17fe2ff0e94d85d8b5798889a415c384e9b6f2552c2
SSDEEP 12288:15Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:15sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE964C51CAE52604B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0565560c215f950ec287d2fe924e5fd8c569dc7b7b489343d38f2c5305e407f5
MD5 e9bf92edee919a105222fb8e9dd47919
SHA1 e1a00044dd2c73793fb901285798e10bc6060a80
SHA512 ddad944800cf968fabf31c4989c9b80a94f2b28487d44c46a66ca79bb4c1b8258e0fb36d15de6e6e69b27f4717f01c536c6c495afda8a778dc9fa7207638f05a
SSDEEP 12288:mlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A4523BF964C41CAE62644B5C3E5F14DAC073E5BE9200493BA9B7CB9F7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c353d64ac97b2640ed5e1453363d83744844a2391ac3b920b9a8a343f0489e4b
MD5 c6b918b3b8763c9cdb0ec0450c47dcd1
SHA1 c6dd917adb580b836b3a7de3fae2375997f6b761
SHA512 8cd4413805cc03d7933a48751b68942e9a8192a4647be0416d4297c903656a9fa862083574a46d07ee39ce9fbddb606b3f4815814e881602f94bf90d98e21e78
SSDEEP 12288:AyPz5L80Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xzy0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D55025B73A530F9D1378178C5A29A06F7327C3647204AAF17A416BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 74736f1bc28195bebb0966603b9f814f6858bdd2bcde7243f80953cf905dcf41
MD5 bc0978c8591465da7edc3dbd8ce3c69d
SHA1 a1d681b8f0006c619d3e3b778ed9513e8b849d4f
SHA512 b9044aa836689ec6eb48adb3f17f02cf74eba58a8bf498b90ba76b66da3344d92913eac89abb05e51876d756ba00e80c9a3f175a2cca368b5518ddaddd8f3027
SSDEEP 12288:D5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B54523BF964C51CAE52604B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 122b87e7ac15180bc1b58ccce9987dbb5fae47ff900844fd52ede545b1d3dbc5
MD5 50d453a7b9836a5da2c561dda37dbdce
SHA1 150beae7510502f5f7c3f1fae3ae564c8f7abcf5
SHA512 15d537d099fd008c97288d9e733669a38115d3d765de8482a12b1d992647cda24bf4a2a001b597069615d23163252a09bdacef4e17f838df046da44338d0bb25
SSDEEP 12288:F5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:F5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC4523BE964C51CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 8ca19aaedb61bf6159542bd60c901115170c60ba22e15d05f28855d66a4fb376
MD5 9fc19ec9439e620b4a1b70131e042ba7
SHA1 46fef3ea8def436a853ac3f0fcee664e67eb2c9c
SHA512 062f0dda376eb3e37e450255718f8da59f750a162bd9676a0db4a2f9b6803151c3c670ab9f1a571a617c43e8a47bf98be6cba376beade6dd720d2f69f81ed501
SSDEEP 12288:OyPz5L80Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Tzy0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F855125B73A530F9D1378178C5A29A06F7327C3647204AAF17A416BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 416bbc5d8e2a02e0b842f09e22cf86bfaebd35eb687ed7d94acfb5b53af57b0d
MD5 71887d8e1a660ed3cf4460ad9abcf357
SHA1 e5673202ac0a4711b0138061e7ef3bb4c0b5d5bb
SHA512 a7dc7d8b56818de99a85722a29e2f616810a284e0fbe88ba36cbf1a9381f5f6c11c0491cb46e05bdd18585d9753e7608b88ff1442d70ebab33e40604ab2b85cc
SSDEEP 24576:JT9aLl3z0zDysqjnhMgeiCl7G0nehbGZpbD:JTQLljPDmg27RnWGj
TLSH
T11C6501A9B35018F8EC67813EC965D90AD5B37C5A4B70C61F13A43A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ecc49ddca2c959aa0f69d7bb72f995c1cdfb2d483b0dbd350de6d3bf4ac6a5e1
MD5 49ee26ca7d94d3568e2aa8405fd2f500
SHA1 414cd57b1442bc680d24aa7573ea9dd88785b174
SHA512 1041ea018214e697b7591d02acc88253e2b7f19ccc12d9e6feac7fe04d6ec0f5d0deb359d8ec795099b0f7346d53aa162dc95700e0b15c733c5cd5c22e091c59
SSDEEP 24576:+3td9CHKy7GZmsqjnhMgeiCl7G0nehbGZpbD:Atd9CHKyaoDmg27RnWGj
TLSH
T13F75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 54afb55bf8c7d48aee9a6d503c7518dcc40a179b55216f460619ea8876a7fc89
MD5 16060fd1c7e316c57a22e47da4f4a964
SHA1 7411b4718d7aaccfcfbd95e9c62c5b480839f57a
SHA512 e48438facf4802ddd8353ca9713c0af55d411037643f92bba9ff9a2fcba95169fc6e89b1e31890d63af567567146a4c7011e9f0e44dd5064a1f22d3b1e872d0a
SSDEEP 12288:aCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1864523BE964C41CBE52604B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b3371fb84f51650f2a093aa813f81b6aaa175b4ca35a305fa22eb9a84fc84bc9
MD5 d3695ece031b59e0a7cec9833fb2f623
SHA1 0120d741bcc3ddedb63c65c28d583c4f773a86cd
SHA512 375752711300313183a6d1855f3e21bd60fdddb0f87eff2455eddeb965baaa2418ad9e7963b15590d65f2be67b69a792219d5c679e53a635271f0e00aed86159
SSDEEP 12288:dUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE965C41CBE52644F5C3E9E10DAC073E5BE9200493BA977CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 808fc228097e5716608cf116c502ec27605a172b5a2999c1fa1dd64b0a980487
MD5 f61e49c45a21fc15eb2a552d1d913c6f
SHA1 441304b39b33ee6ae93e68fb27af86718ad85447
SHA512 7424c7b545fefe73c4f0045a52dddadda8df77eafb240a84f481f68a8b0c355e5bc1585ed0c6c742efc6c62d4db49400732822290119e7aa46112cc1c9794056
SSDEEP 12288:RzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D54523BE954C41CAE52644B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB28584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 78fd403568a31783201e44711c8e1105f5ce3f921e545eb761a1c17cbf7a2156
MD5 e4a9f85666c1b73fa647620a8139c903
SHA1 bce42450243c558cc05f9189481256baca374f41
SHA512 e8b9994a9a9453580caf0bb6513340398ef3e7ba2c368991ef9340189a2f163c6a98ede75b0906aee6acae115a0b26b3e0ffbeb1049db1411513d68b4e798dec
SSDEEP 12288:u5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E4523BE964C51CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 01f3836f7251bf51285c259c23a25bf46e56f7462a3d77130faf07af9bd554cf
MD5 57bc94e64cf1373ded104d456a1dfaa8
SHA1 9f5f365de82465304ee83642724bc027d1604186
SHA512 d1fafd39dff2284a20aa8402559f36d068d69d7e478bee92892fe187327cdc9d24a9d54f9e43a683999d843e6d21af0470184a21e068fadcd5b771f8b4373c2d
SSDEEP 12288:QCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4523BE954C41CBE52604B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 20b643136a29fa6761db4b6eeb9ddd78166cca33e6a16b0870be279ade3dbd6f
MD5 df2f4a0228a9c5002aac4fe1609d516f
SHA1 b9f2e045b5410fc22350cf797b8d6fd300dbb6c8
SHA512 e12f6f7de6d76b247a6607a21a1be41c318c2e96439b3af40ba48046dd9a60b94d0e34c264a07d0626ad4ce3d4c6e5e3ee4836835214d9f43b71d00e7ce95bb1
SSDEEP 12288:cRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E54523BE964C41CAE52644B5C3E5F11DAC073E6BE9200493BA977CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2ad4341e4301caf7ade49209499ffc6b46c49b1097c10ea6a9835b4c9129c90f
MD5 261f54328e6ace7a4632b63ec083ef4a
SHA1 1c8ef0b296ca50c208775dbe968ff907db024972
SHA512 f7024b6fa6df01d25ed411bd0ba61dad47385ae85713ef0e13b8e2f35e866e7ccf11af2edcdc9fd9214e1ac25ab280641b2140742134bbbabff97f323a05aae2
SSDEEP 12288:8PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC4523BE954C41CBE52644B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6e1123d04ee0ab1be49145d4c451cb2781905f5bd1e4ac4fc5bf7105b88fcd00
MD5 4ced5c2fe992ced1b926afbba482776a
SHA1 7b071f5d4886f40211d4fb841fa427776b15242a
SHA512 3f78f8a3b4a617942b1e599cdaee1e969cccb9abede07763401c682edcd0f117e2edf6a0dba260043ac395d17bdcc6fcc0a8288b4e47c8f6b2604478bdd43274
SSDEEP 24576:Sfwvok9RX6wkyAIVsqjnhMgeiCl7G0nehbGZpbD:mMnYIJDmg27RnWGj
TLSH
T16E85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a59a0e7af477a8018307395362ee70896e42ac8000f6c6c9eecf045be20ed713
MD5 e90c80e277a6542cd01582eeba4b9b8d
SHA1 c93fc3a3e0a9fdabbddd73219ef59bb4f29abd33
SHA512 522a82079e3fd007cad61dd0180b5a93e5655e7f29b2f32e190bebb42968be85805e3a9ee1b2462760c812fd6762b9ea348f727f2a15a77a09f9ebdf59485b82
SSDEEP 49152:FYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yDmg27RnWGj:TySzPqD527BWG
TLSH
T1CE066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 27a8abcbf12390539bd10b19675161030a919ce66370ee9e86a64c82fb4dbad3
MD5 af60f343e3194a1b13b1a46475bf98fc
SHA1 9ce3d757a35b7de68664bbebfe3b813609cbd342
SHA512 2d8b9db70eee73f14704da9fd348f934615879b873fea92ceac9b73c0b4ba6be50264e0c7b4236590e93fe61597f7512f3c20a362f77296f676c6f0480d31178
SSDEEP 24576:747Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY4sqjnhMgeiCl7G0nehbGZpbD:747JUQj4irIhCnDHUPfF/iDmg27RnWGj
TLSH
T18E65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 92b62a71d0a15217d1646e4881102b1c020192a18d9c4e51ceb073dfa9f65cf1
MD5 b54becbdf593fa405107bbab6f0e886c
SHA1 cf314f9f4c6b4b202a003bfa75fdbc850d21d70a
SHA512 98a3c59bdffed235b0405ce366fd944ab995a109f74968768c6177ec8efb492cda092171d6597ae9035ce605f9eab0c4104615af2c6689cb2c0f84a1f05db3fa
SSDEEP 12288:5GsfJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E355011AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 a122e0ee7be6c49a1708e38815ff1c1b0347b7af891d2cbb57c02e540e1e56a1
MD5 a2c172c31c6c5be34db5328c1d5dc18e
SHA1 5e7866bef4331a8ce1b98a6aa345b6e0e436029a
SHA512 59214f42c89e6358bc9a989c8248b138e16a93e8d48e5408888866a4e8e390d69ebdef306a1ffd25ecff89f3ba6e2ad348e90c37df9cfa361cb119827b466053
SSDEEP 12288:THr+jU3ftjS9J0sHEqSZKjY6L3/BXCDacCax:TLgUPILSAjxL352acDx
TLSH
T1FE252810B66AD75FC5AD40321E33D2CCA7707D01EE45AB0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 32fe2161e00236aeca8b778dd0f2d9e59eae4a5d34fdbe5e656d701ce1fb3aa8
MD5 29685aa6f7efccc6652632c6a00d4415
SHA1 b1007fc1b24babd9ce5a29e445e1912352604dee
SHA512 fa67c4f42735c7c781626ed8fb78e41306a2986939bbe4ba42e6ba168d45b00609af66f49c2475805bf3882884c1113ac2e3adb7a178bde7afd6e2c136dd7c96
SSDEEP 6144:G9DRnI4G2F2ss0GBB/uK8726tMxzjwFJWdStMtk5Pwk26tMxmB2dpm7ThU:GhF2sMWr2jpdStMtk5Pw+Te
TLSH
T1AC55C7815537A3CFD1F66032072A9B4CA764EC0377496F26B3C4453ED82AB26B1B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 25c8590673af9e8c364c05c4953cfb9ceee9e37730c0858d67ab6831068fe352
MD5 b443b6e2eff5f508585cd1c166fa8140
SHA1 d6ed1bf8d3040ee71b55191355adb7ad73b460b2
SHA512 d1191bb9b3262971de46dae6b71e914fa09a44f9d9c118bc2aeda30e92c6bb1220da9960b8b42fc735e8921f3f28758784ef60cb491d94c55c3afa3f633e2c0e
SSDEEP 12288:iF7hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ehsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE45237B934C518AF93605B482E9E12D680B7E669F2044C3B94778FDF6B18D88F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 159a8b55b37027cd1976c050809edc347b5b7e779c9f175741e10c27accace53
MD5 6a9e2d74cb6e4ae55bbae91441b3a7ad
SHA1 f11b1b163d61a12178a4b51964c1e851afeab20f
SHA512 23abd29c80aed1e673c1a79a240359e988a664bd9d348e5e6698fd856a7b8d6914dcdea5baaa6554f76f6978e9487059e22a4ee9116c4758dfdbe3a88dfe8c86
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYbsqjnhMgeiCl7G0nehbGZpbD:ygb4mBIBhGFkDmg27RnWGj
TLSH
T153659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 2f9d53e26ed321f4abbef5f52426537dc7bc47eb13c05c20e6a9ae12fd1d2249
MD5 e93be50a942239ff705bb0e26d058c37
SHA1 2189ae4196e8b5f59306a3a568527a5087454f9b
SHA512 369699b659ca6b66f47dbc8ab0a3744be432bbac97d64a1b9ce99d0e0143ccef94035591e320b7879b6b199730dd002c862feb9146f0bf12f493615cbeeb3285
SSDEEP 24576:sG88u8FpJqH1Wzria7/mIsqjnhMgeiCl7G0nehbGZpbD:P7ZFPqVha7/XDmg27RnWGj
TLSH
T1A085016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5913193f20e2d5695f489ae880a685d708adf4e2ef996dab992b9858e99650e6
MD5 8d72625cbb5b3883c3f7b5a6e181196d
SHA1 a7c999de757ee9b61b38219dba34e27e738ea6ae
SHA512 8266a78aebee687bed6f8dab83e120bf9f4467dd368f71b35eae4e6df70a4afca2a9e0ab76da495a20457cbe8d04de1ea97673389bd93b64e27a8124c43701d5
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4Dmg27RnWGj:nG05lO43bxD527BWG
TLSH
T16BD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7e2d7396a8bafea58eb4052bca1d099a662a86e68bc8c34cf4bf5bc7d4b40e4a
MD5 a0c4af5b711822544770a74ed207d23e
SHA1 ee37368cf4d3a4ca6bc085e4f3154a1ea4114e0d
SHA512 045f32e92b5e3aa8654909bc61211c24bb66e31c3f7b6c285f1f8bd16e686653d06dcdb3f643f1a3ff9f26803ad0b0703fbce7f9cede7b3ec70040749ba8bb75
SSDEEP 24576:qfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnesqjnhMgeiCl7G0nehbGZpbD:ia5POZ39Jt2pasx2+mwDmg27RnWGj
TLSH
T17A65BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1fcba21b905082fe83642be3e47a60ed3b8a023862dc9a65a8781adbd1191d32
MD5 2a4e7a02de65d9cac84dddac996aee04
SHA1 079b75d80d3554f244ccf73aed286847d148b072
SHA512 aa30ce31292634ef23d692f4943360023362d92e4662dc37820c74bcebf3f4a3e250805227e384974e1b0ae2fb759d12ea4c51b9a0bd183f8e49500c8e66e02f
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkwsqjnhMgeiCl7G0nehbGZpbD:nNc/zEOVHF3Dmg27RnWGj
TLSH
T109857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ec1c630b3a1d38c801fcf502e1e3d8d4aefc51618a76fc9db03a05a8d2179631
MD5 a1d95ddf8a305f0432d4854d200e2303
SHA1 170c1ba3e2024f6a070ca0de5e75458d412d1e04
SHA512 20de01e1414ef337e074c54841752b9533bc8df78ae0ab5d4b447506acdc597d20c6d9538a0a96210ac1ab149adf743d0b990dba2bc28954a4f14ba66b8c0893
SSDEEP 24576:3tkNvNnaFeYhJNtmZBmKsqjnhMgeiCl7G0nehbGZpbD:3tMwBtOmeDmg27RnWGj
TLSH
T15555AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 76cbc9e8801218807a6cc8deb260cb08007c7b1ea9402be0eeb3fb433bac35c1
MD5 b2f0ca8621f3abd904aad6d0c32e8baf
SHA1 6dff21664368eaf55d4b99c7d70c3967b6b6450c
SHA512 84b9921bc80754d2cdbcb74ede64cc2132c75f9da4b22ea42d06ac9db2d6ec5cb3dff76774b527aceba7574cfad7df7fd3cf819ba9c042ca0dabb9dcca346337
SSDEEP 12288:RHvUrBFrEjwaQ8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:RPUr+NQ8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C65F12F62AC18E5E676A17CC582C70DF6727862171192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b92336591e94b5bdc99d1208331ae1735d8ce679d383c07853f0d3f4e5e1f3bd
MD5 a75526865470c47a7e6b5d8a4c454252
SHA1 7ddd8de4b56b07c03a577139c3c58faac831a4a3
SHA512 e205da646fa2ebcc7d68f7aab6486114e72ee8b9dcf1eb94381fa68e6cdf7432aea24ece411e809ab0034f0fc61bb5fb00e6c7a03fb67c26dc7b5c77e0e999b8
SSDEEP 24576:1D3FHshBIYQgA9sqjnhMgeiCl7G0nehbGZpbD:1DVHeBIAAhDmg27RnWGj
TLSH
T17F75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/564-137-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/564-131-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/564-139-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/564-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/628-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/628-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/628-161-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/628-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1020-315-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1020-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1020-82-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/1020-87-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/3212-281-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3212-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3212-65-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3212-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3712-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3712-160-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3712-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3712-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4160-318-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4160-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4160-125-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4160-119-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4624-0-0x0000000140000000-0x0000000140457000-memory.dmp

Download

memory/4624-91-0x0000000140000000-0x0000000140457000-memory.dmp

Download

memory/4624-1-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/4624-8-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/4624-7-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/4744-111-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4744-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4744-105-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4744-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4744-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4744-319-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4900-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4900-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4900-19-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4900-27-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4988-77-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4988-300-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4988-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4988-71-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5548-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5548-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5548-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5548-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5548-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5548-333-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5632-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5632-50-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/5632-54-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/5632-44-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/5632-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download