fd061562acc91cd234c63136411d5d17c604dd7b1fd05181e1357685e007b5fa

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
Size 9.2MB
Sample260727-da5mzavcld
SHA256 fd061562acc91cd234c63136411d5d17c604dd7b1fd05181e1357685e007b5fa
MD5 20970ae557d8651daa21c99a7d226a2a
SHA1 50068677e4f3c8bcf2363b20423aa31d7fb1d9be
SHA512 e2b190672fa9d10ffa5066725c4c4d57a3dbff13277296733c00ac21ad8ce04681e6b47837a6b99104b43ba1ee88e6a55f7a0b2e0dc6a53326b112ccfcc8d22c
SSDEEP 98304:nwiEl4G35xGiPx+avS/OsEP3jaEcqWSxhxtCexCPA/uFJ8yHe:nwiEi25xGsS/4rHWtom0y
TLSH
T1CAA68C5367B840D8D1A7C13A85A3860BE7B2BC511B3987EF3069971E2F336E14D7A361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1960	elevation_service.exe
4656	elevation_service.exe
4404	maintenanceservice.exe
2344	OSE.EXE
6048	PerceptionSimulationService.exe
5664	perfhost.exe
2452	ReFsDedupSvc.exe
5256	SensorDataService.exe
2648	ssh-agent.exe
5752	AgentService.exe
3148	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4c45c9a38f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000038c78593721ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019e6c292721ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
1960	elevation_service.exe
1960	elevation_service.exe
1960	elevation_service.exe
1960	elevation_service.exe
1960	elevation_service.exe
1960	elevation_service.exe
1960	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
Token: SeIncBasePriorityPrivilege	3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5752	AgentService.exe
Token: SeBackupPrivilege	2452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2452	ReFsDedupSvc.exe
Token: 33	3148	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3148	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3148	SearchIndexer.exe
Token: SeDebugPrivilege	3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1960	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
3356	2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 1220	3148	SearchIndexer.exe	100
PID 3148 wrote to memory of 4684	3148	SearchIndexer.exe	101
PID 3148 wrote to memory of 4884	3148	SearchIndexer.exe	103
PID 3148 wrote to memory of 1992	3148	SearchIndexer.exe	104
PID 3148 wrote to memory of 4660	3148	SearchIndexer.exe	108
PID 3148 wrote to memory of 2228	3148	SearchIndexer.exe	109
PID 3148 wrote to memory of 1080	3148	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_20970ae557d8651daa21c99a7d226a2a_glassworm_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4656

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4404

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2344

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6048

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5664

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5256

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2648

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5752

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2976 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1992
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2976 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 81f274b1f98049e853b7eaea925381ac7d26b4b79295cb28eb30df649bd5076f
MD5 2aaa7cb7064c48c1ddb0a76562f1e05d
SHA1 ac45a0707bbfd6a0ef34db7408943eb9213b34cf
SHA512 758b6383b25341d9c49305ff75ed7067bea6b404bf12a43d217a3892aad85d72e7d55db5179040d471f733accd9523b3e91e081107f33fe1e37f70f9b90dadc6
SSDEEP 49152:gb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnJuYtO2E8ywqev:K3q6mjB4uFJ8yHe
TLSH
T1E8D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 73f60e42cdeaa54e416e8ac3e76049f2c1be8a088dd7b85cc31883d2a160fd38
MD5 5d2055538bd76871f9562cfc7b9e8dd3
SHA1 6cdbf24223ab399207a2e6d5ac6b86182945e9fe
SHA512 e001b1ee2ead820e02c38ed6d56333b1d43394e8292ca447cb6df13e8e130f2a9bffe83a07614054b846bf332af86068fc029cf102725529f23143f5c114b595
SSDEEP 24576:EXYfDtczAZm2kxUlYtEjedEeQ16ywqmpv:jtcPuYtO2E8ywqev
TLSH
T1A105012977E508F9ED67823CC8A2C512E633789547A4E7CB03E499690F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1c19ccd01577205014ccaaaa679416410630a36a1901365669d865f42faf476c
MD5 f8b7077ed33d15e700895d1c2ed0ca42
SHA1 a191287db6e8c86197a846e97ad0eb778b85f075
SHA512 1523349985ea51913714c1006c7f6179b0d5833e5e0d7e7ebd04b2fce5a5649e9925a8d6a0e0f2f30e8a5330145fed02cf55cb6fabe1fccafed4b95c57e42528
SSDEEP 24576:B0Le5ji0hmxhrMum2kxUlYtEjedEeQ16ywqmpv:BPji0Az2uYtO2E8ywqev
TLSH
T16535AE16F6748335D073C0B9C5D2A69AE97230861B308ACB4286D77C7E677E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 700b39a4c7db432b5aed14a06faaa46cfdf2e1114f27801635a8fbfa0bf75b3a
MD5 8c11408994d12bbae4dd150bffa96d15
SHA1 1ebef819e11c1b9f95996d55bbe7b3273a6abff1
SHA512 181a6a57e3aed2f52f9845c694085388aa6907fcee76e4aa2fedc653d53e97882605563ffd5f0094dec3e25053783234916d4a53ddab9a02731e6d715fd25ad8
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWj6q8wyucm2kxUlYtEjedEeQ16ywqmpv:M/ezSC6vUzPv+HjyiuYtO2E8ywqev
TLSH
T1E3755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c8480393e8f70caf7a75752cf6dc607620708026a266c427161cf30c8f3aa632
MD5 cfe4c6dbd4581a5de902a6cc05aa255b
SHA1 e17a7dfe3f610d92b2222325e6d11c5c92bb776e
SHA512 f90be731b6e84958e00509e3b353a7fe419d16a5aea9cb47b5b2a56f7d8762ab97c2a5a9690c6deaa5d1a20c7ee5fe7d36bd934fccd0db148e380cdca68103cc
SSDEEP 24576:JVbqPb88hv/l+Bdm2kxUlYtEjedEeQ16ywqmpv:JVO88hXl+WuYtO2E8ywqev
TLSH
T13D559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f85ce7108ac53516b185c27e7f5aebc123a948f59b71aa7396821f00028654d1
MD5 d25ad36f9f128ed1aa00108ac6cecbce
SHA1 d9ea615c2f42da82bf481b6bef1323f3f3ef0891
SHA512 fed011d6ace6c8a8d18859f15d50e2c0bc80559f19bf53cc8b98bf8363fe90b8a7a24fc83f0376ead8a758ca4684b2493d1a143ea16b968cac264d8007865dbe
SSDEEP 12288:CG3iAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:CGym2kxUlYtEjedEeQ16ywqmpv
TLSH
T18CC423C2A6263189F7655E3434FAE96312564CFA34DCD5DBC7D2B75E80BC023D2EA182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 35d425ce037afad2fc6a729da57e69867a5d20feb339ade8ffc236707725c70e
MD5 da4ac17fa10a06e4a7330fc84256daab
SHA1 abf01302e67d3b90feeec8ffc33173574640b9fb
SHA512 e8876c273da38952854f271550a36bc8e9b343d927171e39f34c1bb49485d108088271ca8ade951ca16172bf62a98d96b45bdbb6d63c414927e8adfc7ae507df
SSDEEP 12288:8eBNUbTVO86UmiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:8JIUlm2kxUlYtEjedEeQ16ywqmpv
TLSH
T17F05CF7BEE28FCD2C27A8D785A91C600977278704B61A3CBD165C30EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7736811c08c935d6b7e46b3590c3ed4d7db077f65f1bc6ad730c2bd7dd23ddf2
MD5 d35a86741cce5444eb6b843016f34a9d
SHA1 26d3a3feaea37a951fd69fe11f8eb0e0e0e2166d
SHA512 3e4adbdb056d5790a7838338fa0b68f4c1adfde9282b701c4e8cc00b49127eb9dc0481dd86f592e6fca200b3a021ceda471081924748f9ecf4db1e68cada2ebd
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THE:rQvGAdlCEL8c/WRNw5CvuFJ8yHe
TLSH
T1C4267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 838586c3eaef39525304f601e25677ce032a2290d79039985e761c5af4b112c7
MD5 7f30ba8050eacdec5a15a654608eb99f
SHA1 e40118cb13bcd49bfe6eb19b8102113afca71d8e
SHA512 bbcf313f73f9b189d371284ee7c66d9accae583f920d24f00a81d80128e619a1e63924182f5152cc7e36a4a9d91ac134d98d3f9c797d7f7d84ee4e6a983e866b
SSDEEP 12288:hAwSfxL/2Dc3mDLLmt0LDQewsAjAiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1E:CfewsAjzm2kxUlYtEjedEeQ16ywqmpv
TLSH
T15515E031FE74E036D3BB0DB21B36C716142D79604BA11AC3E3E89E9E49742D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0b543b05a15e3b172a8ab9a52d3f96fcb2b79ba8b6a8613fc29d8c7f984a009f
MD5 264bb9b883e380e38cfac91b735fd2a6
SHA1 130433d7185cbb7af53f1875ef9895c327c0ab17
SHA512 75be9ca9d9771150708b34d496f89aa75a8995f1e969d3d48980a36d98c687563dd5fba63887729e251882f1838949fd1fea17e0b5a3a94e1518663ef831b552
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH70y:8UEtQevvqc2W1cpV20I3277
TLSH
T1C9474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 672db1be0916307e3a205726eb3cfd3fdfb1353f633bb05df896e51b5bff2f65
MD5 607ae085d9f5a70048253dcfcd895fcc
SHA1 7a8e109f8624d673f08057227947bca183b46a5d
SHA512 8ca18212aacb6274b2e8aa1ef69c1ef58fe9fd4177db358748e48837d3fd8e066850ccfc63f158e79bdcc2813def1f609d454a61f663b20fa96cf7cd0e65e2bf
SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/zGuYtO2E8ywqev:SoqtVjnm7uFJ8yHe
TLSH
T154D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ebcd88325a0b6e770818e57a5c6c9a49ae5ca3fa2496718c84973212d0119f41
MD5 c3c77510fac5bd43bd138f432daf1aff
SHA1 132f0304d5f028f885e518f771cbd963b1210871
SHA512 fd28652b0218308806ad9010abfab7124e0d01fc9211db68654e195ae8c675073b053b02701b87d8518bd1b758f6ba31706b9a5150ff4d1f7b02f9fe9d0abd26
SSDEEP 24576:DAhGL6IFoiwtA5l7S53Ym2kxUlYtEjedEeQ16ywqmpv:DAM5Foiq5ruYtO2E8ywqev
TLSH
T15C35AD81E7F915D4F5B3AA7899B69571EA76BCAA5E30C20F2150D21F0E33A40DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 668add9ee57dce24df450d14b339999de1c3a126788f58384f5791b46a3af9f3
MD5 694fad804d65e8353d028385987f8748
SHA1 136d9015add802b38b651042dd64680d52f6da63
SHA512 f498e994688da6365555d930f6af94132be1c3796722b6f65230918b34d1328fb061341cacc9c9362332de8a1df144d018b00c0236843a494c7abc898cf78b3f
SSDEEP 12288:Jmw5HEjsChNEBFgl0WDm+CNiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/H:EwuROWPm2kxUlYtEjedEeQ16ywqmpv
TLSH
T16A05F14676A51CF9F96786388597C132F3F2BC522A24C71F47A0C65B5F37221AE2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 50180a1364e74cf8f6804512feb396f9fafcde8fd5401d2235ac327c1cb6e09c
MD5 db43024bb037737c33859ac0d0632fbd
SHA1 aedf46d68052deaab3545395fe5d64846d70e304
SHA512 9b0e973695bac0ec13ad6e810147f1854924e25f89d4a92527571b3db5843f6b9126a9539409d28fbbb5a317f3a49ee5b82d43407a56ac4d9e6250edb44db61f
SSDEEP 12288:iyZ1IywiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:7Zu2m2kxUlYtEjedEeQ16ywqmpv
TLSH
T18BE4128633A430F9F2A3463C98F19602D37278A7337483CF46A5525E5E776D29E79322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 eae953b5faf2e8e0406de987f24c76d9e29ce40ec1c5ec6aa7443c834a8f826e
MD5 c0c011436b5ab0b3a03cf451e2c2a2d1
SHA1 a8e9bcdb2cadc5346de8400e86d4e016e20d4073
SHA512 6a773d8949949c10a2c4ec4d03d30a7809978847f37db2aced25ccec42fc25d8349a90fc540870ab512a65943d59b2851d0f6f8747ddf89f11c2015dedd29b88
SSDEEP 98304:3QRQyi36YOcPDLvw2gAf+PN3suFJ8yHe:mQyiKanX+PNN0y
TLSH
T160667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 330f9bbfe0f6504fc673eedd64579769d00da37c865d0618cade8e7d8a16ffa3
MD5 bea1e5efe547d619b3b9707432f7b2d6
SHA1 d361656b42cc9e47a868e625de94d4452337af9d
SHA512 194c0f56cc2b862ded4c20c1ed6792b65a4d1d964d4a1ac35c1572488ddf94773982a111657aedb8274b5c173214fe6309bb09fb66ab0bdcc48b5599f54683c2
SSDEEP 98304:DQRQyi36YOcPDLvw2gAf+PN3suFJ8yHe:SQyiKanX+PNN0y
TLSH
T180667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ad19271519e89848fe06fedf1a7f1f0d69ef4d0dcf56196021ec73e1288f9c1c
MD5 4f99967b7c1468d5e482bf2724588678
SHA1 15c04e6100dc8724b811abf63fd74282f848ead3
SHA512 d6e15a17791bbbac126a210b731a8e4fc48f9c352f4d282201e078d1735903ad1ddee60762446c2ec0e1e7c20180b2549153514bf3f9cf634255bedb35457e91
SSDEEP 49152:o68Qg55nhkeWu7PNU3/2uYtO2E8ywqev:ythTRc/2uFJ8yHe
TLSH
T120B55A33B2F20099D44DE1769F4A873196D27C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 05934951d9b76cb5ed388ba1397dda3d5753cf94e2fd3f53c2ce8ccc27c214d4
MD5 d053487b4bb5da587c57ba51a3f257fd
SHA1 fa646fbc9c77ee917c6436bd82f63b3456701640
SHA512 8a9e2b590d28ecbb4f811c6c1ed9e21eba76c67ea82f3920521a5d15640ae2bd280f6a3df7de7d3996e4aa9b57741b1c91f1d5034d290aabba6f4d2a3a1155fd
SSDEEP 98304:Ly5112gYy5azzVvU69nLKnhZluFJ8yHe:mLIHRWhi0y
TLSH
T1B2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e2a5dd339aea9eb3c523960e85b49ced2dcf35c9f6eabbf928f0dd0516560ef5
MD5 5a0d9e943337acef6b84b79a882780b6
SHA1 0aa0aef8cf4ebeb5b506acf6c7deff98d8417c1f
SHA512 5d788d92f65a536091d6075854d5d1f533d31fa31b58da15fda6511764f4ee2c331811c0c3bda19c0ca4fabaa6e9dbd4e7bcfba535d809706e71bca058b68321
SSDEEP 49152:OB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl0uYtO2E8ywqev:cu6JmIxd2d0uFJ8yHe
TLSH
T13CD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4a951c788be4ac72720a29092f1476a22d4311722b01ca9600046a6600e88a24
MD5 ab6a46899a2f512e8e0dc941a5a56c97
SHA1 d21f121d4ddb1827c0923a384b1fa826125e53c6
SHA512 4b42f5aa4e0a408aec8378a8d5e98ccf9cbdac7b644a2e1d5baa89cc92c6f478220193b4115038f74797a000b56c45f85851090794825fd210952ddb01116ee6
SSDEEP 49152:/1hpsNoJpF1A67U44CwH7R4xwuYtO2E8ywqev:/mifPqR7uFJ8yHe
TLSH
T1FEB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cc7c1485da2e60e2681865b6ac4e1567272bb8972b7e60bafa7b31d14b4ac3f1
MD5 e9af50010d3bd4b7056f6f896268b11b
SHA1 3c5bfa4d2e17a8e7d792ef4efabf9ba4f36241f9
SHA512 dc687012d15584bb0425db4436d6e511245a4b1e99e9828cc9cede137d1d9b02492a104199426537301995537b4c15d81ae61f71dffc0f3ea7ca27ef5950c698
SSDEEP 49152:pSuZQIY0Be2KkRVtOnks6NMHq5uYtO2E8ywqev:n5dKqi615uFJ8yHe
TLSH
T157C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8b619230342a0c7859f145b4a359af1c3c4ec0c90839596baa13d22a3454f219
MD5 ee4b80f4236a7b7d87b275a264088c45
SHA1 53c517c0fc6f70c2d7a917e2a3a2251af058ef32
SHA512 765f43b4410fdf315ea00f0480eb1cefa597ee46f143e0ddd980599df262698f51775d2eb91f14ab6b790d705ff9662c90ebf8b00077e85f1d365aa96580f60a
SSDEEP 49152:ihtSn8EApI0figjgiDn0AP5wkuYtO2E8ywqev:DX2iWphnuFJ8yHe
TLSH
T1B895BF13F2D901E8D05ED178C7568632EA62BC160B34B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6e1e91a955e8a6e12f3fe813abd308fa5697d64db6278c564f2d090e7ff55442
MD5 8ab51ae8abb56ff25019b59008e2c7a2
SHA1 67323c9d620837e524ce6730c5de9845acc5171f
SHA512 9743c1a622678824a3104b6fc23b644bcc4f3867add0055e6ec4d8a85aedca4c1625bf379912cbba34c2a7353b2f8c504c920e60bbb4d23325b2c1e39a0ca13e
SSDEEP 12288:EPiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Eam2kxUlYtEjedEeQ16ywqmpv
TLSH
T191C423C2A827358DF6119A3454F6E663125A1CFF76D8C1DBDBCAB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f1bc07450e20985ea088ea82659bf86034456e058f97d8ae4e9a8b724f95d088
MD5 d3e41e62715258a66b0efbe230337973
SHA1 7cd4cb765a8a8479bb5d4cc2d4b3672d7a60153e
SHA512 78f2dd4d0d811c326c23039f56b97a76714217a460392b9e225d0f6d7a2ecccd99fa110fd7c5aa8378fd56ac943474f3167a57a102470006450fe2e9886e0e77
SSDEEP 12288:gkiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:gnm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1C9C423C2A8273589F7149A3460F6E663025A5DFF75D8C1DBDBCAB21E80BC027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b96cf4f785fcba1c603cd5d8a97a859337263c63863bff9b046ddde44801498f
MD5 a6c2ebc61ecbb8436b170ce263ad901e
SHA1 87533bc5b9697a7e97f74c0bb3c43d0710cfdbcc
SHA512 3d8452dc926ea11bbd9e73b4ff39b5195fa98b33fde26f58e174b3ebc0714555d7f2324ba986a245316e4c73a51f3654cebd898b9c167f83e54bf5764538fc13
SSDEEP 12288:G+iAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Gtm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1A1C423C2A827358DF6149A3460E6E6A3125A1CFF75D8D1DBDBCBB11E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 dca9e750d92848b31234672c7a12d1932d7a1ba47ac3207ab6461a1a7f4bdabb
MD5 8a3261d6250ab8a6393d0d36ee96a3f7
SHA1 e629de671b814d037990b538ef7a63d379638f43
SHA512 c276015e38f7b7d85eb62bb287f73b19384d06d3cf930c7622b15fbcedd6e5ed4c19db2f11201ce7c8873eb39162e5387ef0e27518c9c7b8b9e97b5d215e5eb5
SSDEEP 12288:zVJiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:em2kxUlYtEjedEeQ16ywqmpv
TLSH
T15FD42382762631C9F521D63484F2D52293B67CFB77B4D2DFCB81660E0CB9252DAF9281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2e2bd6c26ed630bcc2816abc21cbec5f8b20dab1374e0b40565f3af7b7b09b63
MD5 f0860ebae81a17628426a19d284fc4ed
SHA1 aa7dbcd8b039f9fee88d8251098b5549525908e2
SHA512 d8277ac4b939800ba6868a4852105f731c3607057c3810939995eadea3046946b397154ef301047acba6681f81a926f80288b6f9168da9100d7e6d2e8a8b21f0
SSDEEP 12288:wxiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:wQm2kxUlYtEjedEeQ16ywqmpv
TLSH
T142C423C2A8273589F6149A3450F6E6A3125A1CFF75D8D1DBDBCBB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 23718b9a25994119e74f61c2f7da3e0301d418e66d349673ca3101ed2d192f7d
MD5 83916f8a2e0fe26fd0193fa3e4b396d4
SHA1 d6870d8e09fe87a28c5db314eda6df3e704a0768
SHA512 77d398e20eae5917d8f23df02a37630c8994d45f87b2bc5515d8871f903b28cb26ab70a4191484917c1923c72c319d8d7d9d6552385af0b8b9a72e1a5e19f4fc
SSDEEP 12288:o4iAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:o7m2kxUlYtEjedEeQ16ywqmpv
TLSH
T178C423C2A8273589F2159A3464F6E663125A1DFF75D8C1DBDBCAB21E80BC027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 9d745432e633a6a78b0c7c1004b6e83a926c01cadd507f2d79575780a50aabf6
MD5 e814784d2f76c5e1f47bd8e17f184624
SHA1 c7e04ec61416afd84ac605e1ffb6798e4be9988d
SHA512 eb0ceb2d1b4983d334e20f6e547d6e07142adaa318a93a1ec876fab2aa08452477f09f0cbf8a2ba83b521977ed619e79383aaaea429d34c578e3f71aa4d5b3de
SSDEEP 12288:XMiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Xfm2kxUlYtEjedEeQ16ywqmpv
TLSH
T136C423C2A827358DF7159A3460E6E662025A1DFF75D8C1DBDBCBB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f82b41a55578d7a329564e92712c0afc2cac180be5f4b200a24893bcad18b78a
MD5 eb81c7e461bd0d42d86ab86a5ad36138
SHA1 329be5bedf0ba6e9fec69f88105482b8f8f74552
SHA512 0afb6b2fedab289487f2ae95ed00ab98478a85993180051eb5dd161b0e066307e65f912faa399c9d9d4f2c0c02bbd52f7d78b91d98bebc92202ef826a8fd0f58
SSDEEP 24576:CZM3zFVSOHm2kxUlYtEjedEeQ16ywqmpv:CZM3zf+uYtO2E8ywqev
TLSH
T182050295B35018F8EC63823EC8658912D2B27C6A17B0C65F03E4362B5F773A15D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 acf79521e64953a72f9f97c43346a94b23f315e263eb9a073e2f6baebbe4b163
MD5 9cacacd8fb76992553bc46e67e239776
SHA1 461b50eb85ff32ed6f36d15f7e8dcead2c3de3a2
SHA512 c49ec6e49a57e695a33f7d6666a1b84d031ecc5be30712af7713a468401eb81fc3e21302347db8cedd2afd02a6b925c07d3b4cf212d2fdcd55054ffaad702798
SSDEEP 12288:DbiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Dmm2kxUlYtEjedEeQ16ywqmpv
TLSH
T136C423C2A8273589F7144A3460E6E6A3025A5DFF75D8D1DBDBCBB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 68010a4b2ea48d396ce972de5997fd4c90e1c1e1dfa6e14425ad8da5b84d0284
MD5 eafdc036137993138f07cf80dd3e27d9
SHA1 d5b53a0fb7c739ab84073e64c9816c4d619b7ebd
SHA512 101545f08e25570e81a36a534e1a3bc8131a76b6dab7b6d956804eb5338798d020b4ca019bb0b523102a66425994a46e0e610155a029ee2b5ca117a60e8deba9
SSDEEP 12288:pniAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:pim2kxUlYtEjedEeQ16ywqmpv
TLSH
T177C423C2A8273589F7119A3460E6E663025A5DFF75D8D1DBDBCBB20E80BC027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 8c2dfb2878147106debd976be2ef2f9bcc91854f7b48894bd6038887d61204e9
MD5 be07f385b0a3b396e029f6c9b6f66098
SHA1 64a3204e618b3fa3c4124bad69877fbe4cde8605
SHA512 39fc38af6f33b8264779d1584c847a985b22fd78492586fe40138ef66adad9ea988e41ad8c5fd3802c856484b33d5ece05d4eac7fe6ab70fce9914734dd2c009
SSDEEP 12288:ayPz5L8wiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Hzyjm2kxUlYtEjedEeQ16ywqmpv
TLSH
T102F4124773A130FCE1368238C8A25A12F37278761764CAEF57A4477A1E372919E7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2c9c5c9742a2c24fd9a3a20929240fa095f0102846579d8bc735bf75cde3410b
MD5 6c1c056a992dd744b5eb8abe842158bc
SHA1 1ff8b351b8b972620d1ddc9051616796db9aca71
SHA512 3827a66641ee1a155a4fdba0b6876eab7d41726f9b93f179bc206c734f9fe601264d1f629ea3fb3c5c6afc0adaed5d10acb47e1a162dafb4eef7bd367e9c47bb
SSDEEP 12288:IbiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Imm2kxUlYtEjedEeQ16ywqmpv
TLSH
T130C423C2A827358DF7144A3460E6E6A2025A5DFF75D8D1DBDBCBB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 ace338450b3031270d8430c8abfbccb7a526d496ad9b52c3f22a281d5bfad190
MD5 ba4b15bbce0cad14a478a666001f4d13
SHA1 6ecbfb014924ef198b5a76ec8abdc37b82a3491b
SHA512 706e4e3413080fe7ed584eb702e9f3bbbc56eeefdd2b2c48cc3665ffa853baea576ff9a81994125b6875ba32b2241b8c55f620755f4f9384e156d3db9635756a
SSDEEP 12288:+biAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:+mm2kxUlYtEjedEeQ16ywqmpv
TLSH
T149C423C2A827358DF7144A3460E6E6A2025A5DFF75D8D1DBDBCBB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b9912a132a9a8f70c90f4ae263ceca35d6751c15c4c137fd23bd797b37a5d914
MD5 9bce8bfdfb98d37601754dc6d7b3ebf9
SHA1 67083b0442697d45b945cf482172a9a6ac387b70
SHA512 74c3e4b7d82e05a0695e68d7aa78643eee48653ce039332921c9ae90b6264d1b2ef69646b4a0b5ea5ea8ade4a30572de9b78a06410d6a6c4fc716ae97407dfce
SSDEEP 12288:9yPz5L8wiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:0zyjm2kxUlYtEjedEeQ16ywqmpv
TLSH
T169F4124773A130FCE136823888A25A12F37278761764CAEF57A4477A1E372919E7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 4f27fb92e809d000d381be79e9bf997ff88c276657f020f56ef47931d5bebd4e
MD5 8b96aea313f5d154a6f2e511a1931034
SHA1 b97013ccd7daf0ef248e950a438cc73430508c0b
SHA512 fa2b55ce59c53dd72f267c69c53b80588b43bb1a1fe803ae4cf804cb14a8da335991c0c124f8e717fad37831c7dbbce7a670576f5efcaea39636a094a120a1d4
SSDEEP 24576:CT8aLl3z0zD9m2kxUlYtEjedEeQ16ywqmpv:CT7Llj/uYtO2E8ywqev
TLSH
T1B7050295B35018F8EC67823EC8658912D2B27C6A07B0C65F03E4366B5F373A15D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 f056e6940b6ffce9ab9f4ef6db943b3df28d945effa9b1ee35187aff6cebdc00
MD5 db361b407e23c7d36961932fd39c14b2
SHA1 4dd07a3b99b81fc524f1e1836fd93ef27ae22bb6
SHA512 ac0fde41795a2f4eda483b98d6190f60686e7a306b69e314ea09bc2a1e38463f9ebfcac96a8c402f9501418b9532b4b235ed9d8ded5e70a9f38a71d17583b607
SSDEEP 24576:p3rd9CHKy7GZhm2kxUlYtEjedEeQ16ywqmpv:5rd9CHKya+uYtO2E8ywqev
TLSH
T11025CF90F3E410E8F1B7DA3589769512DA767C9A1B70CA8F03A4661A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 1b9c95cab6b2316106e7a005225ffae94d3bf549ffebce4a7f3ef701ac8028ba
MD5 a099a47ea9a58d1d290d697e45e28125
SHA1 cee90efaabbea04d9f432cfbfa1266ee7d08d77b
SHA512 8541c6de761fec84efaf835b2ed1637a4bf739459c0e29bc2f855634627a10107fbcf6f249fd367151fb21ce2aa93dc8eae8d4cb3f78c9f616e6b29ada5c0e38
SSDEEP 12288:5eiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:5Nm2kxUlYtEjedEeQ16ywqmpv
TLSH
T11AC423C2A827358DF6145A3460E6E663125A1CFF75D8D1DBDBCBB11E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 49bf46edf0652d51ca4e471b746642c0a567a839c7615ee136940ce6e7c21fb4
MD5 de3fc73892c4a8b0ea1f1855d29af05c
SHA1 36e7a40598f0fde0ecaa1b9ed7d4b834cf177bdf
SHA512 867defa179f9f1a71d9404f3a0d3ca8fd7f63f707dfac2c72602bcf539373306c9257a958675a164d420244356275ef092483ea0b6496634210cab65eea99d23
SSDEEP 12288:CQiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:CDm2kxUlYtEjedEeQ16ywqmpv
TLSH
T154C423C2A826359DF6148A3460F6DA63125A1DFF75D8C1DBDBCBB11E80BD027D2EA085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 43bdb22b393b4074b6b8c4dd4dc0e6252792cf9ced6e0d9fe70d14444e215c23
MD5 4a046ecbb5cfc53a6124635a6046b4cf
SHA1 cf0b93f0f763e3db3c0286c222cca3430f46df57
SHA512 f7753ba18b695f726b09f94aeadf8ff98e146ef1406e4b2ba2bb7324e799eab028f10306d340811e3c803c10027e429692a142a772b207185ac6b86a12558505
SSDEEP 12288:P1iAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:P0m2kxUlYtEjedEeQ16ywqmpv
TLSH
T1ACC423C2A827358DF6149A3450E6E6A2025A1DFF75D8D1DBDBCBB20E84BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b22ed05538c13b7cffb3bb0049e380ecadcefe7ba2cf9803f5d6de40ba6cabf5
MD5 58ab0c40aa9e5c2e7075363c151f7d0e
SHA1 b466abbf3639f73a80226a5553693309005fe4c9
SHA512 33162b90f912a17bba96d88a6451a33c160c9f7245f4257ddfa5e2da0235bd10fdcad6cb759d46b3458735f24fb7002ef212edb25859f7168c9753f17e1c45a2
SSDEEP 12288:6biAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:6mm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1D8C423C2A827358DF7144A3460E6E6A2025A5DFF75D8D1DBDBCBB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d87223e3a6e7a720939caa94cb9130f147dfae1ff02ef4b696f77163d3d90dea
MD5 b343840b8ef01148902fbde411ee5a75
SHA1 1de6ae64bf5afd77a9b9f66a0b92abcb68386dd6
SHA512 6f386840bef4bc8d794b3380b0e44b66280efcfda56fdc951ef73b4514f900e9f20aad4747bb6c0f0a298a42ecbd8fcc75ad78a8e1b910eefde9f0cfa0338512
SSDEEP 12288:teiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:tNm2kxUlYtEjedEeQ16ywqmpv
TLSH
T18DC423C2A8273589F6149A3460F6E6A3125A1CFF75D8D1DBDBCBB11E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 948b100322f2390488ca0a7244266f0276a53bf0d561a17eb648515a15767eab
MD5 be846ef363a0bda0c0c6add523402209
SHA1 aa93ed6094a78d47f6bec955f8a229ca195fffd2
SHA512 8176d06829974529f22537d9f2046d68b26fab5bdcf2e5eb94876a2e7394fa16db8954d88502fd4713112dee4ddda3fc4b3876335da923e1cfc4174ef77b9c99
SSDEEP 12288:CjiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:C+m2kxUlYtEjedEeQ16ywqmpv
TLSH
T11FC423C2A827358DF7148A3464E6E663025A5DFF75D8D1DBDBCBB20E80BD027D2DA085
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 e6e600b3b6dbbd1296d3e066d982387572773bb612e432784a331375f9da35c9
MD5 5c5908905e26e98c4badb2cafe62c0ac
SHA1 6520821e006b4ea3d4b1e98212d96d945413a805
SHA512 6da707b4eb17bce1427d14a685e7990a8346185990f28fd96cd77d76255eb638d39576db66a68d640440ed598db747f026bc335eff7b78a05eabf79e11541596
SSDEEP 12288:QxiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:QQm2kxUlYtEjedEeQ16ywqmpv
TLSH
T1E0C423C2A8273549F6149A3460E6E6A3125A1CFF75D8D1DBDBCBB21E80BD027D2DA0C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 01a2091949a93264f9ea642bbd5775a3a3cdff2ede6a17452bef38cebc6edf75
MD5 c937aa3e2ca4646050e39aad6d82fbd9
SHA1 dd948db42d7300098b403483a3f2ff471a472895
SHA512 59ae6bde54e4b0b223ddac4033886c2a52b39e0b904095a00b271dfafacf46aa6942894ed593292171917870ed5bc79ee53dcc0d3ea3b2a74d37725109b494c2
SSDEEP 24576:yfwvzk9RX6wkyAISm2kxUlYtEjedEeQ16ywqmpv:5MnYIFuYtO2E8ywqev
TLSH
T19F35C029EBDC04E5E177923C99B7460AF2B178691B71C2CF029A536D0E37ED49E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1f06ba538ec2db1987e166d4135b4757d82ddd27a937cdb93a7a771037a3136f
MD5 6315c1942eab6df9e6c27cc35020065d
SHA1 b7270213b174ffea7ecbfbe6a25405c8344e7acd
SHA512 44d012226dccd48049c0b04ca925963534eafe4b4296dfdeb560d45ccf4a2c3c3b5601dace01631a1f89e314dd95673bd71269f5c2392723bb8afe21b6a2ca28
SSDEEP 49152:zYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0EuYtO2E8ywqev:eySzPMuFJ8yHe
TLSH
T1CD067C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 65b09721b763fdfd5a6671c4324af9526113f61727429fc88afc1791c841e121
MD5 3e9ba2892701d11e93b6d4dae2419144
SHA1 a6c3490141baf5b2853b73d9b9294939da51fe9d
SHA512 b30741eabd8b3a32f5ab3152b975b09510bd568d42c5c783de243a8616156e8ad35245ad3e24494d0b6f2afae60bff4671bf47acfa45cd8a3d142a920430906f
SSDEEP 24576:947Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY3m2kxUlYtEjedEeQ16ywqmpv:947JUQjqirIhCnDHUPfF/0uYtO2E8ywf
TLSH
T19165AE1EA3EC01D5E1BA927885158A5AEA71742E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 edbba5a05ae4b1252f2eddcc1133b2171e2aaa405200e5300b3476b8e5552a6b
MD5 105cbaaafc9c77ea16a9abaf577fb942
SHA1 f30131df89fa3258646e687c16b5915e0da0b854
SHA512 9e93b1b2bbf27020fafa9f7b849f223471850953161d0e387b50a8b5cc7ce2307d72adfd4939bd7f80d9055aec1ab86c31fbdf4f0bbe126bc5f90e2a5b2f7448
SSDEEP 12288:ppsfriAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:K2m2kxUlYtEjedEeQ16ywqmpv
TLSH
T1F2E4014AD25812D8D16E6239C7969A41B3333C6693E0D3CB57C0F53E0F7A2919EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 3615ecbfe5451efd3f4e7b63db219fdc42229c41e33107e8ae205bcbab2fc3bd
MD5 3f5d373400c3a98e6fb609ef3937fb8d
SHA1 14b9485ccef871e4cb3fd19cc69343577028af21
SHA512 22a8a8ff3abf6419fd42ef21b0c8371e3db0bb197b48b1aa6331695ff1b27e33a970066626a7ad730b4b79790fdc3d67b23c59e715a47015b13f4b56169e0357
SSDEEP 12288:PH0LU3fmF0xUIrZ80ABkgvtol4mIVpb9d:PHKUPPtX8T1ol4mIVx9d
TLSH
T1AC2528107667C74FC66D80361E36D2CCA7B07D01EE45AF0773C8873F9576A58BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 694dec244e8bdc1345aba74da23d3edd2ebe85181ba17d2331d15b5507db8e50
MD5 56d53d2d862a3a372b5aef6b60c87a10
SHA1 de5524f3278edeee8071ea349b2098968a93365b
SHA512 99407d69c9b60cc7a0939985e6e11db657b8b03642b29e1b9f28f0367a337b569264e5849da13aa4b184999b1aefb5caf2682af42f5421ff8e873ebc40690ac1
SSDEEP 6144:0SfG4FJAk+LNt7I1slCSqtMxbSqtMx2ZL3aAmFUWOaayXhlxr/fCaXN2sP:aAWhN3lTOdQ0lrHLXwsP
TLSH
T1B565D7406537A38FD5B66032072A5B8CB7A4EC17B6056F27B388453AD86BB11B4F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a8074f5af8a750de2c63ae86a524d27fc24f7802b360bdb6230e87b0c4a59509
MD5 39bec861382b55afb5eb9058543d2f88
SHA1 b4049581fd07d34b4b3392e87766feb282eab7e6
SHA512 4bcff9dd828694747848644f234439b4dd07e0eaaa14933abad731ded6885b8e65434ca8158e650b2dd93895853bfcd278026497857ad8506778d5a813fda7d3
SSDEEP 12288:cM7ziAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:9Om2kxUlYtEjedEeQ16ywqmpv
TLSH
T185D42382A66A3549F6755A3010FAD532121E7DFA3BC8C0CBE686B35E807C0D3DEF9146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6d36af050c59536adcd196a5e660fb7d65059a1830c3aabaf2386011eaa838ca
MD5 65ec495298f71bbb6d117bda7022c7c1
SHA1 fed66634acd33853244caf49edc2b7ec78442225
SHA512 4725775d458551e4ae655939f99c507337fb4e07ae0146cc30f24c144ef7075216a7029071658c6db7810b39fdef6a25f99056b74f1921c23ac6959c25d848d3
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYcm2kxUlYtEjedEeQ16ywqmpv:Ngb4mBIBhGFKuYtO2E8ywqev
TLSH
T1EB65AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 a939626cabef3c78d63ba90b1176f1581fba2380c25770368ac98ee4aa449038
MD5 d900a935ee5860268d58b311322cece5
SHA1 7194df2b1f396d6d98ec4dbff6187b49ca588f08
SHA512 26d8ce140e4d76ff99b44501020da48fc0c698073fdf57c074c68e7e9c50a2ede811687e3f06dfa8a42cf0010181db85286b66aec1ff7d223f954125577158b2
SSDEEP 24576:GG88u8FpJqH1vzria7/mHm2kxUlYtEjedEeQ16ywqmpv:N7ZFPqVya7/3uYtO2E8ywqev
TLSH
T10135016576E101F0E47BD13889824663F2B2B8251364EBDF07A88B551F33AE54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 e4e540c4e9c429fb43b06bb11d3f03e5b6e98c35543cf872eb6547f2efc5e168
MD5 f71ba1baa8fdf67327e3e6dc3b3093a2
SHA1 4708989739b75cea3b983663ba695b4e0f7677d2
SHA512 98415ba811480cf147602cbe943cba83c2bc53f62f06e5cabddc62b1f2c2c562e819f21bd91b24937c5a5ca91c0061f201cdfc5289de5eb0cbd9ab0074513f9a
SSDEEP 12288:2HvUrBFrEjwaQoiAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzD:2PUr+NQrm2kxUlYtEjedEeQ16ywqmpv
TLSH
T17C05E15F22AD18E5F676E13C85828719E372B8621351D2CF02D1817E4E77AE8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6fa36c09495f969d959be065e5ac255ceb7bba5a2762a1990ebcad0ef33dcdbe
MD5 cd8e03fe1a03057f58e0d4ad0c5dd0af
SHA1 3208b3e7eb7652e346b07fb7e672f894e91ce2dd
SHA512 43b04b6ab20af89aceb6bc70bf4d98cafb268301946b4bafff92646dc632ed23f4c8a6569e0769b24c71fda2b0a16d6db41ea9d88abe918a7a5a2345078d141f
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjOuYtO2E8ywqev:5G05lO43bduFJ8yHe
TLSH
T159D5C06A62EC11F9D1BBD17CD9C6860BEBB23825033456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4e95b154785161a8f99cd8f5f1270c7b2a8559cd6331a04b91ca022a3307b2c8
MD5 5a75c594daa8ead8e5d37b0ff52795e8
SHA1 f926718876949d68c273ebd7ae80736dc1a2e86d
SHA512 4fb61f41a59f420c494b59eef17a62a12e1ea43738c4f7fbb00e3f65e2db6d916e1c63543086fe84426eccf83e23ea4c2190242df26b87a9f67a5e5ed076c8b7
SSDEEP 24576:lfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn5m2kxUlYtEjedEeQ16ywqmpv:la5POZ3lJt2pasx2+m2uYtO2E8ywqev
TLSH
T12F65BF5EA6FC01D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b7def4c7157d85dcb80bbd5dc2d7520d89e310876fb81e78e5e9ad8d7f3d72f4
MD5 d237eaba725253a39e87d2ccd02230fa
SHA1 e45a1b039995ddcb4587cad90c4e2d342a611666
SHA512 65e1fd5922cb06b7b7b901489256e7656323a8533e2e547fe3d358ead35191a642b4ce8cf0375d1d0a59c4ecafb1b5612d943e549a225ea007b15d91554fc19c
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7Fkvm2kxUlYtEjedEeQ16ywqmpv:rNc/zEOVHFXuYtO2E8ywqev
TLSH
T157857B5622E901E4F1BBE1BE89779546FAB17869133486CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2536517336f739c979530fb4662117358919f01240588fce3605f197f6d62c6c
MD5 3dfec96031be25f37141cf290f1a1629
SHA1 209a3cf11b1f6aa6a4fd95b819b1a6ac468c8c7b
SHA512 ee505859e8c92c6f98213e23b16e497c4aa725472557acb5daedc4d9cd91b329ea00bb383654952179611003be03749db6d503cd060d09816244d513aa6ffe9e
SSDEEP 24576:pzkNvNnaFeYhJNtmZBmVm2kxUlYtEjedEeQ16ywqmpv:pzMwBtOmAuYtO2E8ywqev
TLSH
T17555AF6EB6B806E4E1FEC6748D238512E6727461173293CB5390C13F0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 3eb90e603619290795ffa59fb177507fbfccec33036b1916ff46736f0df3b21a
MD5 6c779fd4d12180da74d2ce22e483e7fe
SHA1 c85a255ce876329f8f3cc75465da170f5ab488cc
SHA512 723552558df1480d6480a5b1adcf19f2e2ed03dc186290d14377b8f9631ad349c83c3d8458d7d9c9c4022ef1190d07be4db284c3a3c328305a98ff1e7ca2dbb1
SSDEEP 24576:eD3FHshBIYQgA6m2kxUlYtEjedEeQ16ywqmpv:eDVHeBIAANuYtO2E8ywqev
TLSH
T14F25E17EE65C04E4E57AD1BCD6A38A06E37138AD032156CB02D4C1BA5F6BEE46D3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1960-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1960-16-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1960-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1960-24-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2344-62-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/2344-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2344-278-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2344-56-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/2452-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2452-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2452-327-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2452-90-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2452-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2452-96-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2648-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2648-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2648-122-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2648-116-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3148-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3148-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3148-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3148-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3356-1-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/3356-9-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/3356-10-0x00007FFF22F30000-0x00007FFF22F31000-memory.dmp

Download

memory/3356-66-0x0000000140000000-0x0000000140982000-memory.dmp

Download

memory/3356-6-0x0000000140000000-0x0000000140982000-memory.dmp

Download

memory/4404-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4404-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4404-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4404-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4404-40-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4656-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4656-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4656-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4656-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4656-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5256-102-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5256-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5256-313-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5256-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5256-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5256-108-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5664-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5664-85-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/5664-80-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/5664-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5752-134-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5752-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5752-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5752-128-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5752-139-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/6048-76-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6048-74-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/6048-68-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/6048-294-0x0000000140000000-0x00000001400CB000-memory.dmp

Download