14d1f088924193564f7979610753945f808121baf05a0d26db86b99c916daff5

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 4.6MB
Sample260803-fxbphscm8t
SHA256 14d1f088924193564f7979610753945f808121baf05a0d26db86b99c916daff5
MD5 06e38019bf9bdfef51e88a08156d9bff
SHA1 23515435f560b984959dc8abca7daa9984b68e2c
SHA512 32fb8a4ad2f7d974a723dd030c8dc759abbd46e180654f2a80b9adf1aabc8a4520661b308fe3fe237af8478e1e6f71208c662165606872d97723c306b1949610
SSDEEP 49152:UGtlqDVwASO6Hm1pwYXStH3gAhBClbice52ikesl4+Xog3kulj6JrPOfWIU6ifZ9:OygArbjkT560fx+b7wRGpj3
TLSH
T14F26AEA9A57C00D1E4AA92B9C2A22217D771751557F057CF2A608AF60F23FE02FBF741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5900	elevation_service.exe
1268	elevation_service.exe
3340	maintenanceservice.exe
4800	OSE.EXE
5032	PerceptionSimulationService.exe
1144	perfhost.exe
3724	ReFsDedupSvc.exe
5104	SensorDataService.exe
2080	ssh-agent.exe
2520	AgentService.exe
4968	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c06c632a83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a29f00a0723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008ae864b0723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f08734b0723dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df1dbd4b0723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d82d810a0723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000dac7c0a0723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	2520	AgentService.exe
Token: SeBackupPrivilege	3724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3724	ReFsDedupSvc.exe
Token: 33	4968	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4968	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4968	SearchIndexer.exe
Token: SeDebugPrivilege	2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2776	2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5900	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 5176	4968	SearchIndexer.exe	101
PID 4968 wrote to memory of 4688	4968	SearchIndexer.exe	102
PID 4968 wrote to memory of 1284	4968	SearchIndexer.exe	103
PID 4968 wrote to memory of 3016	4968	SearchIndexer.exe	104
PID 4968 wrote to memory of 4720	4968	SearchIndexer.exe	106
PID 4968 wrote to memory of 4452	4968	SearchIndexer.exe	107
PID 4968 wrote to memory of 3768	4968	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_06e38019bf9bdfef51e88a08156d9bff_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1268

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3340

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5032

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1144

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3724

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5104

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2080

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5176
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 57898108d6f4e4870fe4675585ccdbf0af3b1a05d376d1b7813701f298124f5b
MD5 b4398dc7c37f116e7c191cbc476c0a74
SHA1 c62434faa5f3cce9c8f2413cc96afbb2897cc687
SHA512 ffe848a151eb4ab8770278dddcf93c38fec06a952ce8656194186072b1058f7b7d16476e0ba41002a53cb0de2bf79762c588809b22fac960a757d83525ba2384
SSDEEP 49152:5b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnBLNiXicJFFRGNzj3:P3q6mjBu7wRGpj3
TLSH
T178D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a6273e52c565914e0bbc43c9d7c0dcbc3096f3ede17c2bf612b57d04eb95e633
MD5 b283cc44c5cf9df96e3d6997c1e82ecb
SHA1 27d1ee3f40f2bb61646697f5700cae92269e0e26
SHA512 d4aac2797164137c0a73e2df403c0c6637a2650b589b3d4bdaafba4889557a0b4bda06333ea77b4572685a6427240b13211cfc6c8556f90939a6a4bcbd110724
SSDEEP 24576:bXYfDtczAa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+tcvLNiXicJFFRGNzj3
TLSH
T13F75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b6d9bff459597a39dc264522e9411c058915fbd88521a0e94dec08d361496d58
MD5 e8b3501dccaf1e4cbb5ee180930f13f1
SHA1 61ae9c37370060041ec81c98374034c0f38bdf11
SHA512 f822125a1a70f70cd573349c63de20f30d7931ab6d4913bc7de5931f5522347bd01340822ec43b04877c9eb4c2e4ca7af65bc0bdb84cd3754d9919595a6b87ea
SSDEEP 24576:30Le5ji0hmxhrM5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3Pji0AzkLNiXicJFFRGNzj3
TLSH
T118859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 69dbffc2f73dbb8ca0e41847a179b5ec249dd27e3e5f326443457c1f933339e0
MD5 ca6cf8c7d4928191bd7b55675918258d
SHA1 3b187e901a0cacb35da8ad0c2a51d6fb7566a9c0
SHA512 cc788c14a2e02defdde1b5e68943a4f25f026e4d551463534d08cbb519f9aa3dd160027488b8f3df40b853f91e6fc2aa8c0d7daddfdb82342c89d0aacd1728ff
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWj6q8wyuf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Q/ezSC6vUzPv+HjyALNiXicJFFRGNzj3
TLSH
T13E756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4cfafc1d23d0342f87faef3ad45c21168a1976d1f5578903ff9bc955ffae1bc8
MD5 a4e89fb77e097292e35a3197cbab1c4e
SHA1 937f57e3ed03330ee239b749b758de62caa5bcbb
SHA512 d1609287e7c6af27249420c8075f7a7366257400d29e7c9b08a151f48a5a86b1455fc50dc40880ec1661e554d64e449bb64b7f1e7fe60dd048293f2cc890cbc7
SSDEEP 24576:gVbqPb88hv/l+Be/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gVO88hXl+ELNiXicJFFRGNzj3
TLSH
T1CC559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a8fcc44edcc82a6d57ec2fe008def34dea458dbc27cd51145464bdc184a0f157
MD5 65eb8696b0ac7634cf578fa3770bc6d7
SHA1 78a35b9835126d05facdec990e7f466cabde3318
SHA512 18a9255c60ff25cee7c250bf9d271b736743e46257d82d0ac8cea7704798251ff72004dc697d1b1c754d52067c511baecacdfd44cd7777b37220a72e0fef1c35
SSDEEP 24576:2G9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LLNiXicJFFRGNzj3
TLSH
T1235523D3468855B1FBFD003A867A5828B5845E2C8A595CE3D2543E5E923CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ecd21b422bab0537952ac0fee86c0c476b0a1112f53d9d7484e4523701200855
MD5 73805dfc923a836a3aa8311ea15df999
SHA1 7b1d78a2c7656dca75400aad02f112ca32a69146
SHA512 5d9ab88152327c8f55e675a20bc157d0b7c15950314b35ec522820fb3048d475eca5a813183babde573d0ac1092d57261d87aa1ae5022dc79db9fd1bef98f92f
SSDEEP 24576:FJIUW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FJIUWLNiXicJFFRGNzj3
TLSH
T16B75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 59a217ac8a041e231e513dd2e60efac9668a047699d8cdf0130bbe208d338158
MD5 ddf4de1bab5ad6c425a5d82f78012332
SHA1 69de8fb3ae62b4104d8c7faa37f44e8168673399
SHA512 23b291853c58bb496c927c2ad950e28e2c0e0b667cec90959f9ada7839a57baa56d3768ff3952f49af57f4cd9139fd9c537bb39e6223cfaa5b85e4009b4d2f6a
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THY:qQvGAdlCEL8c/WRNw5CP7wRGpj3
TLSH
T1CA266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 4421fb5331b55fded8518e2e66547db7e4fb3fcdf279fe1fc6b2fe967e3925bb
MD5 8fc7d5cc33382ca8706447ff3c0e0238
SHA1 d5cabe35fcaa2acfa8236a67cc2dda9a6a115aba
SHA512 a31668854931e3a8d81a41c85949bff119f629365320c627b5f5a37c473d246b19ffdc08ac31ad7a88f91398904718123819c4b2b44c925568eac76235640e79
SSDEEP 24576:lfewsAjU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5ljULNiXicJFFRGNzj3
TLSH
T1B675E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 31a86b225e10be1295930ee8c38d90a00fa2e51a7de6655d3fe0c3a786a5cfc8
MD5 c3a57161546f33b7e9ddce6d9a2d6356
SHA1 cd70b98b2a9b9b4a76f545bafefa49893238da62
SHA512 ed1e362e3196c8c8e89ef741c9a610ede70386e220984e34a17c2510c880b94892899ae799a812440d5490318495f7a613e6bd1a294931e908acc4a74d4ee19d
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHYF9:hUEtQevvqc2W1cpV20I32s9
TLSH
T158474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4bd374eba175d28ecd7823993eb5f94f2738aa83d3025cf2de1dfc2b2718bfd5
MD5 9dec1035f1cc286b7ec3569b051170bd
SHA1 c9b4d76d947f2c18d7abd39612dc85c59f1bdeee
SHA512 fe8e15c4d28ed4fda1a0f971694fd264ad3ded963a1607be4b3b269ff934b2bd7feb825c5825e7bc55ee3a886d22e4d2dbcd7942f4d60a99c1910d4d846b7237
SSDEEP 49152:dCbRquA/m2yL5zLfFiV+XenmE3/z0LNiXicJFFRGNzj3:aoq2Vjnmr7wRGpj3
TLSH
T13FD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 573f9dd4b594d542154b16c220910f2237dd81b8da9a412f754eaaa2338b636a
MD5 998bf54c140f261c18bdb5054ac0fb89
SHA1 4c25b137cacacb875bf6efb7f8839087c699a356
SHA512 141035e8656bb43c682f4f63dfec844d1e5e2e1e142d6d4aea44c5a3811d43b21b68a80798422a6a17fd28ac017823a89d5be3b60b78cc3bee7eca1987c4e763
SSDEEP 24576:HAhGL6IFoiwtA5l7S53L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HAM5Foiq5bLNiXicJFFRGNzj3
TLSH
T128359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 fc788f84c84f6de9dbbc0b88795fca06e2d75f5217136b8fd3d522ba8577df46
MD5 089942e03bd1028eec77b420e062135b
SHA1 ee7d20b423de4231eb444895d1f1697164351c25
SHA512 4b6635e1ff52c6b825ae094c182d67dbac31c24e022dbb7a35a6d4256b72028b6bf8c21997b6e7186bcbeacfab4574ac276cab90fc9016e9a036bf02081aa685
SSDEEP 24576:7wuROWg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7wSOXLNiXicJFFRGNzj3
TLSH
T10B65F08632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9a6b2f4d62f325e2a7af11025d6cb9391017a2ce3ff40dea7cfb0c7a46e1f111
MD5 aed4ed134b8ebdc497bda8072e76b630
SHA1 38b72e23d13e309642fa14a70281833a3db598b2
SHA512 99278c26e40fa8d8928c5ddd7aadf20d00412e97d72561b51b57495d16e8987f57fd25eb4a532073256ced8cd6b2c22eaa2289b474da1b214dabd112997e8299
SSDEEP 24576:mZux/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dLNiXicJFFRGNzj3
TLSH
T1B555129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c99d633a6b4b406127d24c4ce5cd7c21a18218faadfc65d2ecc9c98f4af0e024
MD5 8cbcefeedb2ef89681146628b875fd23
SHA1 973eb86aa24cc52e31a6ce6ec6595f9db8f737e0
SHA512 078e317707c108330f0cfa4db95a0d6581505e32a2ad4617da5077bd908c96b7a3b79d85febf4f4ab92bbb76a8ed0518f3411454e359961b7126126e7abf3916
SSDEEP 98304:BQRQyi36YOcPDLvw2gAf+PN3y7wRGpj3:YQyiKanX+PNmF9
TLSH
T143667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c06665a2ef8832ba611c257e0fb32abd4a963fb14b282956fdef12b53de5fbd5
MD5 174265b62ee0be3d939d05de8ae7631f
SHA1 018f19245e8d18193b10533235e47ee99e5289d5
SHA512 9325ad87d6b037b36a00cdb47d334cd8f90e9f9bcc6308473dbbb7457c5a680f38fd15f252b28f1e6f023d22303ac860720f8e7b02c7227514ade64870642d0c
SSDEEP 98304:NQRQyi36YOcPDLvw2gAf+PN3y7wRGpj3:kQyiKanX+PNmF9
TLSH
T10A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3eba2e7c84b399e8e98284fc6d5a181ec081aa761ec30f9773e6a9577cb94cb7
MD5 8aed3cb6d89f811184e3662a155f5fad
SHA1 0c2fd0bf1b2d3762e3fbe29a75e5367be00924a9
SHA512 f346c1dd062aaeec022cc0ab5055bc93f3ff995c3d6737523f1ad876a5e7e40e2099158b622cf2bfe3a649521cbbb93d365712c903ee993f68c50d61178056e2
SSDEEP 49152:E68Qg55nhkeWu7PNU3/kLNiXicJFFRGNzj3:uthTRc/k7wRGpj3
TLSH
T1B3B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1e620b7dd4deed4818c470a603467128c2eb0895bac927086b0302927bd4087f
MD5 7d90bcf7c0687d7f71cff01add9338bb
SHA1 243a7e565356cb401a3f9bec1127d85b313c7674
SHA512 2b154cee18dc6708260b0331423f1203059f92b53abed304a3fe5460dc3676d198c29517828f9ff48b9bee594147beb14c8eb182fc11bb7e167bc63a9dda4ad9
SSDEEP 98304:Iy5112gYy5azzVvU69nLKnhZ97wRGpj3:hLIHRWhnF9
TLSH
T109167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2137ed332c3f0d444be5542da55c1cd99e51c89b8af412295c231b42c2b8c5e1
MD5 3a2dd919ac3d0cf5b9458dc6f7b6dc85
SHA1 b9a14e1d859e102539155155b4963283902edac0
SHA512 c6e233549bb5fa1f148f0313ede92719f8e23cf2504ddf88007f5a8e046fad40c51d2950c92e61cb2a6718f93dd4685ac3a0fe3d1498920c63debdce2b3c72d2
SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glqLNiXicJFFRGNzj3:Nu6JmIxd2dq7wRGpj3
TLSH
T103D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 eddf91147707c31709d7b525e5760a8adb549b7339ed3ffc2747f1fd4b803d2b
MD5 f6af26401d403e9df97a6acdf1bdfc1f
SHA1 fdf2caec1d67ac47dde3e94aa39d3d20a027e96a
SHA512 dae411e2ba1d0be76e924f01c87bad31f5f69b7b8d6558a71e00a60c681b718c9aaa98789ccb76273f0c72a520aca32d1c698f4a6652d746e14259855db32970
SSDEEP 49152:W1hpsNoJpF1A67U44CwH7R4x2LNiXicJFFRGNzj3:WmifPqRr7wRGpj3
TLSH
T1F0B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 756ac858a8a9593d5abb9c321fb46e5a68c26cc2fb62b32f109fa68cf75ddce6
MD5 c197089a4a1a10a67b557c4fff7f6288
SHA1 775ff7ece02831787c8b8bfff00ea444d9646d14
SHA512 0c3e6f07b5b26accf358251ef38355792461f8ed2f931797088656963809b27b65676c73eafdcb31bd9e4063e6cb0011af9e3373f588bfc2fb5647d1a98293d4
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHqxLNiXicJFFRGNzj3:A5dKqi61x7wRGpj3
TLSH
T1FDC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2859c15aa055130549b3599a0ff3e5461c42f7c9c4f4d05dccc6dd30cc7c2d51
MD5 89bdd9492258b8011b4ab9b710cf7f20
SHA1 a75bb77bc69c240ac25cd79d039624988444ab82
SHA512 549061c62cfb4c7d4f4f8280158fc490aa2fdddafabaa455c83391c79309e5df479730d33b8091ebab108f2d0f4068ad55fec1ca2a9635db85ea3fcc0ca78985
SSDEEP 49152:chtSn8EApI0figjgiDn0AP5waLNiXicJFFRGNzj3:dX2iWph37wRGpj3
TLSH
T19795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 771d6521c5b4adcd5a05ea12f90d186935115db8a51b86c6043035ce44106c9e
MD5 6587a3681863011c3e80d24fb78e8447
SHA1 06e5c957d0c8128e47b3fb829d8ffac9d09bca72
SHA512 4c391da23e98ff800203b90878a5cb7d14ac32f93894c4b3eda900cea61d10bf3231f29452c08097abd245a406d7285055c69eaaf6f6795e357a0ecb7078a225
SSDEEP 12288:ipiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:i1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1135523D3558955B1FAFD0039C6754428F5882E2DEB5618E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a7be11faa771a6480750ef3b72e3fa966ad6bd4f6cc5af3852ed22e5ffd7af2b
MD5 bf171c8e6233173143c4398ea6270f64
SHA1 5381997d1a5e1892b116dbe9dfa94374ec0a2ef4
SHA512 6129ef919ea86f4fd13ae5af52c7d1b1cd1785585339c888467e57891093d054193d0382ac98e1209d48e1241583db4a3df59f2ccc7e9df33636fa617b581e41
SSDEEP 12288:P+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 db6491a3f7e04d3ad48ac7e14dddf02f8eb31e9232e42513207f3d5aad83488a
MD5 ac4976cdd62e41bce7e7c39fcbc76929
SHA1 119f5dfe4160b28ef1e847a750c11cc63ad5a8ab
SHA512 a91f2be837cec19327b24ee086e7fdc4ce3704b71df12828149a78771f148a6533548fd7f783c290c8ec3807d2c93a74c2c846c8cb7ff35dfa149b848aad648d
SSDEEP 12288:2kiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1005523D3558955B1F6FC0039C6764428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3f5fc18b3b1fd85405cdba7e66f45b4c7e587b4e27a20da8a6a392606253de53
MD5 6fca7ab5cc45c1a5326664506703923d
SHA1 5d2397a061cf0db6aa58585173930f67b48ad303
SHA512 c3a69f586b900473258805943372d78be61f11794b45f57f132507dccb1eb0c40ad2540eefc438999264268020b094c8bda5f101b9ac42fd1d0cdc7e5b921833
SSDEEP 12288:eVfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B5552393168900F1E9FD8039C6764424F2A47D6CDB325AEBD3003D1E5A75BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8d6904982ec4b2122ab8941f9f4e70bbbbb5f0844d30e8e5bf5ed406c857b221
MD5 fac35a1569f625f4f37f756fc96cb39f
SHA1 e13831ea1b6d0b1828c3f204635c94243f974279
SHA512 8236dd365b33ce924de36cbc59b962c9ea94897f3c5c9a42accf1670dc0ed8381560d3b6b5c95082797303fbb86fa06d8c1f0a8d94b4462ab7fa6ae72a7a27c7
SSDEEP 12288:JHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1095523D3548955B1F6FC0039C6764428F5882E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 31072eb10671d951c0d2903cc7415036071938c0b57b411914c53bae1e313acb
MD5 5f94f77567ab24f037587563d6ae41a0
SHA1 0a838362bde186bb968de77186a45adecc3ca3ea
SHA512 b0212a795b0a7562ef9568c5847a9dde4f81bb91b0b65eba16b33e14b75eeaf8a33c3553734c133de5725b3a60116002281440855c697315fb6134ed4c3cc71a
SSDEEP 12288:wqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ws/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F25523D3548955B1FABD0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 98a9e4fae19c82361cd3812f0dae5d7749ffe4a47c00a87bfcdf2c9e2b5c4fb3
MD5 4a02a827920eacd67cd7ed976c34e6db
SHA1 586dd4d5e43230b479c5a58335a79f815383ce0a
SHA512 55977ba4fe549f0d71cbfffe499c59aa4027844f5a6be273c59f4a5611967c75064867ee743af854951093c4759fcef115a924b2ac33de9172af181eb4a2f85e
SSDEEP 12288:gGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D3548955B1FABD0039C6354428F5882E2DEB5619E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 be6db53c5598b533267ab9664c4eb43425e95a3d4261516597c639270c625747
MD5 5d7b7019854a55761f05edfabfaac613
SHA1 7a2fc613c5221730a5329dfb0db81916e4e43fb6
SHA512 0b6a9142c11e69783723db18ecbab2856bf2d1c83374a9b39c3fbf64456bbacc9fc1df719a522d6fdaed8e39c2335296d6f29932248abe848c35acb1094dcdf9
SSDEEP 24576:4ZM3zFVSOo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4ZM3zfcLNiXicJFFRGNzj3
TLSH
T1E4750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7dcf3b4dae40ef35db31f7380d8f6c325ec8908df687fae076a2da58d205a80c
MD5 90e1805da952d4c0e564c6ef45754b24
SHA1 5886f1277b9f76127190624b4c6d8c4969fb2358
SHA512 7ebcd402ebf14fbef93ca485c2240b792dde297544a8b83eef6ef0acaf742eae1d025f8ec80bc5f980e6a8b9bcae4a0a5d208aa91fd98948143be87a23d45f5d
SSDEEP 12288:I9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ih/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e8cd0c1734ad0e1acd4e9a4d4755362245cf0aedc4adfb51674b24bdeddb9f26
MD5 6a27b78426eed1daa50a614067877b95
SHA1 7a54d697207f7374361332430730e3e815d1d17c
SHA512 f36fb0265b1f7987c60374e16824344e4e7df5a7784219e8752212641de012793ee268185ee2056a53b71b6c0cc255fe7c356e6d07789bc03d80e61a342769e7
SSDEEP 12288:RBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Rt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1555523D3548955B1FABC003986754428F5882E2DEB5619E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 88fd8d12407f742ab28f84207926f0c97ef293a6022f14a880b0731679372eee
MD5 2ddf17e06774de4d71a7e8bff821db81
SHA1 9574ef577ef8f7329eb4ef16f1614b1c3c49de9e
SHA512 eb35320c9ceca9c805fe7420a7d77b03822d10f18044e1af3132b2d6fc1aea7a9ab30dc13a2c029f9d0c4b36cf920bbf107690cb6f583aef3ddd4a86f5706c29
SSDEEP 24576:wzyE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:w3LNiXicJFFRGNzj3
TLSH
T180650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5f509b7e0be2472f1db503270ce167d9396a917f4a96154c762c8b3c94c75bb7
MD5 856787acfee79c28b54197071e7b11f4
SHA1 31df850fc3869995ab6f0310a2acde12b04d66a6
SHA512 479e560f9d96cc7b94ad2693a4af1b88ce58f7608f54914bafe9970da7c254456ac948c89aa43a8e52434b7274beb7b7cf89c42349594a566e53478b5b750aa0
SSDEEP 12288:d9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1665523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4581b84d3aecf0794bbe394a6dced71f334eab961fd19a66e6aa934c45dcfc11
MD5 2a98fe5f83ab434b75e4524a32d6f685
SHA1 a3f3026d630b217d5cf2be0e388c8e8105c6c577
SHA512 e692aaef90e9fcae0cd4e8a284cd0c44d811852e15cae6e7f930d3f3e0129260c238ea734122efcea8733d27322dc638ca29a2fc9dbe67a45fd8fba5bdad1579
SSDEEP 12288:69iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10A5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 35662a8308db11aff7dd265e07ebbb29e9ef78dc32a4f507ae669f4c6d56543e
MD5 1a9700b79af97eb921274a09bbac3679
SHA1 8d406566287e790fa0e3107d2ee811914af0aeaf
SHA512 a63740fb043919e32422fb54310c8968ba504514d5ba2eb3113330e5e1c200deac53f17e3a156a3b01986dbe5a797e7c5c2550759c0120b3f39984e365c99c55
SSDEEP 24576:izyE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:i3LNiXicJFFRGNzj3
TLSH
T1B8650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 d8de80d1ad85543405f1ce034f598f9ab7baf45ecb2c5fda5d524e00e5ff207d
MD5 084dad9d1e7b594c560c14074c0e246a
SHA1 e092a53b33debfe12a4d6d434161db9abd5d2260
SHA512 9a09186c8a8a8bf4c5593bd3f3d61a86fa4eca35a16aef9814662d061c6c9d7979f070bb9021f8c39a44d6c3e71ed01538b37128355a4f0ebfef5ed089ff67e3
SSDEEP 24576:jT8aLl3z0zD+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jT7LljfLNiXicJFFRGNzj3
TLSH
T18C7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 dee9b2c6f366190c88d908b80d03c04d3e7d4add126d743844a5660f2e96606e
MD5 f68a9c5ca346054fb81f8445f8f2e764
SHA1 de0e02799c95aff7dd2a52be31938252a65ea0fd
SHA512 991554fa852477564f697591f61dfb348e1603998c5b457c6a3c9952e2fc6b7a157b26754bdeaa0d31c70e585905296b06e5e74b2ee6f00b54457ebd0fb0a2fb
SSDEEP 24576:+3rd9CHKy7GZS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ard9CHKyacLNiXicJFFRGNzj3
TLSH
T1E585CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ab28c9c66c7b2138d9130e29edb566af4ddd3671c98229fb182761fbe994be7c
MD5 98bac473fede21634fba47c1c8918d98
SHA1 48adaf99c8387916f2edb329f5e5b200fa2b1425
SHA512 82d9a76cad7bc9936863baf61da93b4f96686e7a9b08b451756d857359ee44101a259a24b3cd13ad19f44cbe3997886d7678de6f634a08268eb626fdd68cbc0d
SSDEEP 12288:fEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1105523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a2cf324a58fef04757963b81f53e825d405871e607a639be1f9de3c64e57ad51
MD5 66428fe6f7ff77f1f5e31d2dc61e4d2d
SHA1 f23cc15626e359781739f62a4ea4a31c526662f3
SHA512 a243167cad3297a5d1c337d686fd7e48009a92d512cc0cc907c9ba41a58861f4bf3b91e964bc5042da30ad264d5fc580f746fca932d64198ce1079a80f2a0593
SSDEEP 12288:2iiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C25523D3558955B1FABC003A86764428F5882E2DDB5619E3E3443D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1b158d71eea85d4f4da15ef087570bae7e4affaa758ef9fb9ec05d4662af155c
MD5 e3b29e0ba9cb50352eac145b2c40635c
SHA1 c59131f954b186f5c69fccf610f0b274f27dd32c
SHA512 e3fa3a81d7f74c674b835d906934979a80d1cdfd46bb6926b181610623cb75b344e65f1553748db60497111e2cc45929693820a9af55f26b483a49ff0bbf3d3b
SSDEEP 12288:YTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1965523D3548955B1FAFC0039C6354428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d1d03755694413ce36471fa38104cf91adcfbabd99ea2459ecb8c09510f36b05
MD5 84a2e6d7dc3eef1a6544f717bac69841
SHA1 242b2750364b3ba822b1f005fddc22a545090d54
SHA512 a6c80d0f172b4cdfc68272f64af8c1ce5c66345f68db21dfd4f0b780bb822ad77e6cec2e45b8f81d9442b28ead77c05cab3ed59b216d9df0268b6ad91ed9c6df
SSDEEP 12288:F9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1835523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 064ec5c1cbb460a03aa4ce1aefcc16a4998834df34746b8e48a41b21897089b4
MD5 978ef081d8b2c2139b05c5013db6ec9b
SHA1 130b93308762269de78bdc9c9e8a866037d09d5e
SHA512 859c248c3d0695f91c637dbbd8d57b0268303005d0f4ee891261d2564b430bc7c6d369a36b982399d5cb2a18a3d20c8aa24e15995044712a2f5b7f0379957f6e
SSDEEP 12288:2EiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1225523D3548955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 bcbce68c74c0fb67a30fa748a83c8df55ed1b4408be72e4686531564de4ef459
MD5 5538c5772628e5266b0930b63cc33bc8
SHA1 b0caa1c1eb0caddd9775f356682b23665a76f88b
SHA512 3259a9c035e5a94f1bd8ea0d56a3ea1800dd11e2e5c0ad222fb40436f7d07c7b1aefaaa1ec3925afe1ae635efc1c3d4ac73b6285d9e8327a64dea0b5e8f9b16e
SSDEEP 12288:JFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FC5523D3558955B1FABC003AC6754428F5882E2DEB5619E3E3043D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 aa77bfc02eb2f31dd3911be7ebcaae33c5aa42fcb495ca174316ed662bb31fb5
MD5 be163fa1b6c3f19d774565b4d2a9284e
SHA1 45162af7a0d0c8fbfaec11477616753c55317d97
SHA512 783a1eb94475051618001fb90c52091472550d7aaaea0723a35283df1e09d4f1a9cedcb7cc2d8e3c633c96e43fb29c314dca1186450cf5931bc7053921444351
SSDEEP 12288:hHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D35523D3548955B1F6FC0039C6764428F5882E2DEB5618E3E3483D1EA278FEB9F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 80326b96a34d524435fbebfa9dc9c21ea2f018ff32f1259a3c53e340e051065a
MD5 10092a36c76b66b7382398c3cee93f6f
SHA1 32b1de497f5797640dea9cc0b0b8f31dfac2c3d9
SHA512 e2f8ab17a9d8219a48b9843534765619d9ac907343db0290358aadb8a73c9cfb36dc51d8332ed8ea4831576aa8800d03c8c0d30f1c46e9875dc1dfe5e4845e51
SSDEEP 24576:Zfwvzk9RX6wkyAId/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YMnYIdLNiXicJFFRGNzj3
TLSH
T12285DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 92df5936bb709360fa4e168f8f24409f5e2b9c8352ad42fa502d24d911cfc777
MD5 e0619ddc26853086fbbe3dd36c70eb88
SHA1 e1d54b5c5ae5578c7fff504128ea8aa9bea2bb66
SHA512 ff0fa13d004d3ce56207742c92abf30a3bdca0cf61c8f7a5e3bb84d93945d7134985a35816b44511926c3c3ec37494b2a883134f6c552b4d6c3e91fe68ac5924
SSDEEP 49152:xYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06LNiXicJFFRGN:IySzPS7wRGpj3
TLSH
T1F7066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b3847ac997cb824231a1c9d67ee2f45dc2a49c4e5c19d1e5ddcb280655a49168
MD5 dc6cf710502fb8b5ded324265877bd35
SHA1 4ae7d87fe3f4bbd0519b95602efdde315777f4a0
SHA512 d2bad3bf0ce656ae7ab19955ded8fc7ee0a6597064f0d5af00fa5972b971ce305f62de08eda829b38e09a487503b10935de24cb096bcaf380aef85b7b6eb3c87
SSDEEP 24576:A47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A47JUQjqirIhCnDHUPfF/qLNiXicJFFS
TLSH
T17865AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e95e749543ab228ca1dc225e5a612fa90391f52b3c4eff7f9d1582a3469a0176
MD5 fe0ceea04a9b7313c4bbcf498a1e4275
SHA1 071c34b6fcd2f950783436f64f735bb73ef87d7f
SHA512 46a9a1c3390afa01e56b3ded5a6893144175f59400b1be5607c94805fab5bf15001e45dfe9df5e4262a7491173b7636b60099235fe2b86d2510ecff95d3930ea
SSDEEP 12288:bpsftiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E665F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 964dd266ecb781e63b9f9e37bf04de655e7a1831c176200c463c3a00cabeb657
MD5 d88fbf18596ce1dbdbaf423ea9c14a11
SHA1 fb4f697a4775e41af7cb15e373f027f59a5d0913
SHA512 a22a0f9a5fac772784b17ee9a0e3cc06b59f1d4243c3c2c37b354858a2fcb129b6b8000ec27bdb6c224cab21f233dce3d6b82ae77057bad7a812e33cbfe550e0
SSDEEP 12288:ua7qKU3fX9OFixlwgiNwSuB+VUOPcXZAjxgWvOMR2AYmAGIn:ua7BUPXHmUQUExg0OMR2rD
TLSH
T1AA351840B66AC75FC6AD40321E36D1CCA7707D51EE05AB0773C9873EC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 7656fb8ed8e99d6733618f6d1a05ef6a9cdaabb0127cb1eb63955d5a2990751b
MD5 da8d1dec6135a0519de0b28f00ac1265
SHA1 3dbc4714f8d8d8d1971bd37f8f0aaf948917a16a
SHA512 282d8db255d9ebb428f17c054cf2281c020a0184e039f4fcc026e9ccb423acbd9a6535abf58e8fdf225dc501dc3245c1527c4f63104466bf451b1555f1183dff
SSDEEP 12288:1ziNwSuB+viNwSuB+pB+2iNwSpB+FB+/iNwSoiNwSLiNwSuB+riNwSVi/e+/D9mo:1g9qe
TLSH
T12B45B9819437A38FD1FB6032072A5F4CBBA4EC46B7055F2677C8453AD827B25A0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d7abc046c8b0f449f9535a997dcdf767376510c5be96900b95f4bbe67cd0e1ff
MD5 0787747f826e0ba2845b2fd7841f6d3b
SHA1 6632f3630a2c7259aef178e2eb13a846692df098
SHA512 6d6720e1a4f66ff036762aeaa80c0d27a382ccc5b8f9ac545850266b4a36a4fdcaf2ef2d573fcde3ec08ff0e1f5476361dee6d092dfbd9717b2b97fc8c1c8d3c
SSDEEP 12288:ZF71iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA552393468D59B1FAFD1039857A8434B5487E2C9F1598E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f812e958d41d9a63c3bd1150706ba6fda6ed9fb93382008af48793a1ffd7615a
MD5 8af8d3ce4d3621d12c7f30a8cac412b6
SHA1 ddac2d84e167da7c03fbf69a7f1de40f88440937
SHA512 67527dda4fc1f808ebd4e178757a2fa0d1f248c39f036fba57da57768a398d0cb1b92752c65f3587f81dee6bb14a2481c8f583b43e96457b6aaab4065cbf9626
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bYf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2gb4mBIBhGFYLNiXicJFFRGNzj3
TLSH
T1FF65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8f15b696030d047f74bde6540eb5ef47f73882c7f46f85ddaa2babf7af7c0cd4
MD5 a6d1c27987c760c43a796606f7ddbaaa
SHA1 6f6a2feaa70e553346263e42d65efa4f0b275bca
SHA512 2eacdf80febd7bdee62b6073be878b82c908d943b94c641d158d466cda1727e3561c89d4952277d6ed15bab458b9e29e53c1d57b03f7bdc152256fadd321c0de
SSDEEP 24576:IG88u8FpJqH1vzria7/mo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:r7ZFPqVya7/HLNiXicJFFRGNzj3
TLSH
T18A85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 2083bfb6614d937a93f723706b366704577004bee67b9f4b988a7594c74d1425
MD5 f2119f2c69cf1906ede4222372d3b215
SHA1 1206cc67f54907f2c151089359e56820b3e561e5
SHA512 44385471d467bd50e354c1b865d36bd71354c8e231932106350750732a84dc05294af10fb8984884de2ea287882ae5387b2219941f6070edf2632d9ffe9704d1
SSDEEP 24576:ZPUr+NQc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZJQcLNiXicJFFRGNzj3
TLSH
T1DB65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a335265f3210a12b8f61baeb83a0d0bd4bf9c9778c4a5e17422ca3d9d5ba6f71
MD5 6322109bda3b7e8e71ec1b38c4ceb39d
SHA1 1594d0c92a94eaa76001103368831e5a363a47c0
SHA512 8aa24ac015bbd2b177ca85af999316cd4a99ec02c31c6edb40035160d3c6d65378c129c0b96ed154b73298fb43315bb38653c025daed96623f67c53169332926
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsLNiXicJFFRGNzj3:+G05lO43bl7wRGpj3
TLSH
T129D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 21f252e8365daa9ba61b1cc66909f031bdfff2fde0950faaddcbabbbf97fd133
MD5 9709b2b597fb6e78a2ae4c8bb19d1bd3
SHA1 db31164cee5424e32237a632f716b8c1d570a3d6
SHA512 96be403d9a6e11edb57a0e1dd7c1b57699000f7c7dd520c5e82088b8a7ee970b63868bbc564b923419c21452f6b0538ace2caa8d23924c36df652aef1c25e96a
SSDEEP 24576:efa5POZ3dpyWVM50JicR2hG0lasx2+47eidn6/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ga5POZ3lJt2pasx2+mkLNiXicJFFRGNf
TLSH
T18265BF5EA2FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 41b3da7ddc2517aacfed89dfd1f9c6d3fdb2dbeec046aaa9782e6862d984ef5d
MD5 5dcf3e7cc3935ed2701e4e5fb1306217
SHA1 075fb77725c57a61fe8cfbd304c4f71921988e53
SHA512 82cd28b9b4d27ddcb9798fcace7479676f3a0d539d29d8aa544905a135e9a5026cc939d73149149c076c50f4df27f76cc8ec78916cbe83e06b870369ff50e9d9
SSDEEP 24576:2NcwHdjbyQ4nLC18lb/EOjowL7FkA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2Nc/zEOVHFnLNiXicJFFRGNzj3
TLSH
T1F5858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2653f5d563419333083c54ee0fffabc45b570eaa130d1e86e3d8d448a54c955c
MD5 9e38f4700f5ac82327f60cda8689cc75
SHA1 96be39422bfdfe75f5cad6ad877bda3e2fa5bfa9
SHA512 ad171f4b710237545530dbe42aef19df28bbc771611b1f9b160450df0c09b86e97ff6cdc018f2493d7793b8d54c98f607e64099549d5f0f30f806e1290fd5c70
SSDEEP 24576:5zkNvNnaFeYhJNtmZBmG/TwSfVcYG3K/cJHlnFR+IGNe8j3IzG:5zMwBtOmGLNiXicJFFRGNzj3
TLSH
T12855AF6EB6E846E4D1FEC675CD238512E6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 c1c9de0942a21d09accc3274400be3afbf9676c4a2abc4698cbd8243d815c9c5
MD5 15fc704659b3f3b12322560a18354523
SHA1 4f64ce2a912c5744e0c346421fe4b4f863c71124
SHA512 22bef3bbefd2c69f8edac6b3eca5d4b2406ddbda0ce82e1d04faf4657e967eb64bba9dcd398264f479d406adf60960b88a874f65220cccc968ee9e3a5d0461b0
SSDEEP 24576:ED3FHshBIYQgAV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EDVHeBIAAVLNiXicJFFRGNzj3
TLSH
T11B75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-79-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1144-85-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/1144-80-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/1144-310-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1268-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1268-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1268-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1268-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2080-313-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2080-122-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2080-116-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2080-115-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2520-140-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2520-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2520-134-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2520-128-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2520-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2776-7-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/2776-1-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/2776-0-0x0000000140000000-0x00000001404AB000-memory.dmp

Download

memory/2776-78-0x0000000140000000-0x00000001404AB000-memory.dmp

Download

memory/2776-9-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3340-51-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/3340-40-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/3340-47-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/3340-46-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/3340-54-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3340-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3724-90-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3724-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3724-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3724-330-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3724-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3724-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4800-62-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4800-294-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4800-55-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4800-56-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4968-317-0x0000000002FA0000-0x000000000323E000-memory.dmp

Download

memory/4968-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4968-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4968-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4968-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5032-66-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5032-68-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5032-74-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5032-309-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5104-109-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5104-103-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5104-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5104-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5104-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5104-314-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5900-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5900-22-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5900-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5900-21-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5900-15-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download