0dce7c7c471a1b507b3f5cc57cfdf69f36b8958e7b0298ef36f2dcb352b4eec8

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 1.4MB
Sample260804-c8yfwabg76
SHA256 0dce7c7c471a1b507b3f5cc57cfdf69f36b8958e7b0298ef36f2dcb352b4eec8
MD5 79df3d2c3cb1a1c919ea656f7479b3c5
SHA1 04fcabd4a1ab5e6c1dd832ed658cf2bc36d7cd56
SHA512 eb36bf1af681d7021b00a54b14fbbcec79f1ba777dd3dbc436de508695ff92c38ccc808e45b9bda90ae1f49ef8710c652f60de0123ed951cf3191425ea7a3f7f
SSDEEP 24576:C6dHLN0DHu2CRz+7r4pa0/vTVh0lhSMXlhwqsqjnhMgeiCl7G0nehbGZpbD:C6dHLN0DHu/Rg0plodDmg27RnWGj
TLSH
T1F365D01AE79801F8D47AC279C6A2654AF6B37C4657605ACB139135AB3F336E04E3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2400	elevation_service.exe
4644	maintenanceservice.exe
3268	OSE.EXE
4532	PerceptionSimulationService.exe
5076	perfhost.exe
4088	ReFsDedupSvc.exe
5152	SensorDataService.exe
2660	ssh-agent.exe
3340	AgentService.exe
5532	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2df3f15ce62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004fdd69dbb23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1ef325bbb23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057e6089ebb23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b30e6f5dbb23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e62a749ebb23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000727e765dbb23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
2400	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe
2400	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	3340	AgentService.exe
Token: SeBackupPrivilege	4088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4088	ReFsDedupSvc.exe
Token: 33	5532	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5532	SearchIndexer.exe
Token: SeDebugPrivilege	2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2108	2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2400	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 6084	5532	SearchIndexer.exe	99
PID 5532 wrote to memory of 4664	5532	SearchIndexer.exe	100
PID 5532 wrote to memory of 3152	5532	SearchIndexer.exe	101
PID 5532 wrote to memory of 5056	5532	SearchIndexer.exe	102
PID 5532 wrote to memory of 2228	5532	SearchIndexer.exe	104
PID 5532 wrote to memory of 4772	5532	SearchIndexer.exe	105
PID 5532 wrote to memory of 1408	5532	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_79df3d2c3cb1a1c919ea656f7479b3c5_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4644

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3268

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4532

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5076

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5152

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2660

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 05e82b8ca7c2a7647edcbfe4fa327df10a008884181554284ded448727912104
MD5 b98d4e619fa8548d3df8c690a537412d
SHA1 d36b494f2b326675912751da2a14e08b4e4d7481
SHA512 ef65f925df344453a63c07f5269bcc5a633d3d75283e3f329e78650ba419c37246ef2ee48fca7b916e2e7432716cfe04d07c0311f67d704ea1bab35a4011c3c0
SSDEEP 49152:Gb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnmDmg27RnWGj:43q6mjBZD527BWG
TLSH
T142D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 6fcf609c834cafae4217c8900a8610191189a323ae00ef7d110cf412a8606d8e
MD5 d7f106151d61e6a52b9a239ee67fc3ec
SHA1 c778f27c95e9b1e21d57911524a25df0574dc4ec
SHA512 eecf6db7027878a03e345b4b71824c34b75baa439503468d2e92b4d4ee2647a7e846c37cc119399df7ad5644713690fe99049f07056b2b1e1eb43ace1db9564a
SSDEEP 24576:YXYfDtczAxsqjnhMgeiCl7G0nehbGZpbD:PtcsDmg27RnWGj
TLSH
T1A2650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 03ad560b37239aa7bde1e2ff6c8ff46c3b6a234523a0c956999e9030b486d77e
MD5 0caaa210ff315173775d9817e907d2f7
SHA1 2b479b841f877829411c85ef081c5e5413df14ad
SHA512 5b0cc1d1f435493d98ade6166557dc1c5de7db4b0cfe25ddbfafc760f365e1623f140048fab62eba5fb33263d7ce8f7156673cddbae93ba7aafa9a6d115fe2bf
SSDEEP 24576:z0Le5ji0hmxhrMKsqjnhMgeiCl7G0nehbGZpbD:zPji0AzHDmg27RnWGj
TLSH
T19B859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f896940dfb466d34167a701341904e7fb7ca773efc380d5cf6bac85c800329de
MD5 976ffec2a43d8db0d14464e715edfd31
SHA1 165273a185a44f2ae5498b196cadcd5c0142eec1
SHA512 ee3f651f02d9b73429af2e4fd3bce1f109e7aefe7cb3fa1fc737ef05b9e71ebd2cb70aa9f674fe74c5fa149679dbac3f79c8cbbe8ba40a539f976887356ea05f
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWj6q8wyugsqjnhMgeiCl7G0nehbGZpbD:E/ezSC6vUzPv+HjyzDmg27RnWGj
TLSH
T116755C25F5788323D0B2D0BAC5D6BA9AFD7230465B3089CB0246D76C3E277E58636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d5c49fd0e3ea49a2cfb49d08bd77ba13148b2908ffa9cd0287b80d6442fb1b21
MD5 55b97529183d5864b04663c8335e67e5
SHA1 3acf368a5d43fc6d88641f69c0c9ddc84b3950b1
SHA512 8560b87fcff5129347935ac8cdde902bf3909ded07c433d45f01cd1623427aa7db4be5fbe1ea0f4c55d9ec1aba89875d3e4315ac0778bf1d358b97aa20c63ffd
SSDEEP 24576:4VbqPb88hv/l+BVsqjnhMgeiCl7G0nehbGZpbD:4VO88hXl+nDmg27RnWGj
TLSH
T103559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cd75a9f3f3e990cac14ee2968dcef907c0ad83b37d695a12f02e22ea40189ca7
MD5 435e3d4d9280b43a743cbda519ec217a
SHA1 3a79b6cb57ecd90ee6ee2d472721547439d905f1
SHA512 809f47b8527f99c2800352575998618bf12d23f82e48fd363525bcc8182167a7ac2414a4e8dc28b6307330f151b49d79666724680bffc6411abe6538ba3aad02
SSDEEP 12288:1G+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1G+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D24523BE825C10DAEA7704B5C3E9F51E6C177E56982008436A637DFDE6F5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 131e764d70c1c980ca3b3c6f2361f3bbb2d9be7092ac30378dca20abeb17afa7
MD5 2e140f40b1d5a12577c4540bef5b551e
SHA1 b964919c9992890beba8e3a6cb7dc22c8368b2ec
SHA512 15401ca13d805e536526c7f6f6e888d9a7cb9ac9acff6d4c2ef85e2dcfa7e220330cda4c2e9db83d22592c7ff6952ddbfb5d4706ea9eddf7bb81887cb9ca03dd
SSDEEP 12288:meBNUbTVO86U9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:mJIU9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11965CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 63f90103e06d8fcd4030169194fbfd2a54fead35ecae5c640b2f5daea9caa22c
MD5 54c770eabb54a29a8125aaf1c3cbe912
SHA1 d20887938e036c75bbd9bd665026857083c7decb
SHA512 bbafa3851ac832cf7371eea32b569a01c71b0426694a5a16fc572fc3827f9204e1a27b3a13a89158fef60a87d6213baae9541d86bc8c0b3887119e792c4404a6
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THU:pQvGAdlCEL8c/WRNw5CMD527BWG
TLSH
T1E7266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 dbb71d6bd0d707ca08f9065d7f3630ce38f8f12e80031e084d01fd4ced4e4cd1
MD5 a25d3c77df0b9e87d2c100ad235dd316
SHA1 a7cb73437bc7dc19aa535d18d826904f762583a0
SHA512 ecc52f9725242fafda4fa2d9a1c3cbee9f11d12fd7d51fbe87f26f74896d70c2d4bc98d11bda234bf9d90932f94f31652c0954ea53d39cb72f7c5bf0f0f9e6bf
SSDEEP 12288:9AwSfxL/2Dc3mDLLmt0LDQewsAjzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:ufewsAjzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC75E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b27c38284ac2c712e298dd10e20b90d6f651cd348f5f7cb6303becc605f5337f
MD5 c4b7de32e748f91d841abec8102cbbf8
SHA1 025f640f5a1bb8f7ed71843c20334c35f3930d40
SHA512 af2c7e689c406e5881b5f9c1bb78544d3fda75a2b2a9da729b3c624d3dbe3cebcaa3978a8c5feb9994a7136617c9f72d9eab4b15ead441619734238151dc7fa3
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHfVQBWG:OUEtQevvqc2W1cpV20I32WB
TLSH
T120474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2d65416495a4b93c1974361282fd200f586a8f9a348c518573ed92728a4996f7
MD5 2fbb4469fd057d989115c5aaa3ca0f87
SHA1 069f6766b1f6d0cd68cfc4096ee11318954d3c69
SHA512 bce8d49fb27d489018f70072d481443f1d09b69be571aecaac58d50c26a288429990570b5a3d5308105b217b51a3fc93409a4d9c1c6b80a9edbb35c1717cc8cc
SSDEEP 49152:iCbRquA/m2yL5zifFiV+XenmE3/zXDmg27RnWGj:noqHVjnmYD527BWG
TLSH
T16CD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4bb7f74b635b3d024f24031d5f74214e93f4dfcbd6f9739181b460de78c98f0b
MD5 2f1f815da551f4ae92f884e6205fe97d
SHA1 2c1d158f6cea831ed262ff361314776c48932c57
SHA512 9338c8052535b38b42b571d5c06a4a37152e58e680f3826551e9b076389c84bfa10ca07eceb69c6bb3cc53d8a34051c6cdfd1ccacd971d3c724b9d78c4015d24
SSDEEP 24576:9AhGL6IFoiwtA5l7S53MsqjnhMgeiCl7G0nehbGZpbD:9AM5Foiq5IDmg27RnWGj
TLSH
T1A3359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1821206643c6ea5a8c64f282b2e0cf9074b6b7fdb9aded83434acb5b80134fae
MD5 10e56517e0445fe995fb4564e14a89bc
SHA1 d4568281dd71f0d29a5a738dba0d8ffbf63c82a5
SHA512 b6de19837b0cfa67ce556066ed5d968c1a78be781004fc68f3d74768792e86f7927c7ad793d2cf9883ff3202c79e06c8a70a4bab4454daf9afae769436e9ee19
SSDEEP 12288:Hmw5HEjsChNEBFgl0WDm+CAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:GwuROWvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13065F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3466c78f43e393e62865dda134c4bd000e2de80d8afc19449b9836067587ea6e
MD5 9784fc3b0c4387f16955d61db3ada8eb
SHA1 bbe6b79a58ae92856c7cfcb77697697b9c2928b3
SHA512 a2194664f9eed48a135771f5ad03e98be2b3a18420863e0b8b6f8141509faefc0c57828d018d69cfc375abe3e7844c398332786e2fdadba50bed277035567890
SSDEEP 12288:yyZ1IyjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rZuSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E5512AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 888873519b11e447d5194a989b739a3ec6665bd103717d3a8141f777ae87a9d4
MD5 3cc306c883867412955e52e96b5969da
SHA1 d3feb3c2da90ff31f414c64691231c8113fb8e8e
SHA512 ffdaaa3b216e822bfc21b3ab1ef8785c97c31b0551bb600e8655775da1b53b8693e057dfe36f133d4d636f2018af28af11e73ac76fab0750ccb074c5de7c5bfa
SSDEEP 98304:VQRQyi36YOcPDLvw2gAf+PN3dD527BWG:sQyiKanX+PNtVQBWG
TLSH
T159667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 61708b7b91787ad4c199b9f5fcfa7b80a8ac3021d0630a97930cc99976b9223e
MD5 2a3622c3400b6df22bd9f5d19753e4be
SHA1 0f24bc71e326ed8d32f7c01b45a175028e79414a
SHA512 bfe9e08be089ec51c7c5fecbe8e12c29102c0cf00a359fcd9e7c80b8f6ef5652a23cc9c837c1932faad75ad3e17e2f33982e44c77febe21ccaf878610f944fd4
SSDEEP 98304:1QRQyi36YOcPDLvw2gAf+PN3dD527BWG:MQyiKanX+PNtVQBWG
TLSH
T1B2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 47dc9ec6a172e2654ece7bcf3cb88027763677f226b3b165531a9140f61bc291
MD5 2973355e6848e74d762db466cd84a614
SHA1 15adb6f23c8ae316b4f813505d387c0870fafa0a
SHA512 b525d5abd260552f2d884b2be8aa0d9bc39186072a2e14161df05578c6a502be3f063176a785b3d9e8285a43c14c0d7a6b2f8180be72e3fac322cdc2156d29f6
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0isqjnhMgeiCl7Ge:I68Qg55nhkeWu7PNU3/HDmg27RnWGj
TLSH
T13EB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 59d0fe9046f27562f1a1b07ef2d71b17802b5ae3624454fc5f10b9e76301a7cf
MD5 2ae5d7a7360f8021453d3e8ce030d9fe
SHA1 f5b9501b93f4e309993b4f2ad28170d148a96e94
SHA512 449b2fa10daf726d28396c538fd0fd173e9495ddae1fd7e3fc49ef391fa84b8ee6aebad9fe232498f9216d4b12f187a96d6e0b76369a2694b4ce729d65dec6c0
SSDEEP 98304:+y5112gYy5azzVvU69nLKnhZSD527BWG:vLIHRWhAVQBWG
TLSH
T127167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e0567864066b536aaac6b2f91fd52f7c6add4257114435eaf43c0c22118801eb
MD5 d209b6bdcf35cdff3b34494bcd2c4255
SHA1 af50d1412c3fee2975fbd4fe48fd2b26e11d5a22
SHA512 27bf23f794d4b821a111e9f91351ed60c145a8b2ea8c0064105d8352793a11cfcd917b14897fbf90f2bba6aa4659fdb64a0e73bebf5045bbe27e3e1bd9c33b2d
SSDEEP 49152:v1hpsNoJpF1A67U44CwH7R4xBDmg27RnWGj:vmifPqRYD527BWG
TLSH
T19DB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 acb16bf2f24753d7c5b2c50dc52cf65ab822b6497ae9c7bcc761a973a5a47dc1
MD5 a415bbc0f16063cffe7e0be7807f7e3f
SHA1 c8704e1f80f30cab823aff665e0821a3dd6128e7
SHA512 a38fee7430965eb3cfc473776003dd1a3c617e257e71dfbd7c3e4a3c29adff49d55fa346035a3f7d029974c079682bf31befc8b5e5b6e68bfcbbcd6b28758b52
SSDEEP 49152:iSuZQIY0Be2KkRVtOnks6NMHqWDmg27RnWGj:85dKqi61WD527BWG
TLSH
T174C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 03e2416dccfb2c557d4857e9fe49211c28505cff88e240c5c7b91d472be798bb
MD5 0f8e0a80e1e37dc0a246395034fd750e
SHA1 a6911dad79ef9ea867271e2ae98824f2d13cc4c7
SHA512 92709724b599ced2d6748e94ed797b1e96b1ddbb5859798075c5819378af5b078b7178f1dc63ca9b0eaac5877d67c44587feb7b180e17209200608616d8a4f4f
SSDEEP 49152:5htSn8EApI0figjgiDn0AP5wFDmg27RnWGj:IX2iWph0D527BWG
TLSH
T1AD95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3d35d8d0e5239a800d5db025225f4142fde37c3f4768a54f1a288016255ea720
MD5 2ce734be8c285857ffc1b0e00403266b
SHA1 098d810eb71b6f2522173e1247c271d6b28bd541
SHA512 7f23103da6eeb96dac3795e905d5fe0c2ec43a05a1bdc06a8136ad3eebdad54fbb54ac970836a79bf5b39d00036883d0cd9187a247d48bc9cfc79e4919cf5c9f
SSDEEP 12288:ImXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ImsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E44523BE955C01CBE92244B5C3E5F15DAC073E6BF92004837A5778B9FBF28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 29a3a770e47b7c3b7af1e0bd14ecc98f4d07d6fffbb9a30377d286dfc4b17e19
MD5 d29d7cc4267d52393e8d790cf81b7336
SHA1 c20dfb8939869995625449551ac3358626b38455
SHA512 968c228f29a21f7540d413ea581ca8ffeded4075517cec3cc64be039c3b5a4a2a6a54cd44731b81c7e777d01f3452b68acac8409cb87ef67fe16c7c37a8602c0
SSDEEP 12288:dHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1874523BE915C01CBE92644B5C3E5F15DAC173E67F92004837AA778B9F7F28684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 36a01f5c591242866706e8274224eb75238e4ed4b936c62d37099de010a3e9e7
MD5 fefee8fb6399960c4102972be3db12b5
SHA1 26f99b078fb7f4ea44e23413d409163d07d8f854
SHA512 31b789c67141b33b77f137d4381cde65a6963eecb4e04ac0466600bce25694db2a2b028060e8df3f36cd7e30f1a9b66ae49443e61aa64f677e41ccf1535de9d6
SSDEEP 12288:9lXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9lsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1534523BE915C01CBE92644B5C3E5E15DAC173E57F9200483BA9778B9FBF28684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6696c27114242350b928bc2ced7d4d89f2ca136d2645788a51f984ca008f83cd
MD5 1582d09071f593ff1b10bc25a9964ef7
SHA1 8f3f305ef983754ef81a1286ada846d0b7e2ceaa
SHA512 74f4d0d6e87a51da1566fbd5f35ea447f2425fea4f631e9db254f75e54ce3753be712e9846d2e0ada86dcbffda107347f84e7e679748d9998decfc559f5be564
SSDEEP 12288:uVsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17345236E535C01CAD83385B5C2E5E11DE8237D56EB3005DB6B532CBD9FB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 849d5847525a009f2572e4026713e3903fc7da1a865b9ecd325b7245125889ae
MD5 6c370da90607627bbcfd45711ac1248f
SHA1 ead2eadb0f9bc4afc03d40ade0ea5b0cb8dcfc60
SHA512 e768cb8ed1d4a7a2a062af7d0c6a2766b5e07ca2b3c28f055746f566fac7fad24375438561893a430e5f70e1affbed0a8662f10602d4cd3dadf35643acb1fab3
SSDEEP 12288:cEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11C4523BE915C01CBE92644B5C3E5E15DAC173E57F9200483BA9B78B9FBF24684B3D422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 550fc39801827a6612fcd979a4ba9c26801b18debec6e44c34ffa82fa70e6d3c
MD5 50c78c5ff67cf9b539d85eab3986961c
SHA1 329ace5ed2934d28fad1c344213c82c2bb289529
SHA512 3b4f8d45031f328c37320cd9e7463ceb23144fa2e04cadc0dce7a776ff743e777b3bd4c631a2fde63fdf91ed10c314cb3d997d5d7a761dde9a360c6de27e27ce
SSDEEP 12288:RbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4523BE915C01CBE92644B5C3E5F15DAC073E6BE92004837A9778BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7a622b103777cf4dbb1d41f56a45ee78f5058df06de5f080ac8b87ce2105c727
MD5 399bb2047a2d87b2dc581a95c858eb4c
SHA1 ef15b23cc633814cdb3d5d116693668de8b3ed57
SHA512 fddedb458a3787674554a0e3f7104eabbaf33a580d9178a9c438e7ba94df7669c5129573cf134dedf6565299d598864a58906afc04469c74cfdaca9f3e231d97
SSDEEP 12288:0/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BE955C01CBE92644B5C3E5F15DAC173E6BE9200483BA57B8F9F7F24684B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2b7f35eebc9799c8ae096285db4a962358e521625266bff94404764c895624bf
MD5 79a7de2111a7ebbb0cfd27ee93d76484
SHA1 dcec6c9cad1af9eaea91f08839eb7c9055b8a553
SHA512 8fe4fa7823c0613115dc60e8a774b3280d34ae5566254b8b2e8e3e7bcbb9972a0b09f6fe15fec4cc5e292613456016611dfc3ccd5d96809dc6541f462a089de9
SSDEEP 24576:DZM3zFVSOnsqjnhMgeiCl7G0nehbGZpbD:DZM3zf/Dmg27RnWGj
TLSH
T1A86501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 45643a5d8dbb22d258df4b53e388c97cb36ecd7759b30afca710881e7596d9d5
MD5 d23fe23ed299f72399420256ac7095f2
SHA1 20afa6e8d3511b395700a8628bd83d8376ce4bc9
SHA512 fe4f4bba96d994539c8e20b78712ad9c61396073223b21e8f886eec2571da76fca74e92bca2f5f540a4269e21c897858f12a7b876e7fcddcdf6ab2141e237c7e
SSDEEP 12288:OCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1314523BE915C01CAE92604B5C3E5E15DAC173E5BF9200483BA5B78BDF7F28684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 741b0427d367b160ff06d3124d58b005a8538ac68f4de478db17abde239d0cc0
MD5 e1b832191380aebde8b1b102b4cea06d
SHA1 4247156216b1207009f47295539594bdb8e8c8a9
SHA512 075e4238529ea3c4c871592ae6b5b36388555e3f78f95372dfad35af81947cc3ab2d6d217d3c3b00c8782b0fc816553da0b57c7200dc7dbcec2b07bd462ef8fe
SSDEEP 12288:+uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+usqjnhMgeiCl7G0nehbGZpbD
TLSH
T1604523BE915C01CBE92604B5C3E5E15DAC173E6BF9200483BA5B78B9F7F24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 406284f44c2b68df06ce9ea5e57db4079757116c1a893db308e0947ff8c75dcf
MD5 1d65cf8cd519210f13d0ce2ae6f4b2b1
SHA1 62cd5ecf6c9dd00c3b16e1c71fcb32adbb5d87b2
SHA512 dc54da41c47910bfe0067c754948088e1a19e3ed01e8c241135138fcc9540c346943227535dc36253c8808c1adf5119b4b2a9016f5576dae47667a9c2945f30b
SSDEEP 12288:+yPz5L8jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jzyjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C555125B73A530F9D5378138C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9b72ab4efe87a6f84af18354b412f951b99d657729d72a1f3b1d5f263d75f01f
MD5 37b0a8eee32d89310e885a562c7ee46a
SHA1 d5856b18e381f9ef3e2afd2f44d8a9dc69addb65
SHA512 a307155aa29f840481de8933e72a843b6920e396f820051b1f2226fe1ec16f40d2a95930364de5957c8a9222dfe58064bed8450d7628d335d146911027cc48bd
SSDEEP 12288:DCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD4523BE915C01CAE92604B5C3E5E15DAC173E5BF9200483BA5B78BDFBF24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fd0bf6b17d900d6ae93144b8798ef2509a05b8ef9534f243b71ca64d663372d6
MD5 fc3b900767bd519a56ed7b41b45701c1
SHA1 1728001e2c090f5d9e3efde803ebb6c5472546bf
SHA512 d32fc7c68d9e17a3912b774db64045ef79b4169c2887cdca74e1184312896b59721221c596ee524283d6fc127252b1f52daf3652b5b0437ff0513355f726117e
SSDEEP 12288:QCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE915C01CAE92604B5C3E5E15DAC173E5BF9200483BA5B78BDFBF24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 56b35e179c5a73f8f02240679f1334ec9d9c4a3d80f700902f0f5ffe873b058a
MD5 a05f2e4e75019ae957dfcaa1efe1e2be
SHA1 e9d80e9037296df9df57d5f354a8ca8e5403316e
SHA512 b95f20ee10e7a7a6c83cd4cee3db1bfef6e02affb4a18f4907f3a55cfbe03527f470cfadcf1f43c019b9d483867651ef816b109392a2f01cc918aba99f635fae
SSDEEP 12288:+yPz5L8jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jzyjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD55125B73A530F9D5378138C5A29A06F7337C3247204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c8b7c305ecbc82891dd5a4ef97d24067f3ae3f3129e063fe4df000c2abf43208
MD5 1139fe15b655260bb89e4f9d4a068b50
SHA1 0e3e0c5f54590454cd5649456450d87256558fca
SHA512 4f46554c50af3a82cfdc657648fe9b06e3424a032d79a34ee08d0676d9bacbe3d1aab0c956d22a0d92333402e2268f48aaeb0a9d82c7cd4a2f913dcd764aa48c
SSDEEP 24576:ET8aLl3z0zD1sqjnhMgeiCl7G0nehbGZpbD:ET7LljcDmg27RnWGj
TLSH
T1146501A9B35018F8EC67813EC965C90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2e505758db383c6ab8aa805de8fe2ec73bbba245e21ad88e83cc549fde632b79
MD5 4330c7a3866e19db71b3c2aeeadf1c11
SHA1 5658cb82a018f7443dc9504a39ba4a082175b1fd
SHA512 61cd571b0fb660122f9b2921d271c5649f180e57cd495db12b099a4432993aa94843da598381fe498526c9bbc0fee11c431e0108c0c3efaba5259b741c243b6f
SSDEEP 24576:X3rd9CHKy7GZ5sqjnhMgeiCl7G0nehbGZpbD:nrd9CHKya/Dmg27RnWGj
TLSH
T11275CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 56db56cd2a5b2cf9e5285e6b1ac838307bac42ec1615adcbc5e3c7a961da6fe1
MD5 cf53b45b7da21390b6a30494b57b9d60
SHA1 40c83621c6ffde0f865bd21e2dd8bc7114244093
SHA512 cf326f6b963a6eda7e55f4f4cc57cd2f94f316f79b10cd47c5b35bdc7e4abf5b776ed357648c181403f71d94d9c22ce85faf9750c30e05c20a27a495181d8005
SSDEEP 12288:0FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1164523BE955C01CBE92604B5C3E5F15DAC173E67F9200483BA9778B9F7F28684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9207d3a5cf8f63f5436680547c9430bca3deb14f5afffe56e8ad2f894a2b594e
MD5 c361288a8121b2f56b958327d9bd5447
SHA1 b8f6e33d39793adf3fbd36d11a815846818666a3
SHA512 1f16f9e7ff4c22ca8da1e96388e82f207ee0d07d7654f7b6dc5dcdd4372ba7b7fbbe661ade7e84ae171940a4e26c1ab8b7213fc5cd8bc248b74b078184e0866a
SSDEEP 12288:3DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1494523BE955C01DBE92644F5C3E5E11DAC073E67E9200483BA9778B9F7F28684B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f174bcb2fd3f1161d61c918bf4bd260ad9a6cdd1d43e5c2c6d0133a1571dc7b3
MD5 d44d61936201c2f840370ea7be0ab855
SHA1 5903b36c4da0fa72d75e5916dacac71b8d56fa09
SHA512 d5a4e47351a205f429edcfaa0997fdc58cc6502f09dd48f0512a9cad10e29c278afa8bc2b9b2a8a77bb28f72ef1cc293d2e1dcebe829134ff69e91198ddf63dd
SSDEEP 12288:c4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:c4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1264523BE915C01CAE92644B5C3D5E15DAC173E5BF9200483BA9778BDFBF28684B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3ed0016599cc2797888287109e5d469ae47fad1995c914bdd4368c6273efb232
MD5 615de694b599c4e3b165fbfdb3a3453f
SHA1 00bd9b00aeda2f6a458fac0b1845c04c4329f8fd
SHA512 d7afe02aadd2000449289ea28da955ab82eba72b389abed4f5b2ea606bc9e2160c36a0e1efe541d99463960159ba2ab83887a922c6e71e0ee9a0ef9820b3dd99
SSDEEP 12288:5CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BE915C01CAE92604B5C3E5E15DAC173E5BF9200483BA5B78BDFBF24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2d663dc40e8878843270d0b9cb32ee799b789ec07b2cf1c6b37d6516980f0d8a
MD5 c60109c50b2c3ab9fec5af3fa127e9fd
SHA1 fbcf8642fb0ddd292aca960ff7836c02dae63ba1
SHA512 a3f2704dc35cee2586e8b2168d66b21bb7d0a5adf18723cfd87c083cb70994db112876d7a5f9c9b1974c6297ce886e3be107ff14483f037fbe786e0bd4cce34c
SSDEEP 12288:bFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1234523BE915C01CBE92604B5C3E5E15DAC173E57F9200483BA9B78B9FBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c4833b5a7199bd09c1513bd9d203612634ed32ccdbf646b48b59ffdb534e0ddf
MD5 327793e4123f0cbeb9fc550f1683cd8e
SHA1 18868b672e3954285db84fe7d2d1e5c0f9e44bd0
SHA512 d4b9b4bd75509f1935515b03dd8c7b7bee00bb7c52fb69d305878f5b06009b9d1df6736cd3857e0810559e5697a6f93fcfc77fbe71966ab73044a72bc62c6fe4
SSDEEP 12288:/aXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/asqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F24523BE955C01CAE92244F5C3E5E11DAC173E6BF9200483BA5778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 24e551228499028b8c35859603e28e50ab6760d9e01d5b16cc00c4693852ece0
MD5 37f1779688f25e7a785b28d5a0a7e566
SHA1 0e5dfb58d7d69eae69631746f24b847affb4707a
SHA512 4053891a0ce06be278a109e209d3767683365fe2f4d998b7f3cf648692865ac800b890226dc4b0ec1d0a63b63e39e6ef25a8faaa225edef6ce641844f2268ab8
SSDEEP 12288:HEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A4523BE915C01CBE92644B5C3D5E15DAC173E57F9200483BA9778B9FBF24684B3D422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 3bcc573f74a24321fa643d2b366f7fa0d1b76d7bf1cd55e15920b6a02bde285a
MD5 d963d8ae42f15433d69f867f194548db
SHA1 4190d256355910e66ce7083f7dc4c98b81cab68d
SHA512 0be7af5997a012e043bf18e2375a33fd33979e47d6955c6c956378f5e0d3f2facc0f81f1eb111bbfed685d027cd885a024b44dd9d61ad9dd6b6df0b5c7d213ab
SSDEEP 12288:EtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE955C01CAE92244F5C3E5E11DAC173E6BF9200483BA5778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 67eccff6446784ac2d564d2301481ccd410c8026ce7d86673422a7de4d2df668
MD5 50ac8c397b261f2f1b21a0da3465e0b1
SHA1 7f98185f6adc076f4775f5d6460528dc20e7a25a
SHA512 d6cf7ad368f4aa0ddc66599dea0c0ab1070d3a9a43d3d2abef0f8b4058f47a26ddadd3cf500ee37e00d04d0b4efe7b5706115c158a7d90cc39a4dfc86aa8314a
SSDEEP 24576:Qfwvzk9RX6wkyAIesqjnhMgeiCl7G0nehbGZpbD:DMnYIyDmg27RnWGj
TLSH
T1F685D029EBDC04E5E177913C89B7860AF6B278691B31C6CF125A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dca4939a2b61e84c8be498cb1c1798bf6125fc87574c071cd2cda356e751f170
MD5 2512e048ca4e24d3470a3c7abeb29cd7
SHA1 1885a53369064501aae1509289e8bd70671dbe80
SHA512 3f8d39a2cdf168cc3ae26fbc206cd845249bf9fe1a9cf05eb0bcd7c2da5c9731b5881f62e1a0c67d0035240e79ca15054a7156b71b951fd14f2be6a3bce55177
SSDEEP 49152:FYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lDmg27RnWGj:0ySzP9D527BWG
TLSH
T185066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8ebfe436d47a00853582193408081350170d0a4c5d3c5cc4437b673ee7ef0251
MD5 b4648477838479ce45915a26f5436046
SHA1 9c17911056d4a374c1ca6767ef119eb7ad2f2768
SHA512 c356a2ad5a375b402997aed157cd8f22e3e3800df361a32c71410e340f08217aecf915891bd87d2fec059f237d1d948cba29025e75eb00028424e03340814677
SSDEEP 24576:847Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYXsqjnhMgeiCl7G0nehbGZpbD:847JUQjqirIhCnDHUPfF/VDmg27RnWGj
TLSH
T1C765AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 35e78e20b1f78240e69f6c411811a6a34018e65e048f9064d56065389928eb96
MD5 c955805837019483dfb704c3c977255c
SHA1 01ad6eb4a79e294df3f9a7b713962c70707abdd0
SHA512 affff037fc49e587c65fd81539773b3d099dd4d189ae8ededf17b00ab3b2d18ea1f14288948c36635b46dbd4a5ce64a3f3050e699af1cdd68c1a324c388b15e9
SSDEEP 12288:vpsfSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ASsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 c4a379a654aed806aca9049c70aa92db491f765e4d36d4baf8d7c82042b72ac5
MD5 7ba44e570a79c27a2635ed41cc43fbc2
SHA1 b34b90c5ce075df6e983a3cb33f905f3de3fc639
SHA512 cfb1a4c7b6b80a829b440cd687f543b6743ae8c90a43568f709776ece04d0c809521be8151afa8239e0704ae7317f02896fc6a90d4acc513a9808c4e65cbe4ba
SSDEEP 24576:mu+NUP20SIXjeSahLj8XjAtiaHmkwRxMQ3WL0:GNUO0SCeSahLjBiaHN2xM0WL
TLSH
T144452741762AD78BC6A940325E36D6CCA7707D01FE05AF0773C9873F8476668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 a0753dfc18ae95d754617f01e3bd179ddf5efe035a3f3692cb54cb32e133c2eb
MD5 bfd85a7838b442806c74e85205a2c8d6
SHA1 a1d248005480fd18e9873a53c39ffa941552f390
SHA512 547226c815276f8998706b4beeacfabd743aa6871fefe3ab25b3ea7021aef8e2595ba380bfa2153cf3ceee47d2931ae0701425dc0d6803a37f43b9b5d92401e1
SSDEEP 12288:5meJ8nbWFxhyHSZVfTfdcUsSjD7iFJPObN06EP30BADi5Nc:5meufH8ljKuIP8N06E/WADi5Nc
TLSH
T1A5552A41B5A7E35FC9FE50370632C68DAB745C03B7452B0573848A3C9877A7EB6E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f604e23e890901b5241bbffa19293f9c8dd5e237c5cf737b3d16b8d660d9e028
MD5 8bd4cd5aa0ec593f32c6da6d788cc440
SHA1 c988f8dc37760da83f78c73d633bc514705d6e43
SHA512 4eefbbf0456b43f4b6288affedaac3d4fc40770629b02c570bd64f64cb1a45a9c6a9a3b5e83323b9409a74a71f0477124bb71dfcaecf158f4a113c60c365ba5b
SSDEEP 12288:Gz7qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEA:EqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1274523BE835C118AF83604B482EAE12D681B7E669F2004C3B95779FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cd755ffd4c48b835d61110e32dba84f727417132046959f1c83e2ce5c9ec5d47
MD5 c9f6aae0cbce631a29e157a58dfb84cb
SHA1 d3e80be0660737540e8c2e36049c52478d316375
SHA512 cf233d1b193733146523f264c9fcb4378ef70b2cc4ea6a0973480ee34bd3e076cc3bb8cc5fcb8357c3012652e212c27f50656d85a4d12d2c03d09fa37f159698
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYgsqjnhMgeiCl7G0nehbGZpbD:Qgb4mBIBhGFrDmg27RnWGj
TLSH
T140659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 2ffac6a3c948a45270b82e2e26734ca6e8a99b498570338afbdc388fba2c2e34
MD5 26646069cdf3d3404b38f7acbcb5e3f8
SHA1 f026878709a35efd9399a09f16db210c76de8749
SHA512 1dbf02b990ee8d2a6140b4071d17e6126d9051c4adbf62d4014559db4584175de505a9c26f72ce54d558b268b30ec22bbbd852c88913d0f9069e763ec5a1b7d9
SSDEEP 24576:DG88u8FpJqH1vzria7/mnsqjnhMgeiCl7G0nehbGZpbD:y7ZFPqVya7/EDmg27RnWGj
TLSH
T1D385016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 24bf0ddc7843e61eaf531c83dbf8082a51c0677b61be3e023c63d90131e3bb9b
MD5 af9a384bf4c0c655461dfc219516e839
SHA1 130d9a5d5731ec6428b495defbeba15b052178a1
SHA512 c07265c09a9bbe2ca2aa69cf0a62f39e14c404c160628e8956b187a0e4029c3614873ef07649ec0ad004fb9b69c16531fc6ef94e27874937e28a5de383b750ec
SSDEEP 12288:0HvUrBFrEjwaQLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:0PUr+NQLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E65F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8f385343ec58cb10c208ae5226574735d5ab66914e8e34368c690df2587926ad
MD5 792c9ed2eefdd983b429999d83247267
SHA1 4cf25f95c24969576387818536850b9d3c89435e
SHA512 3b2167c7ede8628f2dac6ce5756e927370e5fa40110b7df6e711b47a24456b7fc4333adeac27c4c1e9d432d33faea6761d8f825db595e4077f92d30bb70f8379
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPDmg27RnWGj:GG05lO43baD527BWG
TLSH
T1E2D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e1c583c4e353f2db643948353b37fb9f9ed76deb21f09dae1647fcee11dfd823
MD5 bd7cd9b9b57d30f62d5964f9d428d79d
SHA1 76dac372fbc98d880d85bf479fc775f0637a5834
SHA512 580de02d3785626d5b1229566984888f8652d20605e18ef1dbd187d4f5e8e6538fb05c5eb1d6184ea3fb701e408a3216a6e0e293b9aa1c4d62fb8a8feda2e5ca
SSDEEP 24576:vfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnRsqjnhMgeiCl7G0nehbGZpbD:Xa5POZ3lJt2pasx2+mHDmg27RnWGj
TLSH
T18D65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 610b7135ad204cba41c7ca595ab1f88cbfdc3b1cd1b36abb2fbe95f03df29568
MD5 b8431f45d680fd1c6b0ac39087d7860b
SHA1 8a1bce9613b54fa89a5c6605897c6b9009f3a53b
SHA512 d00c4ebac662858b50ec52382691b8a2d47cb997490d44af5d339f99a2c202730e70ca5d5b94395e4abdf78ebe9daed5d9e3314bb5737234469e63d25330d40a
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkPsqjnhMgeiCl7G0nehbGZpbD:aNc/zEOVHFkDmg27RnWGj
TLSH
T146857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 46c2237da867be04fe73852936434c98aa1ed711b5d1bc2394db7a9e79f64cd4
MD5 de52d4b5d6ec78cefed282674740c80b
SHA1 753f7f3f7d718b7ab38eed28cc6fcc54c1bc2007
SHA512 df32a391bc05c32ad1c879c198c012c08d74258c5f5cb8566c81f4d3b8a7b93cc76328d97590632c2ad40c22fde88958a79de612553dddd7c0bee7c93b475c79
SSDEEP 24576:SzkNvNnaFeYhJNtmZBmtsqjnhMgeiCl7G0nehbGZpbD:SzMwBtOmRDmg27RnWGj
TLSH
T17355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 425e6c9752fd452676ba4f40d96c9f6cc4a0ffdaef3119a1b90ffd7d6e914747
MD5 fed41de40181827c2bdb73ccdf4fdcd8
SHA1 f13f3076a2e4b66f0df6d96de4df26726c0df37a
SHA512 15d498bac9bae5d2dc80aa030254967446fc42e816462f3c2aa353a42abe32f982e23d99cbde9a0a6ec2a59da02d7f2fda7bc5698fe5e8bd7d42718dec78938a
SSDEEP 24576:cD3FHshBIYQgAGsqjnhMgeiCl7G0nehbGZpbD:cDVHeBIAAKDmg27RnWGj
TLSH
T17B75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2108-0-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2108-6-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2108-67-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2108-7-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2108-8-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2400-15-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2400-102-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2400-22-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2400-21-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2400-14-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2660-302-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2660-105-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2660-111-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2660-103-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3268-43-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3268-44-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3268-51-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3268-50-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3268-246-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3340-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3340-115-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3340-116-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3340-124-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3340-122-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4088-78-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4088-319-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4088-300-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4088-317-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4088-85-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4532-56-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4532-62-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4532-63-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4532-298-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4644-28-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4644-27-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4644-36-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4644-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4644-40-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5076-74-0x00000000007F0000-0x0000000000857000-memory.dmp

Download

memory/5076-299-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5076-68-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5076-69-0x00000000007F0000-0x0000000000857000-memory.dmp

Download

memory/5152-91-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5152-301-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5152-90-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5152-97-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5152-304-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5152-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5532-131-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5532-132-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5532-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5532-306-0x0000000140000000-0x0000000140172000-memory.dmp

Download