ec41d9b94565bfb9fdca7d242d577d0f8091202067be20895f30703f9406b73b

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 6.4MB
Sample260805-s7p14szgrb
SHA256 ec41d9b94565bfb9fdca7d242d577d0f8091202067be20895f30703f9406b73b
MD5 84e1920ce8904ee3fb9c19fc01bf5ec1
SHA1 11bd9527a1028bd2d33ff82cb8c4e9b3f8df4ab1
SHA512 eaf784e4a5f40a6f312392d243aae1ddc1fa9f121ff17acdaa2c5af22ce373bf4ba3e3f4d19dae893231af50297f83485d60a73d5c57f8fe2d0d7276db42a45d
SSDEEP 49152:ONEDnpPQbHt5bihGUvQugvnl8L8D31wdNtWiHFr4ZZhylLNiXicJFFRGNzj3:ONSQHofvilkY0pinQ7wRGpj3
TLSH
T10F6609AAD67641D1D4FAE034C662B22BFC713C5EC230A757A740AB576B36760E63E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3040	elevation_service.exe
712	elevation_service.exe
968	maintenanceservice.exe
5956	OSE.EXE
4120	PerceptionSimulationService.exe
864	perfhost.exe
1960	ReFsDedupSvc.exe
1984	SensorDataService.exe
5128	ssh-agent.exe
5424	AgentService.exe
3612	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\869bb023e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c662d9ef124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2bc43def124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db6913def124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6fb83def124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005cd2809df124dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002398f09df124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
3040	elevation_service.exe
3040	elevation_service.exe
3040	elevation_service.exe
3040	elevation_service.exe
3040	elevation_service.exe
3040	elevation_service.exe
3040	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	1960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1960	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5424	AgentService.exe
Token: 33	3612	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3612	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3612	SearchIndexer.exe
Token: SeDebugPrivilege	824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	824	2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3040	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 1692	3612	SearchIndexer.exe	100
PID 3612 wrote to memory of 2764	3612	SearchIndexer.exe	101
PID 3612 wrote to memory of 4100	3612	SearchIndexer.exe	102
PID 3612 wrote to memory of 4900	3612	SearchIndexer.exe	103
PID 3612 wrote to memory of 2288	3612	SearchIndexer.exe	106
PID 3612 wrote to memory of 2436	3612	SearchIndexer.exe	107
PID 3612 wrote to memory of 3652	3612	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_84e1920ce8904ee3fb9c19fc01bf5ec1_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:712

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:968

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4120

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:864

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1984

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5128

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5424

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2764
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2696 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2696 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7090c892ff2e5c6a351667da264a2bac089f9227d15288345b290a593a4c66a1
MD5 b890efafcfe2c6d088b4f8905f5a8a68
SHA1 c636ed0d43ee488dd8e14e3eff207859bc7a205b
SHA512 3ddf73469621247b636438fada7d6bea02fa68a305663ee137b5a8dba69e760307424be42da9c96dad5fff74c97f5b6c12293a68bddc224f95ace68f295df8be
SSDEEP 49152:8b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnFLNiXicJFFRGNzj3:m3q6mjBS7wRGpj3
TLSH
T158D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 006dc7c9e250b7e9bb275550b391a97edc778ce886dbfb8c88c0051a5427ef07
MD5 983b6475a7d5edee9fd4370297481424
SHA1 85ede0e106859e9ebae3a32fe9d4c8e3fa56dfa0
SHA512 8988c501d69dae8d2d038d4b8dab7be1c2463b747fd04a4ff8348b7feb521ddb4d36fa03010e8b187c2599b81f6936290079eed0740479404afd0b5484290b48
SSDEEP 24576:tXYfDtczAu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4tcHLNiXicJFFRGNzj3
TLSH
T12C75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 461e34c895e967424a9cca2c43b4b6ccd54e46689fe4c72c83912c80ea2e8bd2
MD5 c231a3199a0ed378d043e357b116065e
SHA1 6f8c45a75684b51643713e8cbb2287299a84693e
SHA512 82055e85f651743ca67c2b33055fdea2c25974f564dee4a6bf75f802c0b19855d388e63d8f190f6fe921dbfc321fd3b8019b0c9b4408ba7f16658bd711c92b78
SSDEEP 24576:h0Le5ji0hmxhrM9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hPji0AzULNiXicJFFRGNzj3
TLSH
T1AA959E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cad74a4f671ff4d4416dc01b6c166f7ef023dd5986b3e575b14b95c362e7218e
MD5 33d60af293efecde9d165226a0d57c88
SHA1 f10913583e554f498724642c2d3d844bf63d986d
SHA512 817ed7522ffa6f1fbbe2f0040f0c9d028c8949a1a527879705773a28cdb00f19e786db81ec5242573a56f7112a9dc5ff4e2ad6238e27194d4c48ee8ca4877b68
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWj6q8wyu3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:k/ezSC6vUzPv+HjywLNiXicJFFRGNzj3
TLSH
T1A1756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ef9e1e457da4496de1ae811674adf36b6b17eed225fe1df91b2f13c01bb0636d
MD5 747ca0b17b1a73080c06e189c65e7192
SHA1 c509ce84ae73c24c484e5fc2be2fe08c4f37a001
SHA512 c53686722a728b0497f4be3e79f97d71feb78d0e71e1f997782b64390a101db1b9847baa711826d4c7a6476310135d49f50764765b4e33d59bc1ff642f8a1bcc
SSDEEP 24576:0VbqPb88hv/l+BC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0VO88hXl+0LNiXicJFFRGNzj3
TLSH
T1FF559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 1e56d9633c7899fe20a85008dea580a011c807f64ba9a764acded1fdfc5e5f62
MD5 2a30f5ef09977354e04c851f60beee41
SHA1 aca8122c6d0e1562c06b9ced23679049090fbaf6
SHA512 9b87373cdfeefc6e3f0c5d06a2f94f93c51c8cb2566bdac12900c5740d55a2134063abb4f9715fa32ad7716b6d663366c496c4ace291f66796a7c1211a7346df
SSDEEP 24576:bGR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gLNiXicJFFRGNzj3
TLSH
T1515523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 5bbcb12c2a5931f5b96d04cb7e9ebd968466474b1c66ef6b70ab543759f4f4c3
MD5 54b07106ec58b5675dc19dc0fa0aa722
SHA1 b4490b57616c15c90841fc10acc77947c7e50ebd
SHA512 4f7627e507108e81e04b87f7938d15ee69386b3a52de647b9cdaa9110d15b3e1a4e11e938899d06d27082b0613a0aacaa934f820cf4c67753b9063cbe433605c
SSDEEP 24576:MJIUa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MJIUaLNiXicJFFRGNzj3
TLSH
T16075CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6ff9a31afa09132b8da061ce951e82c3978585434a39ccb513db180b30f319f9
MD5 23cbd1984a573988d07de2b916cd0c84
SHA1 b94f4c6ab91bfb261041c3a944eb1fd5f6e0abb0
SHA512 acdbbaac87647fb9c265cb457de038daa02cb052da428b53055cd564e4ef3de2d7213973d0f4d1d4a1600281aa3a638d1222857d2f1def441da4b0a5945c3f8c
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THk:4QvGAdlCEL8c/WRNw5Cn7wRGpj3
TLSH
T119266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 429d3765160ba262f1e4a63dfed8c19aee6fe8ba57ba3158c0eb25beee5cbcb9
MD5 d19ce2c055c4c1d1ff960106b3df100a
SHA1 d21a2f33277746096dbd7e08e51125208b81a189
SHA512 512ed0b8f2e8b64dd2cc4034b32c34acf1169b50cf1133a4889a902006ed86c158589cb6a6bc0a873776ca5600fa105eec3b5c8ecaba4e4894dde7cfeb12e5b8
SSDEEP 24576:zfewsAjE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DljELNiXicJFFRGNzj3
TLSH
T1FD75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ab6dc57a20663cc7df0ecc30630d0ee948a1efbc42f1fefcaf6e0485e50880bd
MD5 2ad54b9e2b846338c0686e36b282ea41
SHA1 c5746572d8948b75c7ee7bb0565dfc68c34ce310
SHA512 2a16775940759299764b00f31b5f7a685a8eb20e83df22c2f3f1269a48dd6818ab64e2455502477fbe7a08a84b7944804de163ef017ebe176b000ff8bd8866fa
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHoF9:pUEtQevvqc2W1cpV20I32c9
TLSH
T12F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8847e39b853ce77fb5e1ca1027a3e6d5d1c858ba9a673f3e1ec3bf03bdf658d7
MD5 ffa713b6b9037c3d7bb3ae8195f2959f
SHA1 b1d767582099d95cfac8a3593c2a41e6bc8a576c
SHA512 ba751010a4cec9963b3d184e426700ae1e08d303401fd6e8ab6c8f530154a78673c5d50ca861897e38c10e682687756d80bc0974ca69d0bb188657dd65ccd055
SSDEEP 49152:OCbRquA/m2yL5zLfFiV+XenmE3/zkLNiXicJFFRGNzj3:joq2VjnmT7wRGpj3
TLSH
T158D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3a718c69118712444f36be2e9354d8afe86033a74f48c0375e3c9c13fafc3ebe
MD5 700fe28e30b57113eeec4e8a9adc8a1f
SHA1 21eed2396aa5658acd8bacb03fd278ad5d1fff96
SHA512 170e416364121f3d72e9a539d74c239f68b46ace169d2eada46fdf838ee34d00973924b6728f9d4886a714fa9f02897e2e55825e91c8e9465717ef0e93e04bfc
SSDEEP 24576:aAhGL6IFoiwtA5l7S53z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aAM5Foiq5DLNiXicJFFRGNzj3
TLSH
T1C6359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 8f167809587b00cce66986fbac2637f87f450a4302487e6bb206b49b77b2c43b
MD5 4c64a5de3bccc5c21e3ac7fa04a76311
SHA1 5e12a5b3b3df9e92a5ff7fa83bb87714f917ef0b
SHA512 a4076f243547b9d27e13c42a02ad2bf78a49fb9165d2ff17b09abde5adbe323718c3f41582b6e645b09d4d07f67e34102c9b3fccb0751982962b36eba72f391a
SSDEEP 24576:9wuROWQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9wSOvLNiXicJFFRGNzj3
TLSH
T1CB75F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 cd785af02a821e595764e26ec74bdf72210ee81eebf84d80403060f07d295e48
MD5 1cbdf91ebb35ab7f5a3b093810db5561
SHA1 7dfa1e052e657018412c330d00b1f9610317c7d5
SHA512 ef6a9933372ed12babf5ceb597ff57ae233ccd3f03626e3bbf2f55089754f52112f5a71349acc26eb2e556c86c67776e9f60b3e8a46a92aa70cdda9f60b1a58a
SSDEEP 24576:mZu1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xLNiXicJFFRGNzj3
TLSH
T1E765129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3662a6369317de7980b7e56ceedd519a1db32d4004879c1cc039ee0a3b1b8e6d
MD5 31426cc6d86b48f4527a341117a96286
SHA1 43fd3bc75f1c7c19f486194e4dd9cad0612adac7
SHA512 9f8764aa99fd3defe12eea914d108296d1c0a43881726ae363063405b879453340fe5ae9b72d4866cee6b1cfde3e2c2a7acb0655e341338766f223613f84adcd
SSDEEP 98304:8QRQyi36YOcPDLvw2gAf+PN3m7wRGpj3:jQyiKanX+PN6F9
TLSH
T1E5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8592e73c96737d6d525ed69533cc008f9cb901551e117bc841e02a58e22e12a9
MD5 675042cb92f39812a9806c7dec8ab98a
SHA1 b1acf160a939c14bbdb445e7e7bbb6efaef27493
SHA512 83060d38fe978446477ca321853547d3b2100811f1575cc82bf56a427c9826b9d52e1cbf0dfbdf9d6f3e4703254c316600c4541a64e68edc3af3a1c3df59ad7f
SSDEEP 98304:FQRQyi36YOcPDLvw2gAf+PN3m7wRGpj3:8QyiKanX+PN6F9
TLSH
T1C5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9671b274e6991c8667ed8b3319b5f6fd45d3b0d8ddf23056787fd1d695d72917
MD5 505086d087f8e51863652155fac1eaa3
SHA1 943f0e960da09b81910186e8f012da92b53dd5a4
SHA512 24eb925599977f27d21099fc7478b4fa4c525938530c77b106b9483a5447b029caef2d17f1d6cbd68ed911935fb46acd3cef41eac1fe094f49a5d0338932329b
SSDEEP 49152:T68Qg55nhkeWu7PNU3/ULNiXicJFFRGNzj3:NthTRc/U7wRGpj3
TLSH
T122B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cfdc8ce6aaf4d5ea2fc22b3450884cba2de919710550ea8108761a6e1ee8c69e
MD5 f74be573d0f71e0cb30b945077989cdb
SHA1 a85404ec15c88d289188a869c998654fb46967da
SHA512 78a6df913057ca9114337b10f8eefa2c9deed5837a6a1ffcd66d5826f5f8e138a0455cd83592bac653f8f945af5e85d53b9f57f7e7332136fc2cde01d0ac6093
SSDEEP 98304:vy5112gYy5azzVvU69nLKnhZR7wRGpj3:iLIHRWhfF9
TLSH
T10E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7c8c9a7bf4d3ec1c0d3dd70ad9ffec12795e0e5c7f443aa8130bbce63083b052
MD5 55105113a352bedd15ae6f5be0014323
SHA1 9ccef74cab13da83ca46912f0e83e9f852dbb58e
SHA512 f5ce99a977c9b2524052e571be1184f6da84b1ce00760c71347b5cdee28e5c2e480752347f206d40523b77a8825a4c85abf43d3f55bdc17a1924d5bc953a7739
SSDEEP 49152:+B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl+LNiXicJFFRGNzj3:su6JmIxd2d+7wRGpj3
TLSH
T19AD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b880be84f321d7937769f88466ccf6ce02f3bdcaaa06d9ec8fd51571538497ff
MD5 688d5e142d8295456e6112e99531f513
SHA1 cfb2fa6e43a02f1218ecda90237bb37fb7d03191
SHA512 92c3b312161e1a15f299fd4499f8ace680f4c66cebf74a1a779e88ddf914fbea3a7903083ec81c7d205ee181068d67dcf76658eb59d8e123c79d38d14b096a39
SSDEEP 49152:l1hpsNoJpF1A67U44CwH7R4x6LNiXicJFFRGNzj3:lmifPqRT7wRGpj3
TLSH
T187B5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 545f4a31281c217b31b524df11c0c5428dd3624bbe58505c14e018122f1e50cb
MD5 7ff8fec525ce0705ecb2a6869e44d872
SHA1 df692b4d26406febc0c3b51c3749987c94d2b3f4
SHA512 99db020663bc69ccf4cfa74d861dc61d9c67f5629194526b9925760e58662321bb7727b9dd790533c5ee35e60c0ec9974b4cb8e20ea4ad8dd0d8e70172264f69
SSDEEP 49152:6SuZQIY0Be2KkRVtOnks6NMHq1LNiXicJFFRGNzj3:k5dKqi6117wRGpj3
TLSH
T166C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6e2ff179b09d7f9bb02b6eb4bfef6dbe7011b9f384634c093c04d8d481dd7212
MD5 1b11dee225018f401b7c761f4e8325d2
SHA1 336e9c82eee6133e86d3824d4d1e9ceacdabbc84
SHA512 a65b5fb7ea3f17c4b56f93eba1d4fa96d02ddf8e7cdce0121ea0863b8ad40ad179810277a8e8d89030d75ebb40552c9d9d037e2a127c271578b0506aec822549
SSDEEP 49152:KhtSn8EApI0figjgiDn0AP5wuLNiXicJFFRGNzj3:rX2iWphP7wRGpj3
TLSH
T12B95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 8fb0823a6b61590e0f11efd0894cac74e06743d1fb89a41cbc35b4f79737eb94
MD5 d20d7e29adef86450130ae74ddbd7e77
SHA1 c17a20f0918b3f70d8031538c151c6a463d2bb58
SHA512 9740b96f674cd98cab900758bfea0dab5e01c8bf1b971d550f2516302e0a95ff96a06cb4b5e324bd30a682c373c84f6fe3345ac30e5fbc2cc7bbd3421c587fe1
SSDEEP 12288:NFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1615523D3558955B1FAFD0039C6754428F5882E2DEB5618E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 63493841d1c2253e749738f744c2ec6052e9193fe98979f9488e4bbeb0f5d883
MD5 f5bf3fe11ca5f6b6a22684cc3dc8df11
SHA1 eec598ecb56614ddc4b543c3210eaef4dc6a4497
SHA512 dfaa2cdfae6a41f4d8b051d72d4cc3ff93d1b5b11d91c7e8f0a44299c2bd9accfa7ebd6e77f0a6af730c7dc02360dd43ee8ceac8cbd54085808e919268998dd0
SSDEEP 12288:BOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1125523D3548955B1FABC0039C6754428F5882E2DEB5659E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 d7cef673e16a00355f2f5718519461fbdf14e8521914d469049940e8baa2d003
MD5 fba60c0585b97a9cdc8ed3b95be4abab
SHA1 748f8697a6403f069ac1289d16e4648304bc4f7c
SHA512 07b9bcfd5b3d360004f707c5e6a6437ecdcff845b951aad3cb54c9af80ee740eb45cf975538cd7de6135f9a5355c63b826c222809410977d178ba4faa25c2d94
SSDEEP 12288:tAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1535523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1569517533d9be288a868fcc7c0e7497177f43400205bb35899ef46e49b76a28
MD5 7237bbbe30c38dffaaebb4dd6db9a037
SHA1 869cfaf4b4db7e02b535da588ba36dcb10aaa94c
SHA512 63de2a62020c2e3b074638a75af8e5d3febcc8ea372460340c90e537cb2e1a31cbc131dcaf128cf9375c05d0782768f4633e1169d7c4f5f3ec46f6c126ecb920
SSDEEP 12288:MVniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:e/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T100552393168901F1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A74FDA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 aa3e1de6fc6543ac4080b61204a555629c4881f4bd81b28fc60da24864ca8693
MD5 c973abfe7d6a54baba6460cf31eaf3e4
SHA1 dcb462bece49b1da5bf12d78a6fc01c2a3147452
SHA512 9ed9f8fbf9ce964130381be00de5e013b866cfdb5ce4ce5ebd2b6639aac7b59d2012242e2651bb67e1c9c77929100557cecf2a42f50d32170e19540ea6a7d7e0
SSDEEP 12288:8PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:87/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C05523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 9007f437758f351da36026bad5cda88f10ca04a17c71192a4eb14f35a10b9023
MD5 0404f57446c3b6681b397d8df6af4f76
SHA1 1707b81ce47d15f62ba50c1573eec5eafab6ae7c
SHA512 88a0ffbe322c518853e51d5ce00651a45aa7c05318f9eedf7e66f2167feb5364a8467c19f8e667c71c4c262e3e656e0b89d25324c0aef636ffb3af78bcfc69b5
SSDEEP 12288:t6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1575523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 b695244599b217ee7aa939ca15ca4e56c783215bd9476293d98d51d2785a87cf
MD5 fc3db5fb8cffc04d0a4fd819b290653d
SHA1 6873723994c4ffa3fa219c680ce30fea1f4f9995
SHA512 c2f0d00f737b3c027e1c4fc9c6256f0eec16ace30a6d5516d83d6de677b4146ed60d35b8424dd1e5eedbae792dc5be20e6ea73b8970b0866abcfffea9451697b
SSDEEP 12288:gWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19F5523D3548955B1FABC003986354428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 de296ef8f5a51a45e37a7e79febebbad4c6a99dd6f0045f412d20f093eadb665
MD5 8fd6d746a295d152776dd61ac3ad8bcd
SHA1 b79092780f7ca3e71a497debb5fede1df9b7a57c
SHA512 103004a8f5ea60926306e7a6e1ecee451058d1b148dd120288ea44906b923296491f9333abb2af6a2e4640288c9d08e36615ede587a0a79d98991713c0dad4f6
SSDEEP 24576:HZM3zFVSOY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HZM3zfMLNiXicJFFRGNzj3
TLSH
T1D1750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 d5ee0df834662c86a894ef4da1d3434a3b662db02f97eead199201f7cbd71822
MD5 895c799719ffcec03c6e7f655748dc56
SHA1 09275e9b7287ee10689f585854cfcd741caa0a83
SHA512 0b31fc87f2de168138afdd732588c79c6dfba3afc0e38e1189919c6dc98e852b212895c9e34009149e7fb6caebadb289d9ab59aeec952e8d0f5cf4e957af4b94
SSDEEP 12288:k5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1285523D3548955B1FAFC003D86754428F5882E2DEB5659E3E2083D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 000f19d41b6091cb475fa9a2086b63121620ec6e6d301c3dbbfcfe44d82ba0b7
MD5 d25fb688fde26febf50c93c35429b499
SHA1 4b43db151aa5d0f1ff16a9bd4f394f907af753f3
SHA512 4ed51965008e7f41863f46759197804a9c0ed4346de8f2e642fbef5841f0f908ac0e4651416f080e976df42156b9444ef4dbc224e1cd4eb92812fd2483d5f982
SSDEEP 12288:KdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1935523D3548955B1FABC003986754428F5882E2DEB5659E3E3083D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2af24a8ce99b251fe5e16f1587a627aca0b1d3804492a5baad3d07b078039e57
MD5 0f23bb8d175b7e1a0c7e52261e9c0f24
SHA1 069f280ba8a5017d785bd3dc55f51ddae0dfe7f7
SHA512 dfc0f4eda6d08e5640ab831d1c486dea24c4d188108a3a613f77d990626ffa795fcb626042daf413d26d445be933121cc7fa06882cff3c928b4dc27de4bb3a79
SSDEEP 24576:7zy0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7PLNiXicJFFRGNzj3
TLSH
T1FE650247629530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 bc3a4c7918dd3b80daa57fadd6b9273fa176f4d21cc30b4f50efb9f762c2cb78
MD5 8a8d296040d2f7417bb64da321206381
SHA1 2a0ae2e7a25f569c217a2d7973ed739d739a17be
SHA512 9b0e97c63ab7b5ea378050ed81c6cb8f6b224ef881806e405d81a5089bd1828fb7b0d29d8801b06656edb4c6378a2b9724c9931884fc0034a553af343e891c62
SSDEEP 12288:15iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1795523D3548955B1FAFC003D86754428F5882E2DEB5659E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 d65f8dc66264c19308122b9e3f66debd2da02b4fbccb276b37dcc102f3f0d4ae
MD5 071ec6e68b09d36ed1d70c0d156220c1
SHA1 e986b3c0b901d7179559945758265d1f63cdb425
SHA512 507e2e9a5dbe6cd9c629b2e73b87a303e7355b56dfa8492b1095b48a6f75ad38dbe8646413fd3fb584c64123f5e67f6f0d4ba65c369ab2b961dd059715f0673c
SSDEEP 12288:h5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1465523D3548955B1FAFC003D86754428F5882E2DEB5659E3E2083D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 85ba7aef87e31fca59bd5dc234a02a44e95244cb30bab6107f3fc212373bb517
MD5 3d124d273baf813c8f37ad2400da7225
SHA1 917b70c079497e301683ac0f4e156ccde82da785
SHA512 202f3a1aec23d58885713a685eecd887a6d5f3ad663c730ce092e13848415156e93b3a462a46c36b75c5e3f26557c84eedb3f365fbd265c059db1630717015ca
SSDEEP 24576:qzy0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qPLNiXicJFFRGNzj3
TLSH
T148650247629530F9E17A4139C9620915F3B17C364B208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 2a49b274ae97a9a7038a1b0383e7f3aa3d1fe263ef3505deb34eb4bea8a0fa11
MD5 64dcb183522bb94b75df0875026d028c
SHA1 9bcfa8acae56bacbed9b1e503fe0592f0ed68262
SHA512 378b812c044bd5176d28be4b6acb9d9ff29c1c32980080efdd489bce73a9caafa384bd246e91760ed7f1bc6a11498145cad0299d18f65f1480a45e9e632c92be
SSDEEP 24576:rT8aLl3z0zDi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rT7Llj3LNiXicJFFRGNzj3
TLSH
T1F07502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9ffecd6ac978bb285e398c4653edb2319484020bb8d921d393768af71991d06c
MD5 37edd7f120a8d8b88b7c2b73592bff8d
SHA1 235522cb1cb30946c4157b7bcdac8c6cfce8da2d
SHA512 16c5cdeda5d989c7805967b940d776dd955c02a1d1b1aabf03489b570afe12ef3747310ab843b927313a067b5960929413fe6845d0b4967582a4461e3863b23c
SSDEEP 24576:M3rd9CHKy7GZG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2rd9CHKyaMLNiXicJFFRGNzj3
TLSH
T18E85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 3e3e6630b533a38247f80e84ddadd771668addcc97040452ce5a93ce56a7469a
MD5 1fec1425702923c62977a40ac1a6241d
SHA1 a2efccfe6aaed0708c5907d3f4d7b47d239e5389
SHA512 3269b4a9027ba4a3b9219b0f2aa2e3937a0a6007e7117cc473d5e5183229208253f4ec07cb910d2464774b587e140cea75d2161986d1b5d9a47216b5cfbcd5c1
SSDEEP 12288:EgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ey/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11B5523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 2e532b4401dac3daad4b2efff37745e9bc46ae0ec241c3466e12d43d0ca7042c
MD5 9f2d021ec0b1b50b7076c00b6c37b503
SHA1 83349fc3698e98ffdcd3501c4dd5cf8815a9ca2b
SHA512 f0d59efa1db90bffaa3941ae5a3e838196ed6133d862e3933cee55d694b1333c95875a98993e4c72cc7beef115397124f98583cda8a9d71a02368f1db2b27c87
SSDEEP 12288:cyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1055523D2558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 0f6b4653617359ffbb3f7993a8b2e029352cf3f43c8c3ef807298b01b9d0c255
MD5 7afe847dd204c2ec3f19d83f2830d253
SHA1 eec9da760ca5d6a94996ae4ea09383814cddf16b
SHA512 ec27cea8a07ce386d9a252d939b5747b7a53e9ec35dc40f411888d717e2c5d208e721078a0af5f1598e5718b81327a3020e15f6a1457f324753b76c4ec5bd6db
SSDEEP 12288:HriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:H//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B45523D3548955B1FAFC003D86754428F5882E2DEB5659E3E2083D1EA278FEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 4d0d8987d25f9cd1c4fc52db6eabe6f7cd038ff750e559c7208d920fc85692b7
MD5 18cc8524627b5a96ee1a32bb691e6a08
SHA1 3cde8885a4d84f56c7a07f0af33a370e595de2e2
SHA512 c5bea079b6baf4cd0c015f5daba69e0ac20a52d2539b001770575412d097820e746e4c58c116373509d7bba81ba99763908a0bfaf1526f67a6fb0983012e6a43
SSDEEP 12288:K5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F5523D3548955B1FAFC003D86754428F5882E2DEB5659E3E2083D1EA278FEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 6e689577d973b473dd995ec200a5b53e47e6331816ea5e2b9b3beb491f394499
MD5 0187a2c0a32be805ee70dbf2a050e63e
SHA1 ceedbf8d4365aa1b56968cfa46596b5b1f771c27
SHA512 5d7e0f397348d7395040f65e03d82c6923f84b8d8f9ed6126ebc7aefcf9c0bbde2db52248be5f018861703b087eadb06ea928cd6fb7a56774c9fd22fbdfe1d7f
SSDEEP 12288:dgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E35523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 655adb785e8617bbd247e7abcbf6bb1be24b0175b6bd904dfe0ff77878368b50
MD5 a55d9d0a1d326eb9a5d389387764c23b
SHA1 636468ab576da9863f0925b0907d55b4a7aa6ea9
SHA512 a2ce430fcaf77f6e73691681725f8a43b8c26e338faae4be9bf54702178b8ae1714c8bef2a27dd557de7ca768617534253d19eb0020d29b55a1e9f23a28bf4fc
SSDEEP 12288:GhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B35523D3548955B1EAFC0039C6764428F5882E2DEB5659E3E3043D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 773739641c641d8608f87daf7c24c0d19b497c76270ea555a0d316e117e33b92
MD5 0eb8312a4f230c06b039a12c3dc95b8d
SHA1 b35e439dbdb21514c0f210a90cdc31ba89df314c
SHA512 c6122c46b4e883963232dfb6c160aca953a1b03e98f081523a132540db86c97ca2ebd925704c02062d8a293feafe19427e33e86e0eca18e8fe3e99ca13a55f46
SSDEEP 12288:2PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:27/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13E5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 23e7dcd768fa966185ee3513cd4c2da77e7fb283cfdc6c9f80bf05963f3bc36e
MD5 45a067f0aa42f8a80aab156d57740e5e
SHA1 ea7cd63077dfc9c4f4fb9f9a1dd23d53456290ac
SHA512 0f411b8ddee3642cf77de83920e6d7762bea04a9b75aa25b52f7577f88862cea0a16b66cd045a8c26b4ff209f4f4357c5407ec4167b6c641a5e96b84f329bb49
SSDEEP 24576:7fwvzk9RX6wkyAIx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uMnYIxLNiXicJFFRGNzj3
TLSH
T11C85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6b6b8ea8c3a381e2fd2b8ddaee27aa68b9b572322030a6abfb01029a8d83316d
MD5 253e983655fee4420f671bdcbf984cfd
SHA1 54e33621d1c2d684982dded06b5588cff576473a
SHA512 78cea966ad051fad5fe1453267fb3ba002e2715962c2275d1ed53de7964d061fd6ac358143759a0094f208a22ce474c3f4129f30514690fafa20c6766fd1ce3c
SSDEEP 49152:1YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0OLNiXicJFFRGN:kySzPG7wRGpj3
TLSH
T114066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 263b08cebd3ccd33e99aec0198f085a500d96764d4169ab9f901daa254c25d71
MD5 e9057414c62e52222b85f2bceb7a950c
SHA1 a36dfdb2e243dfe9cc3deb2c3c55a48aef172e87
SHA512 4d8f411e08aef440fda147f35e2dbb5adbf688873a8050041e57e265ce51a18f16757d7dec22bd720bf6671a744a71455a792f47050bb302023b7dca3a55ddd7
SSDEEP 24576:547Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:547JUQjqirIhCnDHUPfF/+LNiXicJFFS
TLSH
T1BD65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e5bf9dcd9b8540b4b501925186db2ebfed7f5d0f99fa38b5078efc4d175bd486
MD5 d45eb0eb220fa639ab09e218e20ce1b2
SHA1 6b85ab024b41b30cc39991552a58d0d8359683a3
SHA512 ef6ebc1a7df9a53818e4480fd6820205675dee45c44102132511337860ee57cc6ea7fdb8c8a05e40e6f201c0244dc7ee1331f4829a68787c335faec9e44b5eee
SSDEEP 12288:gpsfpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:R1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CF65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 481a3d423393846df4d0736166f40141aafa4b19a3a24cf42effba638660a28a
MD5 d2ddc2484cedd2c6aa897c1184162eb1
SHA1 74d6cd1f1c697edf03096feb1a5b004fe7d10b8e
SHA512 0133493d4dca134cae66ee313e0e705a5f56438a55608231637298e5230d6a7fc3041a92854bf1064a149a7dd62d3e72a98bc1df30537a6dbecc888e912f3f18
SSDEEP 12288:QskNU3fvcDTQoNzSlt3C+SVJPisqTFF9TL1Apip:Qs8UPapgfCzVJP1qr9TL7
TLSH
T19F2517117666DB4FC66D40321E37D2CCAB707D41EE04AB0372C9972FD5B6658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 aca500473a1daa90ddeb2d2694520259de02a88787df2e97295fd89b25851208
MD5 5b610308e0fe7028f22c2cb327ef2607
SHA1 4249ec2652d5922e38dd75927bede1b684a83c21
SHA512 d955c55a866d8c3f52d8c3afb22ad90362920f92eb9b11ab6041cdf3de48b9260b9b8213b2b37bcbba2b86380fec57dcbcbe241798e90ba43b9e4799951ce4d9
SSDEEP 12288:BCt9PS/q4HedBnep0a56RWcbCzZKItpi+afMINNbJDXiO:BCt9Na56RWcbCzZKItpixkINDDj
TLSH
T1CA75E9406536A3CFC1BB6072072A6B4C7BB4EC06B7096F2673C8553AD86A715B1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 5f1d4d728456a9eb96a9c795a2f5efb7e811d8f86e716cf23d8758f3a86e717b
MD5 5933e6ac8e61f71473ff6d8f31356d2e
SHA1 8b7fb3b77863f8bb672e561bd5fd0c28a967175e
SHA512 b503960c85be4b616f55d3c53139ae00657d3f5d4599a71aeebca9de5deecd74f627d8f50993b60b47c5382a102b09ef33821be574512f84e9fa137af3315c46
SSDEEP 12288:7F7RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Rd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FB552393428D59B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1d25a6b71193c966362976eb6254228c46ebb3de191a8af6c39061c43169dc78
MD5 6528eff0b940ccda88991cdbab6efd8e
SHA1 a2582d0c5c57b6dbdb3b1bd9f49d312b8e67232b
SHA512 225d3c6d127a2b04aad848d1f2b6eb43149cf52ca61a39552a292b3ad9cc7590fd5fce8cd04d7325705f0b923666c16fb1157e5ce323453721665c1eac0b167c
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bY3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:igb4mBIBhGFILNiXicJFFRGNzj3
TLSH
T16765AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 aab9118f3e1c412b323c691f4627bc346aae0fb7a8d8683a960c17ec4dd15e7d
MD5 39a9e7b92dca47c6f27d4b43062a5cd3
SHA1 fd94402029f7e9c5648414aec061c86b2f355d65
SHA512 93bed151f83a59165ec86123bc7896999905ca4ed668b51f0b52f952e3ad1e7fdfe1ba1a06347d84dc39373d0a9986f9ac063c89668bad3f791aa91b40a88d94
SSDEEP 24576:hG88u8FpJqH1vzria7/mY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:k7ZFPqVya7/fLNiXicJFFRGNzj3
TLSH
T13095F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7082baf0588da46799899737810a7f5157e45f8a68ac71d605f73b1a4521917c
MD5 915e50e555d821e49d4a3e930c2041b3
SHA1 69a0245c5726dcbb8e1931f6e5e16e726f235f02
SHA512 f9f8377e9a791f9832aff41d5b047542af11ef9582a0a442c6973811b0bde5e682d93cd4bb9e625226ad4f2aa214b1d77b19725f57f2991f53c4fd67e6281fa9
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcLNiXicJFFRGNzj3:FG05lO43b57wRGpj3
TLSH
T110D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 472a6c90c75889cace56ae6c9dc894755160f084e21da2b62f64142a1cf65ea7
MD5 1ee25373d762cbaccd4f25e1fd83bbcc
SHA1 093e9df69b6f46861557c42f40db2e8d6e2e4c5f
SHA512 765564c0b599779119ea524fef0cd3e38fd2bbc24301bfacbfc7f3a79c8339d548ec2e81d9d9dc74853c0a4a0bf393acf043391002cff714487141046e1531ea
SSDEEP 24576:/fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnO/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ha5POZ3lJt2pasx2+mULNiXicJFFRGNf
TLSH
T11565BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 854a0598c66bcc4c79ef85402ec79d7c4afe5fad6be0894d6fdfde1a4e889283
MD5 dd93fea02515c33fe528bf687165510d
SHA1 a0fdb89c13b67af5e2e3d093b8a46891af938652
SHA512 e6fcb7e9b09f8c3b5128627932377c5c15c8f7e3c1bf11de4b9a4669c4a2efe4f97d5121eba5914b26605c35fa9c032a61adbbeb11ec9f2c92cafcaa89b5175a
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7Fkw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HNc/zEOVHF/LNiXicJFFRGNzj3
TLSH
T1C3858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e2f47a6c711b92a1cbee158a1a3a9864ba73ea4f6648ea1b46b3a99930642e9a
MD5 06ab4ff793fbd351cee318d1cf82a568
SHA1 b21eac6d5268d177621d4815adc0be0b7a26f68a
SHA512 b20ec31e4a8b414a25683d5f97faf5b327b657e1199ae36b4c8551f1d1ba11264a8f332ea39da715a8dfe650a07baf73f9009036e07eda64ceaf561eb33beb76
SSDEEP 24576:bzkNvNnaFeYhJNtmZBmK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bzMwBtOmKLNiXicJFFRGNzj3
TLSH
T1A255AF6EB6A846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b9ae15a8e25ece889e2a2b6d2c40d20d7d93ff876d902a46e25e33b8b41e6289
MD5 9bd2aa11e3a172c115edc71795587701
SHA1 f22ed8203623609384868b68716565f65ad9dcc3
SHA512 21c1e20bbd118f3baf6382db36ae048f164223c6abb8089bc15d9742bfdde60b4274724db5cbc809ed3d23b8a6072ee5295d0ce014806c79294b8bc857f4f647
SSDEEP 24576:APUr+NQM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AJQMLNiXicJFFRGNzj3
TLSH
T1BF75F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 b8980fa8f31fd14a6d0b402a192ab25b3bed9ab4c6e2313c037815475b53c654
MD5 afe9bed2005a807591ebf119f32a2826
SHA1 a0fbe3bef067a30acc36427172ad1bb771525ff5
SHA512 c472296b01b13a4de6463d3c4534d5b5cdbd3f2151650c14764c4908223bf6e58c49204e157e120810ae5156b45768b0fe4c60e339b2e262b8af48ed4fc2414d
SSDEEP 24576:hD3FHshBIYQgAp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hDVHeBIAApLNiXicJFFRGNzj3
TLSH
T10985E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/712-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/712-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/712-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/712-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/712-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/824-79-0x0000000140000000-0x0000000140691000-memory.dmp

Download

memory/824-9-0x00000000024E0000-0x0000000002540000-memory.dmp

Download

memory/824-343-0x00000000024E0000-0x0000000002540000-memory.dmp

Download

memory/824-0-0x00000000024E0000-0x0000000002540000-memory.dmp

Download

memory/824-363-0x0000000140000000-0x0000000140691000-memory.dmp

Download

memory/824-6-0x0000000140000000-0x0000000140691000-memory.dmp

Download

memory/864-87-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/864-297-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/864-85-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/864-80-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/968-54-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/968-52-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/968-48-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/968-42-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/968-39-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/1960-97-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1960-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1960-332-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1960-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1960-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1960-91-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1984-315-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1984-103-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1984-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1984-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1984-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1984-109-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3040-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3040-23-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3040-14-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3040-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3612-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3612-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3612-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3612-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4120-67-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/4120-75-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4120-69-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4120-275-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/5128-115-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/5128-117-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/5128-123-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/5128-314-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/5424-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5424-138-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5424-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5424-130-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5424-136-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5956-56-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/5956-213-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/5956-63-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/5956-57-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download