0175f8df1d0125dae9fb3a0fd7a75178faac9facff02a96aee4a873acec2b86d

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
Size 22.7MB
Sample260808-qp9lpaxfmd
SHA256 0175f8df1d0125dae9fb3a0fd7a75178faac9facff02a96aee4a873acec2b86d
MD5 74379b873bc324512cad674b903ecaf7
SHA1 f40e0a6f65ab42c57dfd012b0048c5eba9521af5
SHA512 a0a2b0457628b59f1f2c2c57af093df8ec52716d555f9991fdb89434066f8efc1e1e0f23092110fd85683e3be5edaa63550df6bc4e11c2460a2dbc97d1e41746
SSDEEP 393216:JoVgo4IFtzebI1meE5Ze0QlviIXf6qU+Lg5Jsv6tWKFdu9CRKE+:DdeVvULKE
TLSH
T123378D8B76654084D07BE27E8AA79F47E771B815073597CB06A4469E2FB3BE04D3B320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3368	elevation_service.exe
1916	elevation_service.exe
4544	maintenanceservice.exe
2884	OSE.EXE
5404	PerceptionSimulationService.exe
3504	perfhost.exe
5028	ReFsDedupSvc.exe
4152	SensorDataService.exe
952	ssh-agent.exe
5932	AgentService.exe
3316	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2e647c158f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005c34edb73927dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e0154b73927dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
3368	elevation_service.exe
3368	elevation_service.exe
3368	elevation_service.exe
3368	elevation_service.exe
3368	elevation_service.exe
3368	elevation_service.exe
3368	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
Token: SeRestorePrivilege	2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	5028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5028	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5932	AgentService.exe
Token: 33	3316	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3316	SearchIndexer.exe
Token: SeDebugPrivilege	2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	3368	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2912	2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4640	3316	SearchIndexer.exe	100
PID 3316 wrote to memory of 5396	3316	SearchIndexer.exe	101
PID 3316 wrote to memory of 5408	3316	SearchIndexer.exe	102
PID 3316 wrote to memory of 988	3316	SearchIndexer.exe	103
PID 3316 wrote to memory of 3724	3316	SearchIndexer.exe	105
PID 3316 wrote to memory of 3944	3316	SearchIndexer.exe	106
PID 3316 wrote to memory of 2400	3316	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_74379b873bc324512cad674b903ecaf7_amadey_glassworm_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1916

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4544

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5404

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3504

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4152

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:952

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5932

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2500 2580 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2568 1544 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2568 1544 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2500 2580 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7e0aa3382f49901fbada3c005b64694eccff02e6ec9ff223bebd797b7ac70b4e
MD5 fe4a908e2c39c7b8679d5f288758b824
SHA1 f9d105700ece4cf3c724bb6199340be919ee58f2
SHA512 d91eaa46b4f8d72886af11795a89194a5c5190372c7055c4595df2bf76fc7373e2d06b187f0d87260d874a7aa9f1b1dfbf57783f40f90b3da4a45b8170fd9fb3
SSDEEP 49152:Ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxnp2LlOpbeZB7m:O3q6sjBgycv
TLSH
T165D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 51bc8bffdc3ccb6e2bd240a8c287656bf549cc74c182fd0c7a63e2a234fa5119
MD5 3e9257a197c20c94ba50a2bf0d5751b6
SHA1 267772c4491b86850f55bdb9c81342cd17d486c7
SHA512 e19cf360ec21d45871600e02b16d9c70653efc9a8e684c2b948557dc5cf207a997f9623c545372da8a49f1e49126dccc6b46f02e446067de53295b381c51d9dd
SSDEEP 24576:2XYfDtczAV+22C9+bmOmbTk3reZCIT59z7m:1tcD2LlOpbeZB7m
TLSH
T12375026467D408F9DC6B823CC9A28411E633BC9587A0E7DB03E489661F737D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0fc05624242641df452838901e6bb4a2c9c6b424b698f02e1800d594891fcc80
MD5 461a222082089697362f610a2b263cf2
SHA1 3eb3717800983d6c45708deba06d0d6c4ea171b7
SHA512 7cca8ac38edfb72d8b07e94da206736ae78577e9705de216a9bcf605412720efd5e441fa3ad79b4f3d47ce2e7b1db78f2659290054294f464616da4111378b29
SSDEEP 24576:S0Le5ji0hmxxrMw+22C9+bmOmbTk3reZCIT59z7m:SPji0Ajy2LlOpbeZB7m
TLSH
T19895AE56F6748371D073C0B9C5D2A69EE97130865B308ACB4286C77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bddc8c891e03cc13972ec00f505ddda9bb6a26f54aab768a54df00df3158077c
MD5 032671f6d4ddd8d4724cf058f337a9f5
SHA1 0e8e6a07b2e2da8b2d71cf372a6252a25cf7b6d9
SHA512 611ab5057c881d54ae136661db9cd929ff5e7dea8f0a98a4d6f8deeb323145e95859d0daec4a54679b5d0162fe96250c1863eb7f2bd60a7b5c5b9f7b2d434b75
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWn6q8wyua+22C9+bmOmbTk3reZCIT59z7m:0/ezSC6vUzPveHjyu2LlOpbeZB7m
TLSH
T125755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d486e10d563ca91cb9913d7d6a4089ace74f74f4ba0debbb471911c68b0634d1
MD5 41271fb5f458f7bbc98742c27f733986
SHA1 f430f260c7f56d0d1613a202d12225c8965e5e39
SHA512 962d253946dca93db2da347abdc56d0d2c3f3f072376ebbd10dd775979d06e3cd6c931cf0319f085c2a3e1d63a3790ad5888e68d112ce4c1223642e74f39daf5
SSDEEP 24576:MVbqPb88hv/l+Yx+22C9+bmOmbTk3reZCIT59z7m:MVO88hXl+L2LlOpbeZB7m
TLSH
T1E6559E66F6B48331D073C0B9C5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 8b6d3739a010eade046133d30b13a5f7dba5f90015407cecb6e11de5fd193e11
MD5 14d025d7b4b9e4e79e95ab756f0fe764
SHA1 6f4f26e715952dc2f3a6fdd2ea9d076e3b6c2078
SHA512 caa8e50ed5bf7a41518b3bcf8e1460e372d821f7b5f41a1692996de120315d76c95affe8d933cb82f2b609bb223bd902513ace46f9b78ef80aa4e4676992d4e4
SSDEEP 12288:6Lc+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:6Lc+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1125523C18FD8C4FAC6BF1230569164F56635EED8DDC6755B81891ECF18F1AB8D04A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 e33924c9284df6127d7a02db117c9f6e74ae7e72307ec9d5a6a4c21c95d1098f
MD5 8240d84543af8602a76eb6ee21b9fd58
SHA1 f36f2c6772a4db449afae9f21b57a28489c8e9d3
SHA512 a49230dd9de27e3df37011416c77f3360151e3f31619f76d4e0aa767a9d8b8b211d0a0b7e0a3626ef892245bfd6730c64a78d7f52279a68f6e628f1de95d0b72
SSDEEP 12288:veBNUbTVO86Up+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:vJIUp+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1DE75CF7BEE28FCE2C27E4D785B918640E77278708F52A3CBD165820E9E235E05D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8a39a4aa8be0248e8cc1ad5591ff1603a628bd9b7b9d84ff5d5b91b1913ff3b0
MD5 3c50b942b2c9336d8cea156299cbe96c
SHA1 4871bc89c4558d851cba3d9c78f086f4a0c351b7
SHA512 137454789d8ddb41dee0731ea462e3d14f6636c2009a22649043cbd3ff5eaf2382294ebe5c5955869c462c6119223c2ee9fe6f1975111c9f746d2088ae7bedf2
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THm:eQvGAdlCEL8c/DRNw5Cjycv
TLSH
T15E266C656BF880F5E0A7E134897AC5B2F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3ccb5340a411edad733f5863f06bd66e875c0ee06e23eef436075f7be8c26e83
MD5 dc61a2cc3948ae66a64bd5f335403b67
SHA1 035062877d3ee2846c28184d4f2fa2b0a344806f
SHA512 b8f499ff1bde916f6917783152668d49aba53fcf99a75ee0b1b3628a193acd7e83c86f2bbe433c021cba0315e6f7e8dc431fc693b0015e048537bd49ccb1d815
SSDEEP 24576:D0ewsAjD+22C9+bmOmbTk3reZCIT59z7m:Qlji2LlOpbeZB7m
TLSH
T16485E071FF74D436C2BF0DB11B26D716142DBA604F922AC3E3A84E8E59702D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 048954ca00d6dbba258f147f8f42de70834cd50352255a147b187a23a0476381
MD5 c083c38d99f4542409e970eff3a82b49
SHA1 a3121794e0c1e5d3dcea84fd23cbcaadfcf5a47d
SHA512 179b099109d3ba35b966d44916889a5e0a3a6b753c1fe5c6cdcf1fc2c2408ffa11ff67cdcca953f1ec219c32617e152b432f58be0ac1d12830a29146139e57a6
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHWv:SUEtQevvqc2W1cpV2tI32W
TLSH
T1FA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 79133ddea2c531c55d3b8afb96d4a12ff975d5ca9b12f08e128958017be34212
MD5 4490794d1cd5fbc2132942f2e8aedcfe
SHA1 808c5482aec0c6a33fb98bb52c6af86a5d6f4712
SHA512 040d1f2b609e6faab7fac04a12f54cd4bce63c7927e4ee9fdf13f200675e871748d9260bf64654c2e0f6f81a3f405260f8e27f6d3ab77ef62d7d985cf9623620
SSDEEP 49152:UCbRquA/m2yL5zTfFiV+XenmE3/zC2LlOpbeZB7m:9oquVjnmPycv
TLSH
T1FED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 18effd79e3dfe6c3ca4f02e0cd7882b9c9a1eb9fae8c411dc6da0bd658de8fef
MD5 c374730f2c59fc416747deebeee92c1f
SHA1 ae746c869b07c5ec81c44350fa6102c59dd02797
SHA512 7eb33e645bdd82ceb6218e06850bfadb770b63682728caf5c6a79b597498b07dfab6bf040ba85764044bdfcd61d6ab251ba6053a78bdb9926edbd05135e12daa
SSDEEP 24576:0AhGL3IFoiwtA5l7S53++22C9+bmOmbTk3reZCIT59z7m:0AMUFoiq5/2LlOpbeZB7m
TLSH
T1E935AD81EBF945D4F5B7AA7899B69171EA76BCAA5E31C20F2150C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 234f3f7249ce38edb624ff4fbd977fa0cd2fe6bf991e1e6ddacda03ef199a9c9
MD5 41dd5503d8b3430b389974b805645723
SHA1 474f27ceb9c98ad074f6b6f51f65095f4358d16c
SHA512 b51d490464686555476e1fe28ba79445ce1bea1a9fa506ed180db19b3048746a930960b532a03b61ee8caa5c205a656799013e0fe3f9f9c161093c35b7b9a0f5
SSDEEP 24576:pwu4OWX+22C9+bmOmbTk3reZCIT59z7m:pwvOb2LlOpbeZB7m
TLSH
T1D075F18677E80CF9E96B823885978136F7B2BC152A65D71F0360CA5B1F73361AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 d795c998612075b9345b00a2b91efcfeb62e6c3ecd7ea30f86eb599747c1c22b
MD5 eaa8301098d52552e6211b2e69c239c4
SHA1 f5bcaf7f77926dc94058176c37e1e94c57bdba2b
SHA512 3bb6f1c2fd903aac627f0b1f9892586ddc25d6fbe25f8db7d317d1ef8264905a1b07732154e76a25ef5dea9713090e37da651e98044e3cfef95aa889bc413931
SSDEEP 12288:ceZ1IyT+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:FZuo+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1E86512C627E860F9C1BB4238C9E15545E372B8A5ABB253CF02540A9A1F73FD59D39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 87193af2a92a21bf69500f272d90740376845974bb8a68214f9fa0848a570369
MD5 4d5b44973b66dde741d5a9973018d523
SHA1 2e0906c945529243d2066ff7df0aaad07f5ac042
SHA512 dd0c00174353d3466e34622217abaefc1a6df432b5cd59bae7d3323c9e7581fc9e02823c3b4a64a32f30a640b742cb16ae3c8ebaa5e63a12387093293cf2b843
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uq:cQRQyi36YOcPbLvw2gAf+PN3Uycv
TLSH
T1D7667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f7d94e9d866a6ee315d6a30caeebd296222516e51de979ce5cb273498bbe9ede
MD5 5795076c11572845c405cffc3be81cf5
SHA1 076203e957fe549716f5da306aedc25a625eb58a
SHA512 360fbf6bf0cbcee5096587359e7482aa41900a132faa5b980e54b64a84b54b1816eb831f5f61f842589f66e8e5fb31060a43452701ad347fa0d6aa272aea189b
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uq:wQRQyi36YOcPbLvw2gAf+PN3Uycv
TLSH
T1F6667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d75a0f797adbba731e4299cb00635a371957671c8428503af0cc108644891adf
MD5 f3f8d339e33c241e1c3ee146cdc18277
SHA1 cb0a2bc233e9d6e1e5962a45c69b4f0c48e5f435
SHA512 febf9949ef48baee966d3ae249e8e369d7d04526e82dab3c20a11e778b5b76499b4328c1edecaee935a5cd2f147b35af86a647ad9052a65572bd04d61efe94b9
SSDEEP 24576:VwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0Y+22C9+bmOmbTkZ:R68Qg55nhceWu7PNU3/y2LlOpbeZB7m
TLSH
T110B54933B2F600A9C44DE1769F46873196D27C758FE1E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8006a7627cfe339ea85c6c64620acbb803de78c3daf6449789ee4b96c6bce744
MD5 995352a4088769dab43581ffa2c4ed9b
SHA1 30638a76a08938af88178bb0edc1568991926133
SHA512 074b9f7891bf76e3989cb94c32240850c53911364e36f2501586faf1d4ddd535e1c8987f477e21fd5831685f95542d04d3da21fe1c5da60597bdaf2a1f0438d4
SSDEEP 49152:b3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99o:+y5112gYy5azzVvt69nLKnhZlycv
TLSH
T106167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f4325bace70fa07782b61decab2ee93c77f298e1790b45faf3b6cca50d02fb91
MD5 2b50ec9220ce40c70c249369607c5c2e
SHA1 cecc90018d9cb5f22ff472af1a86915bdce299fb
SHA512 4a4ae9582e2fa8493ea0d14f26bfda8319e5a9f0d2ac7f68dd7ee1c20dccb8018f332a856090c1cd36d9c54824cff020d263ace6dea879b13682fe8819bd30dd
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl82LlOpbeZB7m:6u6Jmdxd2d8ycv
TLSH
T1CCD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fced870dd32d0851950e1be049ab088042ababd8e03a5dddb5b3baeb83b8b1a0
MD5 6f599775f9b890c44890ef518ed1b550
SHA1 56c91b4fe5e7135c034542b1455f37a599e42c9e
SHA512 bdf35df4650eb87ce563b7b7a54868612374d71d26dc496c2f79182150c8488d3f9e2b38bbde3e2859b5c638a8d149448feb50041fa42a14d63b64d255b7aaeb
SSDEEP 49152:01hpsNoJpF1A63U44CwH7R4xY2LlOpbeZB7m:0mifPWRPycv
TLSH
T17CB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 74dc43a97c8a8d5e2be809244a5e0b2dc5d7e20f9f3fa868243ac0422162a464
MD5 f8054769f689b6da96b32466c9c5bda9
SHA1 2dd44d6775695eb540e2c11a75e64af71670fcd7
SHA512 1cd683bed306c993d9d34dc8c4da241075576c3ac83cb150fe3ebeeea7fb67aceaebfed59ebbbf0d1d9c430c9d1980f92eb662172ca53ffcb8f1a556c11cfee8
SSDEEP 49152:HSuZQIY0Be2KcRVtOnks6NMHqZ2LlOpbeZB7m:d5dKii61Zycv
TLSH
T148C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 72228dda52c44f046ce31cb512d5a57402ea5dfd804e1f725160e0f0251e84f6
MD5 6c902c19bb9cfd004b2d05987de2c3a6
SHA1 ced276c8d277c78404faaeeec39be4c993d201c0
SHA512 4f205b54d23782a294169a2e94401dff76d8302c29c8e78057bf6709ee0224e6b6799d4b1aacf5a9aaaf4ab5f28491d6a47dead0dfb30381ca0764ace6cf0e51
SSDEEP 49152:IhtSn8EApI0fig3giDn0AP5ws2LlOpbeZB7m:ZX2imph7ycv
TLSH
T1DB95BE13F2D900E8D06ED178C7568632EA62BC150B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 59a05ad191466a4aa67aaeb1231303a135e43e0a645eb91c38300ef01702d254
MD5 01d5b49a598401c187732cb4b7fd756a
SHA1 eb078f5a0e98e3b183afdf963595ea90fda70aa9
SHA512 5cfbda8863594ffa74611215ab690d15864b6e19d428bfbc52c30478fd14592c3d00f7bc0d7392dff44382592857b410f50764a7663c1ba401ff03aea88db383
SSDEEP 12288:f0+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:f0+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1805523C18FDEC9FAC17E5230865120E56529EEDDFEC7619B428E0D4B1AF1BF8A00954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 134705f609745c7d9acb80350d77b2a66f669167a0c5704bbcd28ea465a2c489
MD5 3618c63929d1628678dfb8f64ba9d3b4
SHA1 0c739777e1359299e2ecbd54570d6a54a41f5c19
SHA512 d8bca4b38b275efcca2d28fbd7e680bbbb97cfcf0ab5da751f887454a148d70738d5358b654187f06775f465e6549401a6469fa2a1a59e8e2606c9fb2d7dd8db
SSDEEP 12288:Mf+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Mf+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1285523C14FDEC9FAC13E5230465120E56529EEDDFEC7619B428D0C4B2AF1BF8A40A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 7684d13301d6729ad280889a732ec242bae93187b63ece893fef5009cd223043
MD5 b601715c6a90749902b3f9373db09a4a
SHA1 69a897343ad71dcc6dadeb795f7c76dfe5fa56d4
SHA512 de5b654ad6fef23ee4eeee52c42215eab996096db7407c63dd6db956b3dba41206055670e8830759333330926c32d4bae11fc42b28a7ae144cf72f9790df72b8
SSDEEP 12288:Nh+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Nh+22C9+bmOmbTk3reZCIT59z7m
TLSH
T14B5523C14FDEC9FAC07E5230465120E56529EEDDFEC7619B828E0C4B29F1BF8A00954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2531e674a71e331129bf72befe0a243aae905ee4a9906fca082be99bc6b1771b
MD5 9c4c795d2d0f5e6648fe5f091c60eed5
SHA1 671d16a0667043011b2508959cec991a90922f9f
SHA512 9e1a6884010ec1a9284f916f0ecb63a5b85b044441d3ec205647d426d0cb960545e96aeee6bb97b0d7627cf760b8894cca6b14aa520ee5e1d0299e9ec84cac3a
SSDEEP 12288:mVe+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:7+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1F65523C11FE984FAC47E9234C56150A1E275FDD8EFE3629F82450D4B0EF17E4A829B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 2ad665010d784c0384e206c765d2307d4217105750bf2d9c77e9f9cd2c7d6239
MD5 c082606660b6dfc4d657c6c3dbb51e41
SHA1 9ae9bf472ef9bd1f6e42dae8665a8bb623d478bd
SHA512 2b396c305c0b1d19177397c0ae4fedf9ff1b50683da5a60b9e13dee8297679cff114e407c49be156a8a2ceacd7e471c13422a020c63171d09dcd1e404fa6dc4a
SSDEEP 12288:LG+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:LG+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1FD5523C18FDEC9FAC17E5230465120E56529EEDDFEC7719B828E0C4B1AF1BB8A40954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 22f53610b44fbf323437d20fbfb456173d6ff641a510ec044f26be16c898f6df
MD5 33e1c4d92bb884fce4e4f56b7017eedb
SHA1 281db028a1663cb79283948d0efff6b5441381ba
SHA512 77cd9864364c1553233a2cdc7d38df77296805f29b4161047ebfc14c883eaa5a99b4f1953356f95b97f4860a5ad35389500cf2f8a6a680f57a939267fcdf8e0a
SSDEEP 12288:/7+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:/7+22C9+bmOmbTk3reZCIT59z7m
TLSH
T19C5523C18FDEC9FAC13E5230465120E56529EEDDFEC7619B428E0C4B2AF1BB8A44954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 b66b28492e910a40727c4e06b73b4dfa176bd69561eb9dace7f5f2d30092e03d
MD5 9b227c3b846238ab823508d3a0477db3
SHA1 81923daa62390b45b22e9bf2b99ae723b13e4e30
SHA512 8b0b2244af18ac498776e41f26836ba418f770306685525cbaa3b8f81fcb680a9e861bd01373cc8289f0f0dd284c068e139568338f3631b169b9c10a89199120
SSDEEP 12288:xH+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:xH+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1D35523C18FDEC9FAC13E4230465160F56529EEDDEEC7619B828E0D4B26F1BB8A40954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 312b4061ec5445ccf5bc59cbaba464d9a6e68021a47971441c6f2ebab519cec4
MD5 3f5ddef4793e9850f943fbed01a5ec69
SHA1 2d99ed2ba2c8b8180a3488bfe1c0a29782864d7b
SHA512 0e16a83666694a7c83cd5d877c74bd1b51adb0d63aac4d58616568c6fe0402dc9752792c95baeea5ba61201a1869dc54b8bf3fcf6caa607b30a5616b1c90137b
SSDEEP 24576:NZMRzFVSO/+22C9+bmOmbTk3reZCIT59z7m:NZMRzfa2LlOpbeZB7m
TLSH
T1937502D5B39008F8DC7B813DC9518856D6B2BC594BA0C65F03E83A671F733A15C2EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 7e0fad26c239ca6def7135d297cf6ceb56aceed9843857c24080904924a5cfae
MD5 619237b4a3ee2c557901173ec7f380d3
SHA1 a1880ee808c6c74b38e86e53ac9f0e22f33a88c1
SHA512 06ed604f98a4d70f2257219aa18c9f753f79be46854da28d64803140b3ecc5d740afcaa391762f210fe7c7a62cf3465231a83d163e37fa472f51704da2257a57
SSDEEP 12288:b4+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:b4+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1DF5523C18FDEC9FAC17E0234465120E56529EEDDFEC7719B828E0D4B2AF1BB8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 bdcc04ab35701a796dd00e6dcd0dd6eddc5f771330b47eb84cca8873087470e4
MD5 cc0f9c8b73790c0d344717dd1b09e617
SHA1 a20d8b7ecc5cdc1f3595b930c39bdaffc48fdccc
SHA512 de36fc1abc6f8927f4315ac7eb727ef2bd816c70df3dee350c68f91547e23b0c895c9088a998187c6f85f1ab34e4446f6359572d3a71442d50f5d220e821c310
SSDEEP 12288:8s+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:8s+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1095523C14FDEC9FAC13E4230465120E56529EEDDFEC7719B828E0D4B2AF1BB8A44954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 18dff8a519cbb94e3e8d7c9441ec0c17ef2c428ad325fe3cab3a0011a0ac2786
MD5 fa399d52cc032864e188303b221f8f37
SHA1 7c4c695ac8b97d06812e607b7f2a89b3df587ccc
SHA512 59a8a566022d6cb9c087660af0e6ab7fae01e4b7743b44791c28fc01f496b9729d85711c982433058341b9fdb45111c6a912b18de093d38474a7b57e518c7778
SSDEEP 12288:fyPz5L8T+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:SzyT+22C9+bmOmbTk3reZCIT59z7m
TLSH
T11B65128377A520F9C13B8234C9921951F375B8758B619AAF03940A7B2F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 33eb674de5205490f135d3687daa27869767b3b9f9b77b223a75f8b183c4e694
MD5 ae536c960bb2700f45b3a9a171f10c22
SHA1 8b53cb687734c227e21e38219d10a5fc7d12365a
SHA512 5c0d192436fc1741461607207df0eba7fc8f7cadd6152260f78624d2775bb95e300282d480acaecbfd37406564c8bb6d134eeea062f658a03e8f43d4b292cdf8
SSDEEP 12288:i4+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:i4+22C9+bmOmbTk3reZCIT59z7m
TLSH
T18E5523C18FDEC9FAC17E4230465120E56529EEDDFEC7719B828E0D4B2AF1BB8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 6eee02510ca78b0231456a9c45e3fade5ad9f274215f542f1070d9ceca5fee6a
MD5 2dd11660a6ba72d6f6283861879746ac
SHA1 07327dbc4f147184999c3511765c5021c4bd150d
SHA512 7d65208f749a97cbf880e27177a3190252217dafcb77a13840cb4600175aa5bb9a741b8b8e6ad4729509773370926222ebe4ffe9ee69be508a2fb100133dea2d
SSDEEP 12288:U4+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:U4+22C9+bmOmbTk3reZCIT59z7m
TLSH
T19F5523C18FDEC9FAC17E4230465120E56529EEDDFEC7719B828E0D4B2AF1BB8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 c5f5f07bbabcbecd6429b48dc2145059d6657faaf2c8249b0e3d910102ffc492
MD5 0aa7ae3e1d9eef90378d347293dc48b4
SHA1 2c36c3c5e046e9679305f94c95567041a116bd49
SHA512 c39f96adba28716de3e51f80c4277c663c8f2b210354b9675e43277c3fd54cba009271a6926747c33400a90e576d32a562a91c27161d36b75bf65673b6d3238c
SSDEEP 12288:2yPz5L8T+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:LzyT+22C9+bmOmbTk3reZCIT59z7m
TLSH
T14665128377A520F9C13B8234C9521951F376B8758B619AAF03940A7B2F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 6d45d44c4d7001cc021bbccebfc3a5675b0845a78a4482c98ff15e062625eaea
MD5 dbaadb3d935667e51d9de4b91b3a76ad
SHA1 ba12d9c47d2f50c1f4baec3ab81811db69cc8d9a
SHA512 03afa7768e2faff61e28a80c3d00eea58ce3ac44b5200962a046185d781305e7bd326c50d7b435d1a6d997d80b18af93b95a93209f6a34cc3c06ddff886da267
SSDEEP 24576:tTDaLl3z0zDR+22C9+bmOmbTk3reZCIT59z7m:tTuLljz2LlOpbeZB7m
TLSH
T1A37502D4B39058F8DC7B813DC9514956D2B2BC5A4BA0C65F03E83A6B1F733A05C2EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 c92e754ba395cc0b5d94b3da1f6c0b6d4d80739070d53cb17858ca0cc7b4be4b
MD5 176f2a1e6a53243b6af1bb6de523e48e
SHA1 0f39603ae171b002346ad10fa4628d9677214529
SHA512 7df968c971fcb3ea0810726b85ab1067f4c3363c1c94816c02a02f888fd9d73bc0df3b5be33a040b55aa0b1940ed36a79a12bfeedbc64022b8894cd737c98333
SSDEEP 24576:s3vd9CHKy7GZt+22C9+bmOmbTk3reZCIT59z7m:Wvd9CHKyaa2LlOpbeZB7m
TLSH
T19A85DF90F3E414E8F0B79A34C9725511DA76BC995B71DA8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 25f8bcf2b9ec294f7b63d2b8ed6d2e49e8bd8e3dbf030c630d51c78017b5d22a
MD5 aa86a5dec7cbe5d1b5303865533d1bf6
SHA1 36b75de95ad59ecee6b5e7d7eeb9804301f88f80
SHA512 264620aee37daa42894b8df533f06b46c5f42ea0d1682e43679aa75940b22e91bc128148129e2b0a748dda8ec1dfe6c5b353e78f1adc5c0a62d54aa5a853c5fd
SSDEEP 12288:kB+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:kB+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1FE5523C18FDEC9FAC17E5230465120E56529EEDDFEC7619B828E0C4B1AF1BB8A40954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 c90ac8a76ef33d6499b95e227bd41641e7c006776948187be11a0beccace49bc
MD5 9cfa25945b462bcb2a30472764da3d05
SHA1 47dd0d28dbc435e12ca96eb4b7d82588eed75239
SHA512 62b7565632e5e59d0fb90860621927a7be8d23fcba2d8786aa3a3258d242cbc1f63734f8904f22f7980b4dcf271dafefc6b401be8319715d5d4feaa6c2f17dea
SSDEEP 12288:yz+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:yz+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1BB5523C14FEEC9FAC17E4230469160E56529EEDDEED7619B828E0C4B1AF1FB8940914F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 bc426a3dd31c19e1e14af87eefd093b0411d3197c51e91fb0f463c1b4fcb1c56
MD5 4affc76cd1101c32c1c00dd00d1182ac
SHA1 2a7dfa1a8d0bb67fa104aa1fb7c69504e994611e
SHA512 9478e3aa2620f576767e5e369f7658bd03988d6199d1df5881090a654898598d9d24d0f2338dd3e80e9233c423af60805e976c17b7dd97b993fe9267cf505112
SSDEEP 12288:Fi+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Fi+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1FF5523C14FDEC9FAC17E4230465120E56569EEDDFEC7619B828E0D4B2AF1BB8A40914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 daf67c223f776d83ba980624f475f95cd82aa595ea68e5e9d91e5c1e321f22e8
MD5 478ec166ed886cfda932b68d30755794
SHA1 c6c4784fe9d0580f6b64386d459e641781162efc
SHA512 e81f54b1d42644b9f7e02674df8ccb759ce304f91e54c947c98783988701d59ec936dde102a10ea6719204cc82bd688d9c599343f1e4a7af4577848d498caac8
SSDEEP 12288:E4+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:E4+22C9+bmOmbTk3reZCIT59z7m
TLSH
T13E5523C14FDEC9FAC17E4230465120E56569EEDDFEC7719B828E0D4B2AF1BB8940914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 ca98382a9d2eba2dd0f917baa3304ffcb5690d4f5d033cae5a93a36ff8bc62f5
MD5 c262a24efb16b16b65e1e3dad66ef120
SHA1 874246af4dcfc34d075e5d9e0a8ec767b6b4d094
SHA512 0c2fc736bcd49aff4ed7ae416e9e93a5c747554e7c4d17ec25be4bc76cea6955725b63464c26bc22c0d5b815766db842079efcd0f920f956222ae16d3a753c7d
SSDEEP 12288:GB+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:GB+22C9+bmOmbTk3reZCIT59z7m
TLSH
T13C5523C18FDEC9FAC17E5230465120E56539EEDDFEC7619B828E0C4B1AF1BB8A40954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 784e8e6b18d30bd5b795ea8e6f61832651759d9d6ebfb81a26f8ef57a0c6e8dc
MD5 17e71756e798936e7d6c3aef0b37d8da
SHA1 4c0478d59faf2fa9b60b926609c483b5b71dc297
SHA512 5d014365ebe5ccaefcb79ab6d840a96ad2c80d9b2aaaff3f76ef2d3c856a61431c53015130f99f728cb8a166172242a62cc20667ac55f2dda7d9d65fd668ef7a
SSDEEP 12288:Lg+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Lg+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1225523C18FDEC9FAC17E4230469120F56569EEDDFEC7619B828E0D4B1AF1BB8900954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 61f984075df2772ad81304928984c5715f12fa263f012b1b1a96039eb0173388
MD5 8e894d4aeeb7aafd12f7fe8fc6ce517a
SHA1 3c6880ecd239b09ccb279f3dc89e1836e922eedc
SHA512 60310e8b8feabd37723b8ecc768e87eaa5ace110c6cb28a8d79ae1d176a6b3c111da8bfbe9aa4b09efb0b52387fe4aa380e22f86cbf1df86eaa04d3cacee15a6
SSDEEP 12288:SG+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:SG+22C9+bmOmbTk3reZCIT59z7m
TLSH
T14F5523C18FDEC5FAC17E5230465120E56529EEDDFEC7719B828E0C4B2AF1BB8A00954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 d11433b870310158a47936b161f7bc9c3683f27c2f02f6633182cfe298a6b85a
MD5 4f86617a97edb6c4a8f092c303ab30d6
SHA1 c039c0721beb1f13612bdbeec8aef52f2fdb2247
SHA512 2d534998b80b757274b0811c15ae7d18d4571bca223d35bd56c51a385422a34d610bfd7ccb9f563e76b434d25b3119384aacb6ac8658c4302a5dfa94519c8e9e
SSDEEP 24576:rfwvUk9RX6wkyAI8+22C9+bmOmbTk3reZCIT59z7m:hMnYIF2LlOpbeZB7m
TLSH
T1AF85D029EBDC44E5E177923C89B3460AF6B1B8695B71C2CF029A53AE0E33ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 95a677853a18f892dfec4a5594ba7aae51c0377d24decf293fb66fbdf140bc49
MD5 d8342b8f763f8e794cd0b041680c9704
SHA1 4c62b0977ee5add67020c28516b65c5b8ad5ec81
SHA512 9a7a733b053d75f7fbc057ee05860eba4bbca5af844fbe8975441baf949c496b70fa991db90252f6c246fd7ecaec3051df42710f4c30cb12b227b0274a5b24fc
SSDEEP 49152:eYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0M2LlOpbeZB7m:tySzP0ycv
TLSH
T165066C96A1A841D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5a9192b8acf3a9a32f36d3a871ec105cb1112a3ad585ea5b426789d39b650cb9
MD5 65c060478d42a7418674b9643adc855b
SHA1 5366882931fb4b63edd774698133f9cd17e139c9
SHA512 59638c0a6f62753f9959e5043a3f99e519bcc543f67d02f8c1feaccb323f0d347139e220da20f029de8a4c12df289bd50fa7f49d0f3574885cc73ceedb96909c
SSDEEP 24576:s47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYP+22C9+bmOmbTk3reZCIT59z7m:s47JUQjTirIhCnDHUPfF/82LlOpbeZBi
TLSH
T15465AE1EA3EC01E5E1BA823885154A5AEA71782D5F32CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e4ab415054a13994be26f2b1a1cea72be864b675d5e62e03e7f6cc0e85643316
MD5 a63cad567c1dde760ec12a5ee3c15621
SHA1 771603913e848a3455c6cd703b8ecd74c8c4b0d3
SHA512 7c8eaffe33b441f1fa59779e208170465fea2e0d3eccb8942915a0d1e814ca08538bc83900a01e8838a1698cf92ab4f921e57d52ad158d97842c14d76ac39d1c
SSDEEP 12288:Qbsfo+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:3o+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1B065F185D79842E8C06E6234C7515681B333BC659BE2E3CB52C0F97E1F766A09DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 984KB
SHA256 26c19d2f246cc66c2f78fbd8cbb1e0796da9a18bd7cdab3c5adef762a7613617
MD5 3dfa3138d426b51fbb979522ad32a605
SHA1 b664d40a97c61d88dce320baf1f73ca2a30b311f
SHA512 7abf07ea93460e2707731fcec27d7fe36ae2ed68be6eb3d1c7a62dc4e0c311ea6668e0278bc880b3d9681316806a00190492f8bb9bd45bd099154e4658d38ea6
SSDEEP 12288:xBX0zU3fF8zlLtuJxQxKytOxbVN75F4eCaZAcOZtGJR:3XmUPEl6bVN7r4eCUAbZ4
TLSH
T1812507007666C74FCA6980361E37D2CCA7B07D11EE456F0373C8873F9576A58BAE2692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 eb5bbd822c63cb3d6027ffd8bc33e78626a00a1086b6a9c3a1cedda51f3f870b
MD5 0b451cb964f0fdaf10823862e4aa4833
SHA1 43c864c079f186bf0966750e0e2284ab966e7982
SHA512 4979231291ee3ea921adb545445b39295626db1112be8e878b079f620a3cab2c18573ade532513dba5dd87bff2185be49d77103ada93d9c6dc2e74b0f271704d
SSDEEP 6144:8gw9pM0t47KTr4nbtDVhtuJxQxG/J8SqtMxMl+KwpgWjUISqtMxc5aK7bL3aOaC:f42bt7tuJxQxxl+KwpgWlGK
TLSH
T17955E7409537E38FD1BA6031072A9B4C77A4EC16B7096F27B7C8453AD82AB15A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 279d29e706770f0cff364e6dedb5778f4ca903d4524818dfa6477ff988ba8d85
MD5 25f68c65517189260fcf42f6c62743a5
SHA1 116456a0cc9b0d3739415608f3be42af343e9a27
SHA512 2591cfc499d90b477b630eee0dc8b3ce1b4b9c5718ec3679947c54521d864d543d86fa5357ffc703d78fbba83f72a0b937a21e5966c04a2b8c1c6cf6c2c903f0
SSDEEP 12288:a07Q+22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:bQ+22C9+bmOmbTk3reZCIT59z7m
TLSH
T1545523C18FDD88FAC47E523045555074622EFEA8DFC2A0DB91490E8B29F1AE4DC7A60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e01e5883f42bc13a1b077d6d964e76d3e4b1f040f43d351aad26c45d63228c8a
MD5 f9354d7982efeee12e12e238dd5fcf93
SHA1 8e738b768232b652649203a48693f0cd1247a410
SHA512 22dd2e80742525e4b7111fcbdc0251f3529fb02f31183243d2f53aa20b41e766e9e3254ae622403424c57ad8551046e09a3d4a30a068937e296c46ce37efe56f
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYa+22C9+bmOmbTk3reZCIT59z7m:dgb4mBIBhGF22LlOpbeZB7m
TLSH
T1CD65AE1E22EC02F5E0FAD2B8CDA64417D6B278164732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 54d28ac90ab2638e6e3703d0d82ccde26fcb95376abc79356f3a4cf8aa64ffb9
MD5 035a9898bcb9c4878cd3e697c0c69a1f
SHA1 c0a72e695a724531bba81f110370abfafaf9f021
SHA512 e07e531a5849ac6fc301f486f0515663f53036a9eba3861390041bca1944591eca265119a4b8c98bba6671394141bc97aa1e2e4dde3212f9259807dd45053e2b
SSDEEP 24576:/G88u8FpJqH1bzria7/m/+22C9+bmOmbTk3reZCIT59z7m:O7ZFPqVea7/L2LlOpbeZB7m
TLSH
T1EA95F16167E101F1D47BD13889824663F6B2B8250364EBDF07AC8B561F23BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3dd5b4e0c945638304cf456c3f734880dbaaf9349c9cfe011c2754bc34c14a54
MD5 f5df0f44d54e8ba05c251e04c3381513
SHA1 6c43e9cf8d319aee8096565759eb3f9ffe972412
SHA512 67f9abeab997ddc6d9f2c68ffaab9b08a8a3814b942ae4e244bf62823eeebfd7b4b50272f917d6e64908bc8286fa356124accfed0b247c49f1f6bf96aab8706a
SSDEEP 24576:yPUr+NQL+22C9+bmOmbTk3reZCIT59z7m:yJQa2LlOpbeZB7m
TLSH
T18075E15F26ED18E5E67AA13C85824619F771B8625752A2CF02D0817E0F73EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 13352deee6d9728a38e28fd62b8b6f854fb315b1af3ea898408999c6e88c7abd
MD5 6dfef42e72091ec00a28dc445e6a6928
SHA1 7cf299283bef716fe0b20e732581c5067ef41831
SHA512 bd52660e1cfaf38cc4073f931f22355856fc8e63191359146b45d71b71d95e262c8c594b2bbd3c5e792474834d7435d2d00d459eb4d9df5e7dd2ad1d8a7aaa1b
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjq2LlOpbeZB7m:mG05lO43b9ycv
TLSH
T186D5C06A62EC11F9D0BBD17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3c0b0cfc3493dd4d9dbe5be21004693842b605323c77fadd178797e49a90a9e6
MD5 84814b444b5be664612b4222d2a943c2
SHA1 6648b563dd510eac3fb005e8ad7c6b740ad17483
SHA512 b5ffe959c7e3fafac7be803373a9277421f7a31adfac9ee2c4b84f8a731cef21a9e79cac4178311bb4d2ea236e29eb8b15267a63be952a3dd3cc03a5e34507be
SSDEEP 24576:1fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn1+22C9+bmOmbTk3reZCIT59z7m:Va5POZ3BJt2pasx2+my2LlOpbeZB7m
TLSH
T1E765AE5EA7FC01D5D1B9D17CC583861AF5B1742553329ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a980e90290846f7c757233bb16df5a1d8f677feb6b64000c82d9e4a4ce8c43dc
MD5 988edc1761be822f08e7611dd95f5c45
SHA1 b7edde15d37e3c746827566b3d9ff5f11614ac76
SHA512 21b91ee014eaa1c4f0d19d2ed40ee47a92295ecffedc62e66d60990d9bb4548040b0a1a3fc2744bf755363c3f7d83bf236bb8876f41599cb5cab505e4ad2b5ae
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7Fk3+22C9+bmOmbTk3reZCIT59z7m:lNc/zEOVHFr2LlOpbeZB7m
TLSH
T18B858C1623E901E4E1BBE1BE89779546FA717869533086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ff12fdc7f85b7dd8095d3042385a8312fd07922da03331c6e28513985d93fbfe
MD5 46a09f0765f5674d15bd1d65529a5f5f
SHA1 bc6d3e5006dd1a50d355c09fbf77e466c554a1be
SHA512 e687a08b1a145ec9dd7bad31901b488bed92701c4bb54e8733183a5c4e18c83d142b73c5792afdf5fb1328bfdddcdd4697f48eb2fcab5d3cb3095116951b7d16
SSDEEP 24576:/TkNvNnaFeYhJNtmZBm5+22C9+bmOmbTk3reZCIT59z7m:/TMwBtOmo2LlOpbeZB7m
TLSH
T10C55AF6EABF846E4D1FEC6748D238512E6727861073293CB5290C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 0d3de5babf0ddc517012e40e42df129bcf00314dee44fe553b452e8c794dd88f
MD5 6cb86db64bdf4f617606b27ba01714e5
SHA1 5dc51de3ee5870dbbe77faa1cf90650b87df6e4b
SHA512 f4b631810a8c03b455d24b1872e7f989833d8164f1153d3ab34aabc3f36876eabc31d797f6c35fba78b1e4fd960dc0b18a563b1b4dde0b57c4264a1f9fde5cb2
SSDEEP 24576:tD3FHshBIYQgAU+22C9+bmOmbTk3reZCIT59z7m:tDVHeBIAAt2LlOpbeZB7m
TLSH
T13E85E17EEB9C04E4D47BD17CCA638506E77178A9072266CB02D481BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-98-0x0000000000F90000-0x0000000000FF0000-memory.dmp

Download

memory/952-92-0x0000000000F90000-0x0000000000FF0000-memory.dmp

Download

memory/1916-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1916-23-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2884-52-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2884-46-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2912-6-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2912-0-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3316-117-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3316-123-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3368-12-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3368-18-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4152-86-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4152-280-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4152-80-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4544-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4544-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4544-33-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5028-292-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5028-69-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5028-75-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5404-57-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5404-63-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5932-102-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5932-113-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5932-108-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download