82f60e269143265a73201eb63e44fd50f75690823079ef6c3635b1925083e6f4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 1.4MB
Sample260810-3q9pasbc49
SHA256 82f60e269143265a73201eb63e44fd50f75690823079ef6c3635b1925083e6f4
MD5 877f2eeae1370b2d166d16fdba494b93
SHA1 9bff5fab22a687cf0d63c534b4c1f7c0344cb8d2
SHA512 b9830d10092c833b5f92072067bad15eec2edea7b5e319096005101005dca232644bdf8cf1b118dff070d4fd67b10b6136c097efd18f1b110f2add807172cb80
SSDEEP 24576:oR2tN7JN2dv9V13b95qWv9YQPZWuipzQPI9hAH8CzQgAqvuG:oR2tjNW96+5kzQPm6YgA0uG
TLSH
T1AE65C01AF6A812FDD076C37ECD565941FA72781657209BCF03A0465B2E2BAE44F3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
840	alg.exe
2052	DiagnosticsHub.StandardCollector.Service.exe
3244	fxssvc.exe
1388	elevation_service.exe
636	elevation_service.exe
2716	maintenanceservice.exe
3044	msdtc.exe
1596	OSE.EXE
2452	PerceptionSimulationService.exe
3172	perfhost.exe
832	locator.exe
4596	SensorDataService.exe
4004	snmptrap.exe
2488	spectrum.exe
3884	ssh-agent.exe
2968	TieringEngineService.exe
2972	AgentService.exe
4828	vds.exe
4164	vssvc.exe
5092	wbengine.exe
4592	WmiApSrv.exe
4116	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b1bbecdf3a3ba122.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Colors	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4ba1d382229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f21a4372229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055684d382229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000406ed1372229dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a30cb0372229dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3c86e382229dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006169d4392229dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000971b3f382229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efdd43382229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeAuditPrivilege	3244	fxssvc.exe
Token: SeRestorePrivilege	2968	TieringEngineService.exe
Token: SeManageVolumePrivilege	2968	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2972	AgentService.exe
Token: SeBackupPrivilege	4164	vssvc.exe
Token: SeRestorePrivilege	4164	vssvc.exe
Token: SeAuditPrivilege	4164	vssvc.exe
Token: SeBackupPrivilege	5092	wbengine.exe
Token: SeRestorePrivilege	5092	wbengine.exe
Token: SeSecurityPrivilege	5092	wbengine.exe
Token: 33	4116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeDebugPrivilege	4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4776	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	840	alg.exe
Token: SeDebugPrivilege	840	alg.exe
Token: SeDebugPrivilege	840	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4500	4116	SearchIndexer.exe	113
PID 4116 wrote to memory of 984	4116	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3972

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:636

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2716

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3044

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1596

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2452

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3172

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:832

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4596

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4004

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2488

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3132

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4500
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c272790217ca5965709ba7fd1dfce7dd68a822509c802f99b040ff8da0d6e5d7
MD5 4e7a65205ef230980a32e4df29fc8e80
SHA1 d2c0ec349b2f703988fc432199ba323887df92cb
SHA512 b76362016b911e77c15112fa67b3f166cc4e22b09997c1939bfad7ccebaacc31ced9ef1347d4f6aa99a231d4e17df67322f9ee1e7f6016ff7d3c362dc30da4e0
SSDEEP 49152:zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4zQPm6YgA0uG:R3q6sjBD6YgAn
TLSH
T1B3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 610310fdb18e134e84b27489fd4e6687762d8c8c078a62636abcb60153ff9647
MD5 4f4c324471e89150553160b2eba8f2e0
SHA1 69c215fd19d5575c358aeb0a30f7a954ea8cabd7
SHA512 4d78c3d49f4eeea567f15591554c314c1e957712f96c61aac3b21139cfdd98cf0726e04ebf80db46793245b6d1b371b6396690c6cce6882bf081fb6bbd659a85
SSDEEP 12288:a1XLsswWkxy2lRq2czAxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:wXYfDtczAnzQPI9hAH8CzQgAqvuG
TLSH
T16C750129B3D409F9ED6B827DCCA28911EA73785047A0E79B03B489754F332C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 0943bf27fc0d77899691386f87819253a5ca91e2cd037341d4eed5ee76e0c690
MD5 9a88d6b63ce981bfa37b0b07ae448a16
SHA1 02a4f8695bbaed52b53ee3a1a41256ccd8ef587e
SHA512 b3ffeed127b7bc9099a0db486853c28a6d6c4c54ca93eca06655653d79b489b4d04e48f6b556a37be2f2a2e551d6d580cf5796d051b778a385d767247cf50046
SSDEEP 24576:D0Le5ji0hmxsrMwzQPI9hAH8CzQgAqvuG:DPji0AKhzQPm6YgA0uG
TLSH
T17C95AE16F6748371D073C0B9C5D2A69AED7130821B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4e072b172442b31019cbd263722db2d76015c72beb86649b4e5bbf250725f8ac
MD5 9bb1cca28892cf30532f7dc370a9f84f
SHA1 bae00c66168db2f1247afd1afac91beba86a9716
SHA512 a59cb9f7f996b3d1e7ad5aaa6344c7ce004d37ea16a58930eb9f1bbde3af44faf0eb46844da8cabf961d461924daf2847ded0bb0a3905ad9f974f3653f2ae1c8
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWn6q8wyu+zQPI9hAH8CzQgAqvuG:V/ezSC6vUzPveHjyVzQPm6YgA0uG
TLSH
T1CA756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f17a37989ae1b840571d78a9dd9f764390a6a979bae47164cdb2efd325563a2c
MD5 de28bab3d333d3ab447be5dc0462e83b
SHA1 e017b7e9f4dc9c432fd4bad22b2e995bcaf02c23
SHA512 619290ebff4ab7acc8b483142bcb5227c45cb8a1f2bc5ff93496532b44dc4fde42bf7ac7ac29a6c78be977433c4085f4412ed3322785e17e79939af3ce72ac3e
SSDEEP 24576:uVbqPb88hv/l+YjzQPI9hAH8CzQgAqvuG:uVO88hXl+GzQPm6YgA0uG
TLSH
T182559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 508967e39684aed4c5fdf98616a5558010caec0f97a060fb5a007d7a18ac4b8b
MD5 70d99e27ea3abdbda12aa4cba5780125
SHA1 0aa6a8e66f01743097422fe747684973f6b1974a
SHA512 11e3dd675012d05ae9b242dbda57b92ed1cec74abffffb21f7f5881bfe32225a86b5306e6eb9eadd9e239348db7a392976d2cd5d713ff06325c48cabcde13638
SSDEEP 12288:2f6RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:2f8zQPI9hAH8CzQgAqvuG
TLSH
T144552347F59806E5DF5F0B725C6B5FE2087D8DB43BC0A76702326DA68E7F084E906292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 0b91e0e5c94361a8ac452dbcfe3822ec2e3de7a8a52166b56f02d4a76be5af54
MD5 a66e64a5596805a8e0434f65a2ac2406
SHA1 b64b7aa56ded62849471c7f983f4ba422cdb2fd1
SHA512 c5aaeee9399f0eeff3cf266f59791e951a86e357dd9fb56c623368d325283148d55302d754f9cbcb50ec3a1a6d6605e5ab56d1f284db2cf8dc6752c66e53e164
SSDEEP 12288:NeBNUbTVO86UFRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:NJIU7zQPI9hAH8CzQgAqvuG
TLSH
T13875CF3BEE28FCE2C67E4DB95A918740977278704B51A3CBD135820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 405270e0c133b5bdf61b402997079d10a4c08d68cb2dcbafe6d2fe4474bee123
MD5 dbe9f364784097f4eeda6183a9081a01
SHA1 38152593db8c65bc3ba966d014a4b6a9a0d4438c
SHA512 78965386c85f0c98a6d25bbef58582d5597299278ceb67edc4514058fb984e7c7ccebb4dca68d8a5dc1d31533b54f53c7b8f914043972d15accca165f47d0705
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THO:OQvGAdlCEL8c/DRNw5CQ6YgAn
TLSH
T125267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 3f909662c110cdc6201acdd99125a5b565e7eb16a56b2e28e0ba86ecf720bb11
MD5 b339099b4d5fa5fe29dac983637271fa
SHA1 1eaa1f1107ae78979dbcd2ca24ab46aa7f2c89bd
SHA512 566a8eba181b94a70d1e12739308b299b1e64cf4513fc66cfa23bf53c996dd8b087d07c033ec143c586db3f7ad334b8390bb79fab60e143c4e38a4053ed7fdd6
SSDEEP 12288:yAwSfxL/2Dc3FDLLmt0LDQewsAjnRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKole:3wewsAjRzQPI9hAH8CzQgAqvuG
TLSH
T16B85E031FA74E436C77F0DB21B36CB16187DA9204B912AC3E3B84D9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c18fbbde9dd625fb90c3735ba4b2c4933220ce2ccfe65e6283bda3edb32fffd3
MD5 88a1db999d47156132b7609729621c1b
SHA1 2a419dc1996f1fb0b2726ac031d8e140ef29a621
SHA512 6e4a7d787074cdb43dfb9badaff4c9a5c03810dc7bcdd9c1320fabeae2dca2ff34d86b6df2d933dab8c3e7df8191d52e0f5d6586d1e090aaf155664e8718da2f
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHUp:VUEtQevvqc2W1cpV2tI32Up
TLSH
T12F474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 35b76e777a1d4f8c7d3cceed5ec3f74a6b4dbac0b6828e0b6edb0a8d397132f5
MD5 fab9be715203fcd86ab5a9d1fc02d2ea
SHA1 48bfe7a552ed66422bbd4688e2335fade5bd6c52
SHA512 6d058eb28030a15add24d564edc06346bcc2d557012ea36e30968d0b652303ad245b5151bf3fee2bfa44a98c3de91abc7ed78027914df5bde299304d87aad072
SSDEEP 49152:JCbRquA/m2yL5zTfFiV+XenmE3/zxzQPm6YgA0uG:GoquVjnmE6YgAn
TLSH
T1E0D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 65070c45de49a4e65a7fd679dc10cd32453054d4b5cc04bbcf2a1ad922894623
MD5 4d8ce8dc61a535933b4bccb09d5b0321
SHA1 29d52a9c73d611134ab20b7e9e6827f768bcff6a
SHA512 135b61174aaeb5382d56c8dc74c93a5e5e908ddaa5611a538bae9ba03a770d3b776fa5effc306afa7f0aa7f7a4509bd2ef99366b4b12c81abb4aec8b4f1932d9
SSDEEP 24576:AAhGL3IFoiwtA5l7S53yzQPI9hAH8CzQgAqvuG:AAMUFoiq5CzQPm6YgA0uG
TLSH
T1A9359D81E7F945D4F5B3ABB899B68571EA76BCA55E30D20F2160D11F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 7cd11d07bcde339c0e90b5ec44be1a561e6df85f6da31532005f86a66d9e1610
MD5 0ceade7ac92ff1badbbe967c9b3b2bda
SHA1 8d882dd7f39d82befc2e8d24178ec839c0e41fd8
SHA512 6502297c7b157a4a73664c644a63813dc95f78914744aa12f52e60432cc83033699752f0192e1fa2b2ddc0d1a632b1ac08959a5c17efe023dd78b43ce4404299
SSDEEP 12288:omw5HEjsChN5BFgl0WDm+CYRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:FwucOW1zQPI9hAH8CzQgAqvuG
TLSH
T1BB75F14A76E80CF9EA6B46398557C632E7F2BC112B21D71F0360C65B5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 1ffb74c27182f1826731e3987604b14f973b41c01c192b6bf76d3ac774c68e8f
MD5 a9ee04d0c280d7a6b08af94332647425
SHA1 8008843b90508cf46fc57843b37fe1475e15c304
SHA512 215478d6e4930f4e42afff3bde0fa8ba4b634e732ad7c12aff6398eacfa52ef5888bdcde67213e3eec01bbfe2cf3599bdca59c9a72f2b8b0dbc70b02a8db65a2
SSDEEP 12288:36Z1Iy3RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:KZuozQPI9hAH8CzQgAqvuG
TLSH
T12765128A72E821F9D6AB4379CCF64B8187767861377193CF023106A65F37AC56D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e63bfb7b9d0a1dfa0112e3aee63380736908d71027403679cb8640b1ddc47411
MD5 5d2b0f2bbec4e08d4a056b29b3b3c4a5
SHA1 e2332a683ea73ba6feaf0b78b340156088d457d1
SHA512 22863a64339ba579f1ca9ae97052f320a1605731a037b6c4f1baa96ad766bace2023396816574176e587e31993ab73b5f08eb9360b849cdd5dcaed01854225ac
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ua:1QRQyi36YOcPbLvw2gAf+PN3P6YgAn
TLSH
T1B8666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f6e1a74e5ca18222ec35c71d3c828e12b0626dce88dce7879bd6a8bf61652052
MD5 64d17367c8387ceba10144994e4be954
SHA1 107368946145234ebc0e0cdc45374ec1151288e6
SHA512 e5edcada48407238151f8fd3cc7f2e2608be63f58247d6cea4c51098523bb8c76e936fbdd2f887bcb3269612f7c209f39f3814194e991578a5be6bc201992a8d
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ua:GQRQyi36YOcPbLvw2gAf+PN3P6YgAn
TLSH
T175666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c170d63d457d572e2d27aec2109ea4540cccc215970921574b908dcf62363297
MD5 e5762d654d92e9b4827d5364a1d8760f
SHA1 f0a7f4fc82aa46d3c53e76dae7d533ab8014d599
SHA512 d27f0dd72e64e673aa1fe50242cb584ec7737487e98aa0c08c771f8ad8764d2ee9e538f885530c2c53d9b1b23c67071f194d85e7ccb4cc87cbf4d2e5dc8330c0
SSDEEP 24576:VwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL04zQPI9hAH8CzQgv:R68Qg55nhceWu7PNU3/hzQPm6YgA0uG
TLSH
T1DFB54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d29ff46216cdbb53798cf23334cd030ce710e7cf55766d452e2fcfeb4401aca6
MD5 e36defae875b042675e391f8637116c1
SHA1 bd50cba5665f07b2f81c0f86b2eb68399c457bab
SHA512 446b15370595c4be01493f510cddc860a9662eeb8e70e42aac19679479680a61cb5834d4de1084cc40fbae295b06ed7ac954c38107cb6e3b1ab681e8ad6a1485
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99o:ry5112gYy5azzVvt69nLKnhZ26YgAn
TLSH
T11F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d41f03bd2de14ecc20cf90950be26a12fba134ac8b6cbf8ee547d15042567890
MD5 f412ae35661b0eb50dfedcf0659028b1
SHA1 cb051a262033d419ebbb1027dd71413887fa0798
SHA512 5714dcdd0ed784b105491229dd4c56b890b15c90e67819301bc68312bd6bca936214f7cfa105534233eb9d29cbb46a4931eb5b599e0962b2c6d9e9ac6a85e6c8
SSDEEP 49152:7B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl3zQPm6YgA0uG:tu6Jmdxd2dn6YgAn
TLSH
T1EED59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8346887a13e91c3f659518dea08e9d11f21df954f71c34aaee4216d6d833d477
MD5 4fb98692565f56d8f9932683211074f9
SHA1 df55e24f817c80d4c4e79390aa5ef8570978138a
SHA512 3850c94cf435822f119791e131ca0e9df1047d9ce90cad9ba798217d90c610dfcce4e949aa4c77bc5e056238fbe017cb939e662a7a2e25ad533e2e2a42467c92
SSDEEP 49152:I1hpsNoJpF1A63U44CwH7R4xbzQPm6YgA0uG:ImifPWRE6YgAn
TLSH
T17EB5BE13F2D801E8D06ED17887569632EA62BC450B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5e11c3e66e5efd5dfaadb03a6863154bc60b959b39776cd51dd88ca094e9f16b
MD5 864a9540910c45b7143836190c6efcb7
SHA1 170b13fe8f6a4772d9f7cd2d7fde65b820e15fd9
SHA512 3fbec3e52e6eeef73362dc28577553a294e815896fddef0ce628a9200eda96282933bbf799438281687ee11e75667d87c05d5fba0015929b242c632398d006af
SSDEEP 49152:eSuZQIY0Be2KcRVtOnks6NMHqozQPm6YgA0uG:w5dKii61i6YgAn
TLSH
T169C5BE03F2E901E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 69e3c174df3317f4cc0e61b6af2a2e6d6a1aa93f46d6a7db683d72b01e12459e
MD5 7ce9885ee02c7a8f4c3d352046bcd6a2
SHA1 ca447c71e780388f7af9786bebaf86b37b7cf5e2
SHA512 2aadf95cbe19dd9081e4c8f19c38eb809f4841bd49131cdde0da81f0216487bc24cbb30219306a40f22251a82315f265103b51bea1bf13fd1597c8d3b9ab9158
SSDEEP 49152:uhtSn8EApI0fig3giDn0AP5wnzQPm6YgA0uG:vX2imphY6YgAn
TLSH
T10495BE13F2D901E8D05ED178C7568632E962BC150B38BAEF0A50B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 ed4ffce2d9ebe0be047f0f1172f2b4014c762c880b5ada6f471d768a52127f95
MD5 ea30f1be2816cdace0339d5080763736
SHA1 dfbe75f7848147a09099f122912f66abf2731faa
SHA512 7bbd3d1219885b2bbd72d25d50ddda42c041883a8c4c2db79d024391bc6e475bdd8fb4eea6c87dd11d3ed9f6419d3f5111d2a1bbd6ca1257f7dcc844c85687f2
SSDEEP 12288:jSRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:j0zQPI9hAH8CzQgAqvuG
TLSH
T11555234BF4980AE5DF4F0BB3486B5FD108AD5DB47BC1A37B123218628F7F5C8690A291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 7d8f2ce94ff4fb6da2a98ad56d708328e2109dc147e9f53dc8d3e9f1b6c5f137
MD5 0f8085fee7252c64c3dd9f251580d301
SHA1 ec1be908027eaaf1759296c758f1f22e170d150e
SHA512 e01e9c9e0fa94e6ddfc2c0b7d85e0e61c2526677cdb20b9fdac419ef8c81f99f67923dae1ef4b21db1a73171fe9706d30944af90a1532163714651ea96ab4e17
SSDEEP 12288:fDRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:fdzQPI9hAH8CzQgAqvuG
TLSH
T13455234BF4980AE5DF4F4BB3486B5FD1086D9DB43BC1A37B123258628F7F5C8690A291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 9d1cda3bb94095b6d6c3d2d0740ea1981556daef58bfcfabfc49fe1703984394
MD5 68ebbc5e8100a7474a898db198b6bc1d
SHA1 68ff9506853c57cefdc6a5a4c6811b658532b389
SHA512 f4c7b0096d9278aad62356ce61bff4f80d82d1ad9c80f034703fb28c84a29552cb99c41f18a428894f81e441eba7554a73ed67d66ccf76d09a87dfe3a64a7d2c
SSDEEP 12288:c9RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:czzQPI9hAH8CzQgAqvuG
TLSH
T17D55234AF4A80AE5DF4F0BB6486B5FD1086D5DB47BC1A37B123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 29f9aa3ec3b2447c8ee1d0cd669320ea5d3bc852f7aca10af19a4c249fa076f1
MD5 35b15d22e0884a8a87b58e93811d4919
SHA1 c24973046756a0e8dc12fac1958e07b13b4d9a6d
SHA512 542813cc0fb5741ae28a753ab9d6b90cca8d91a427e4154ff0011e2966ef7b0b4ebb6696e23e595ff8b76a0f69be944e48471fc149c4725382bac528942bf87e
SSDEEP 12288:KV8RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:NzQPI9hAH8CzQgAqvuG
TLSH
T150652346B6A806E1CE5F87B688774FD144BDBCB47791A3AF032208A64F7B2C4BD15790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 7532b87125fc8916d6a53b5fe05af49cec11883f8e3aaef693ccd75edb08baab
MD5 c233abf57a13bd43986e108491042388
SHA1 2aaf72b981846da3bd20a30f7936dff687317acc
SHA512 2196ea57a4662b3be6861e4b7895cdfe3ad27dbc5f3c527ec9b24e9f0851e5de0f480f9901b5c205494ddb59344470b9af7307f9d93dfae7b946a4f87e6e67e6
SSDEEP 12288:XkRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:XazQPI9hAH8CzQgAqvuG
TLSH
T15255234AF4A80AE5DF4F0BB2486B5FD1086D5DB47BC1A3BB123318628F7F5D8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 6e22d3edee1db2d2ab4eff0fc962f2798e86f61d81dcad1cbcc942dd1cdb43fb
MD5 05e120a0900e326207a7f7f0e8c86528
SHA1 b4be3d00fd2e47d57607115407d8e1aa0554bdf1
SHA512 8b10c6516bfe1f8605b32846eb597d3c7c53ec2b379e3eec4c5d8104771eab0d1f2ac711d0bc42128b078526085724e36530df02ba69329913d65dbab012f4e4
SSDEEP 12288:b/RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:bJzQPI9hAH8CzQgAqvuG
TLSH
T16355234AF4A80AE5DF4F4BB248675FD1086D9DB43BC1A37B123318628F7F5D4690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 fae9be7b1223a7d647ac39a14a985134ea692afb6f73270e06d341ee3f5342f9
MD5 140fc17015ba4c2f0df09e1b5a5035b0
SHA1 19678839bbe4cd62746cc4f58a71311fd9f06af0
SHA512 31e54b36339431e07c73c63dfcd7ffd8e29b3a49f033705609cf43fd757a757ab0305e13c191ac47d76c0331f9042873ddd18132822d971ea4d98f7a8fea2e47
SSDEEP 12288:+rRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:+FzQPI9hAH8CzQgAqvuG
TLSH
T10355234AF4980AE5DF4F0BB2482B5FE1086D5DB47BC1A37B123358628F7F59879061E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 0cfc8cb733f14a88edc30611fe19581c3dd965f5bb505795dc6e2f49bd106ae9
MD5 726d6bc02edb195ef9888829282ceb16
SHA1 2c743c0407353197e5c1160eef4ba43f9edb527d
SHA512 e9e9dde0791c54011717e5bc5f6c3cbd1637e3f87f4c35d8248ef11408307f5e44539710926fc7a639d45dd228ef7698c72677179c41b7f962f4ba771a7e82d0
SSDEEP 12288:CiZwbJzzFEoS2cPvyjRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:lZMNzFVSO9zQPI9hAH8CzQgAqvuG
TLSH
T188750195B39008F8DD67823ECC268E52D5B27C691BA0C61F03B436675F373A11D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 543bcc780d5c67295830cb4916104d43ab64a246474f48ef45b9d2c791b51685
MD5 bed6360b971e5d8bd4996bd15e949d03
SHA1 3be736ade54302b802aec2b8c22ea020574c7f25
SHA512 7b304d5241bdf115c0aa11cf178bcd1c0153c6fef8717672c1c04e227228cd7fb0a6962e1e82eb10b764a64b24d24c9b11bd41d9b9e037728ca636ef31cf09bd
SSDEEP 12288:HmRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:HYzQPI9hAH8CzQgAqvuG
TLSH
T1AF55234BF4A80AE5DF4F0BB648675FD1086D9DB43BC1A3AB123318618F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 aed8eaa74e3df90d7450eba5ac283d4b4f2f088c5e2a083bc69772bfd89f06a4
MD5 f5a624e77d4484a2a82abdd197ecd6cc
SHA1 059703d96abfb52c8d3a9d0acecdcf43e30d8ba4
SHA512 cbbbeb8a59250bfcc653445c24f3f67bd214166ef7f969b801ec71e9a63d2518d295aa9f8d0fb3cee564ba754e72c7dc86c9ab38155f4fdab729d5369923e487
SSDEEP 12288:hKRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:hszQPI9hAH8CzQgAqvuG
TLSH
T1D055234BF4980AE5DF0F0BB648675FD1086D9DB47BC1A3BB123358628F7F5C8690A1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 599a505f9a37f992a53403172b3dc5baf10369a0e0d00349fa758478ab39ee1a
MD5 ec8e7624dec604ccbe10cd6c5ba3f523
SHA1 f73bfe8f9a4317f21be1e41dd36760ed56fa343e
SHA512 230a2791ac18ba0c4fc08861598d4a28a97c7b12c2c4015a6af8aebe6fbd20b6a976feb9de3a5c509cf0be5fd6220d84c4bc3f088861ba638328b595e368a4d8
SSDEEP 12288:PyPz5L83RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:izyBzQPI9hAH8CzQgAqvuG
TLSH
T1C8650247B2A421F9D56B8339C8631F82E776B87117609BAF136006761F376D0AE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 5e741e319efbc5499ad687af596460960ba6917ea14d4d74750c88d731c5f253
MD5 7d68f8051da8dd054e80ce15fd8528ba
SHA1 b3ddb3bcb73fee2f2055ad1d88e0a2007bd4c581
SHA512 4a1f07ea5bf86870b13bc28b42b26803ac687f04d78b2167c2ba3c89a17c186b5f444745d687c54d3951040b45d04e6ec53cf6eaf2cf07cde424a8ac2d621886
SSDEEP 12288:HmRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:HYzQPI9hAH8CzQgAqvuG
TLSH
T1DC55234BF4A80AE5DF4F0BB6486B5FD1086D9DB47BC1A3AB123318618F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 810ecc37a5c1c3368a71dcdfcdb2bdaf8fa9d91e92bc1158720ffc83de2180c1
MD5 c6040a289a13558967b6e280569e4cae
SHA1 07090b3433089258b513d2dd6eaf4098986a24fd
SHA512 54edf4ffcce48528808c85fa8d89a898b69f2df86760f6fc9320f8e9d61d1856703154a6d5b6bebe282b1d4c146e0e1a194e7e3ee0ccebda38c1957fdfd4dc83
SSDEEP 12288:4mRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:4YzQPI9hAH8CzQgAqvuG
TLSH
T1D555234BF4A80AE5DF5F0BB6486B5FD1086D9DB47BC1A3AB123318618F7F4C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 d55d0fd8ba85bcbc21f600acfc45bb7f9f0e3c5f27b31ba2c179e0a8a73f5ebc
MD5 5589353a41501c230d18676d005f38c6
SHA1 5ae7d4d487fd0ce086d388111da952bab56eb3a1
SHA512 9b5183b9902b427985ef656b4b5b7be9a7115b0598abf1096413a15833868c63db5d5c9eb71d856bce3761174ed6315c62d9f926c76dd34a8c94fddc5261de22
SSDEEP 12288:oyPz5L83RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:pzyBzQPI9hAH8CzQgAqvuG
TLSH
T119650247B2A421F9D56B8339C8631F82E776B87117609BAF136006761F376D0AE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 efeb485622b07d2d3f3cd5540a396a264e878ff7965c2397f4eee405d70509f5
MD5 5c7c73654c7c5186de5b754bb3eac563
SHA1 eb15f819679e9bc59a36807a955a93cd1608b90e
SHA512 bc254b9150406834679a24d3327e214e228f9b627b3d012a8bd3e142456a394579022a292c39d9565fff644d93d4189ec0823cf9f670b273b47553e50e572687
SSDEEP 24576:+cP4mcvIjkGOxhKP2l71SNKbrh/8KBAzQPI9hAH8CzQgAqvuG:5P4m4IpOO67N8KuzQPm6YgA0uG
TLSH
T1F565BE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3d150fb7ced693d9b3df5a159dc7204bf93e48d043b8c4bb3adbc7758344ca14
MD5 76f23c9b2e2868a54967e83662ed5f4f
SHA1 968fb751e1b784ea349230a233f8881f0a394e06
SHA512 34ec7931cfd42bb707f37358da61e06cce769235d0000352ef1c8fdf5f54e83c9aff54fec5bf8f099ff7de1783219bf9fd0f11e5b590534104a243ea31162e7d
SSDEEP 12288:qPsfWRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:lozQPI9hAH8CzQgAqvuG
TLSH
T14565F10AE29802E8C56E5276CB564A81B3377C6457E1E3CB13D0F47E0F7A590ADEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 2b187822d3d82b7931a1a4656c1a138229c24539209cc1f605ec85327777f556
MD5 274d363c910b8d59def922f01436fa09
SHA1 50f438506bcb92f00b3308be8a66f30555dc7733
SHA512 ab7be5941e5935c1043a7b108eda74c53403fb3992b48ab93f915ceb398963b27961190c04526e2c8b5298642ff2cd7bcf0d8a558d6915e347df2d2623f90814
SSDEEP 12288:e2RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:eIzQPI9hAH8CzQgAqvuG
TLSH
T1DE552347F6DC0AE6DE6F1BB248278FE1143D6D743F80E3AB222218658E7E4D4AD15252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e79a24f0e98b95ccae8ce5e2c33e9a94e3501484cb86a6c627e252f07688d0ac
MD5 dbc8870dff7ffd18772c35a59e231d6a
SHA1 f94f77e562e1cdd94004ccbad1ecc41970e0b6ec
SHA512 02cd9513c7e412bd5a8be8f62269bff2fab93305c2a169be9038afd9244b951c8276ce80a686786297c6a79abe27dc44cbbe2ddaf79b56cc4da62c5c7881759c
SSDEEP 49152:Ca0h2GEkuAe73q3pp46zwwQazQPm6YgA0uG:Ca0hNYG4Jw56YgAn
TLSH
T12285AF1E67EC82B5D0BAD278C9A6854BE6B2B4220B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 86510cd0f0423d8916e50573747b60e9fcf88550e0f7b3110035d72c327bc15f
MD5 2e120cb207b2ea2d331644784042c47c
SHA1 dd0f263c66015f09a9518560e1c489b6f1748f79
SHA512 c73363e370d06d3cbf32f731af7ff25934700351f803bb2b28a61115b32ef1d4e36029009c898fb7bf68ce9cadbd5c76f21fe2ae260cac85dbd7d6238f3a861f
SSDEEP 12288:uhbHjfXzRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:uhbHjPtzQPI9hAH8CzQgAqvuG
TLSH
T18665126E66EC11E9E676937D88578A82C331BC342711A3EF13A2817A4F3BDD45C35B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 82277ea92e2a45b8aa68b26e785ace6577f258643b9408904cb06252f1c3c0a2
MD5 e75977d045515669745f2d3c5ac06ca7
SHA1 0dd8fbc97105d2e5fc7289f49649f2b65788212e
SHA512 73c2300afb816f6a8f97b09cbeb727699e20d96c6e71af82a4659b1a5089af30ccceb95b2784d89e3808122ac7c79b166d59f07893bf948dd4498474ab82754f
SSDEEP 24576:R3YgnJcRTk4yti+R5dpR/1zQPI9hAH8CzQgAqvuG:RIgnaTk46ppR/1zQPm6YgA0uG
TLSH
T12045AF2EF2B910F9D8AAD236450147B5BB71782D1F209BCB0170C538AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 085da881ef81bbc210d1e0b813ee3e7628962e9e72882b170b0ba84e7f034ffb
MD5 e1283341ca1547348e4e9d2b4776a477
SHA1 5e3bec422d2a04d6fe9f4d41f909087fe0e7fe5d
SHA512 d1f9aff77ce1a4300b6efc3c4ba44840b0b8c9b7b6d5b159f3be54e9fd60dad28db478431f5083e8e7118a0c5982528de416e4a310f9a10283707f178c6791cd
SSDEEP 12288:iaRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:iczQPI9hAH8CzQgAqvuG
TLSH
T11355234AF1980AE5CF5F4BB6482B8FE1046D9DB03B8163F7113358A28F7F4D9A925291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 92e27d6986a0e5f119740a6a165f4d484246f06f038dd8b4a0ca3e86ba27b0f6
MD5 8ad83497293331b42245d8abfba1cca1
SHA1 e05255070c76f9b0639d152b67098f10e4e249b9
SHA512 c4919e276ff479d5949d6ba91cea6eb9d0375bb81b68eb6b8d30aa346962447d6fb0680076f9ebd7529eb659cda58133e4011b954abd32ae61e39dcae8e8880a
SSDEEP 12288:9Ob7A4LWOsvAYFTxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:avL3UTnzQPI9hAH8CzQgAqvuG
TLSH
T1A585F145F7A400F9ED6B823DC8678A12D672B8AC1764E7EF03694A651F237E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5f9abebbec64bc7915d9a3c220a4d3e7fab916025a0930ced92896282bbd049f
MD5 14c0770f62c1038584c66946b6a9de9b
SHA1 ae82ad80a2ca661f295ccce52cb32db8a850722b
SHA512 42678a8430699fd8087ba1c682ca571350f8e3dd0e035341bd1c5062c3c0cf2d899fd927cf2231c31000286edbc51f7ef80003f34d5442944213739c0f794143
SSDEEP 12288:dpFt0OlRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:wObzQPI9hAH8CzQgAqvuG
TLSH
T14C65121E32EC10E5D57A927D89938789C375B871175163EF02A080BE4F77EE86C3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4a9bc817b6d18429d4f111724c151c2aaefa4d2a69427b29ea6c7e1a5fa5895e
MD5 ba4a30d8164a66ae8182a3e8bedf1b21
SHA1 5a038869b1330cd4a35a0c89631560ad8ba23ed4
SHA512 bc356043c95d7eccba60486d1f7ed0d79483719f1d96b2eedc1bb7e12813c6b36024370c5024d45fa84668bd538f24802631b4ff2f97d1ae5f81d80fb321fadd
SSDEEP 24576:u7NM9YmZqmWMUkPjZM48Mv6bEhsYzQPI9hAH8CzQgAqvuG:u7cBWMpPjN8DbEhNzQPm6YgA0uG
TLSH
T17365AE2E6BEC81E5D477C13DC9A28645F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3dcc197110eb81a24402d718d0165221a460ed9b0a271c4f7ffba2f2dc555554
MD5 2027d037c7c8a6757552c49e7b593839
SHA1 93541721d77e2b8f917200c0edbe4d846b8dbeda
SHA512 4091bc41e2f898b85bf0fcd2b80d1efbc572b58dfee436ff41249beaf6de932d3606479593a7f1a5905ca606b1ee71460601531a480ff120554f0e437f432332
SSDEEP 24576:nW6BApg2YuyuNDYTabvcRvNYf8km1GzQPI9hAH8CzQgAqvuG:nF2YuHNETovcvNYf8km4zQPm6YgA0uG
TLSH
T1A6858E2A67ED80A4E0BBD27D45B7D286F9B2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 42d473fbf1cb8bc205e669e5321d86adee6dc4cfa3a20ec2c063b377897f40bd
MD5 03239f971128f07ef72fbe198ec095f4
SHA1 2f06e6adff99bfb9785a27e02a88962d7b7ebd4b
SHA512 1e1ef01537923a23dd086e60efa1fd587d7b0055e137b3650ee894f26dcdb630b4bc0bc231bb7cf85a70770fd0d76408849c4ccd84b86302eba4e75d075c03e1
SSDEEP 24576:jAFs06+OmlfkNXEbTofzQPI9hAH8CzQgAqvuG:sFs060lwXu6zQPm6YgA0uG
TLSH
T13265BF2F62EC00D5D07ED17E8997C916F6B1746307256ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 e222f316cec94b5ffefbd0559fa75d2c1af1eb4d6d6b5b4c9b1bb16c14237bb3
MD5 3c80929dad0f291b163a24512e0ae56b
SHA1 d548e2856934f9784a048e2fe8529a84a5e193c8
SHA512 2a720a2eca008bca504a995764e9453dd39fa74f9965bb884318d57974791824d83266d37290a2345b7066f28ea747ec3d56f074a665881d6444d7a0835b7f5a
SSDEEP 12288:CCJnJ5D3VkrYzxGRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:DJnJ5D3Wc6zQPI9hAH8CzQgAqvuG
TLSH
T1D085E12DD2A810F8D4B7C3B4815A1B96BE72387D2F226AC72474D4357F12EE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 161ec405a250cd7d8ea86a54082a13cb37ec09d4bba2a7219134ff0f63edfcf5
MD5 86bc23e555162c377a7b4b8e3b057c24
SHA1 d0650c4f7b5321cf864ed30086ddeb22ea41c440
SHA512 ecfb947e85e756d53f9f2bf4c4ec6ed6b765050baf12730daee43928ef33fd09c14e805f43e3e3e37a94f78b2a158ca4c23cac9ee4b3f62715e1763393995b22
SSDEEP 49152:2o06DIKdwc+eQnSt65aV0zQPm6YgA0uG:Po6YgAn
TLSH
T1C4956C06B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 6b664c35e03d8e47a1d28f95ff0cbb052e659ad6865f516db7d044a890318967
MD5 b786584f5a41067904fc8f39e14a7196
SHA1 7dc3a2a5ea3159941148e4b7e4f23118f6e0b0a8
SHA512 68732707a40e0d1973ef2cb6877c935c75fff8b48c7c574f88581365ef5efbe2b0932ded3643abe7738a001ac13e725c1ccb2c912cd28272075800c153446335
SSDEEP 12288:tEP3RvYRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:OvezQPI9hAH8CzQgAqvuG
TLSH
T12D65125E77AC20E5D52B927D84628B81C376F4702B4267FF0261817E8F7B9E82D39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 94106461fe7e9adfda947ea4df27c26e3824877b2c3df7197502d07da1a0220a
MD5 96e48cd9eacb44da1b49bd31b43b448f
SHA1 6dd0b6db8168b5a0a63a92738bf66160082074a7
SHA512 f0a07d84df0c74121106adc9d06c70411e555557969f280ee55fc268c877e89e2151c74718cafde951bc02ae698ac93ba6650ba0ce3c5c0308e28be0d96a447f
SSDEEP 12288:bjkyDRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:bIydzQPI9hAH8CzQgAqvuG
TLSH
T1C7651209B3D811D4DABA0779897387E14979BC302F10A3EF1161AA3E9F3B6D4AC35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 2944ae3161b31f392f60ea89fab9fb100088de3e204ca1ab9a72cc8af805ffc0
MD5 255478d31bac1af990b5920a4de2a8ce
SHA1 8d2e85fdd6e17debcedbc93fb39805bed9938e00
SHA512 e394e12a1911a365daf4dd3940c78469ac5ef11c9c9270288a4439d01c07ec0740516ad29ea56e37e9bdddae285743cef2a6089b38c9bb541f2d55b973f9e288
SSDEEP 12288:6x1RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:0LzQPI9hAH8CzQgAqvuG
TLSH
T14B55224EB1A816E5DE1F0BB6482B5FD1047D69B43B8072FF113298B2CF7F5C4A926681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 11789770f604e73d4a52c09d526d76f023e5b9de473f6d8a1dbb1306b79bbe8c
MD5 821f050b6654cd0bea76ae4213d7b4e1
SHA1 a3359d62fb71a8aca3aa0ed96dc1194f965bb0c9
SHA512 0b85ec064388a06fa15c734e37980892612b909862bb779240bb760e11cc5d95160d37c7f1a331ff4d209b38b2b8bc18dcfb5c2973e591978be433376a663ec0
SSDEEP 24576:bQ9MxZKdcz97w3QzQPI9hAH8CzQgAqvuG:bVKXQzQPm6YgA0uG
TLSH
T19B557C2DABE9099AE177D27594A250C3A673B4301B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 057ce7d6d202234b603a954ed482e986f9c7141928d722bc688db9356cd1b20e
MD5 f6f2672844811a6d8a3848217b72a119
SHA1 7919536fb31483b0bab0590bea9109995d521d08
SHA512 4ca2b6fc70ea43546a1c0a8bf1a3e725775103afa2c61fd94c7bc4cffc9da3e71d90e154da88160a20d87a8c9b70497b2fd1c0eaa2ca3d5f48c81a498dafdac1
SSDEEP 12288:oyoKo2jRple9pnRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:oyocFApRzQPI9hAH8CzQgAqvuG
TLSH
T13C75E00FB7A900E2E166823C88868785E773B0702B5263DB5291C73D8F779E9BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c372a1bca4bfe4c4c8325ab427541e7ce0448201b695758d9495a53bc627bf61
MD5 61eebaae52b29bc4b066854823b88c29
SHA1 3bc39ae013254f2b2a54574f17bee11f39a56183
SHA512 756904596c0db00ac7705316aab89f5d7ad69b2b009e765da936a24720f1a4b0d89cdd5d83067ce47d6a9575b3fe2fd616f3759d95f0220526bd1a1a6164748f
SSDEEP 49152:0WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKRzQPm6YgA0uG:e0zuNIl6YgAn
TLSH
T183A57B3DA2BC00A8D9AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 760e286e3c8eceedcb6e764c946b20bedbed948bb6c2e85cf37143a6db910343
MD5 f7643f95e235deb7c0da7a81f61c6507
SHA1 83efd758fb019299cd04c37660c219c277efe175
SHA512 b8c98685608692072416fab27d35997d5ebfd0cf1483273a4698e941de6393bdd248ac73aba46e3726c945114bd202f4fcb97ab05cb52a4b9d191ff5503a3181
SSDEEP 24576:h1QT7EcpfxR+N5AWAz3ooiYujMqbezQPI9hAH8CzQgAqvuG:kTDxR+N5YzT4jM7zQPm6YgA0uG
TLSH
T13955B02EA7F815E9D17E86799A23C512FA727821033193CB4260C17E1F7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 ffc1d5460324d7e9f7433a948a10b9db94266484f354e5d7f9e153bb502c591a
MD5 f87f82c22825782d95b896c3dfa3cbc1
SHA1 da22708f8b489665a37fc029ffcd0812babbdd8a
SHA512 b68502d4c0d9dda71f7805896fa3efe9eaeeaee97f34f595e0ccb91d339cab86397aa354164e6e24905d5cd136ef0784f3293a8db15b0082d0b00aeb2717369e
SSDEEP 24576:OTMdOz0FFS+/mSLSzQPI9hAH8CzQgAqvuG:60K+/mSLSzQPm6YgA0uG
TLSH
T1BE75F13EA3AD14E5E57FC27D9A538E06E57234710321B6DB06A0C0792F6BEE47939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 1c537b319df355dfee39c75c2cce3dc46c6d73756ec701fac3436fcaf4cb71eb
MD5 150287cbd40979a045e0c012d4473d49
SHA1 7463a5290302cd8e4f5bf5ccbcc6dd8df10c0f06
SHA512 ad4d6b625c8b113b75331f9bd468d66ea6a12fa96c1adef304c33e8fcfdd4bdae8fefbbde01cf0159fa2a22da752aa529abd2d92e8fa68edde7465d648e29078
SSDEEP 12288:n4/xRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:2nzQPI9hAH8CzQgAqvuG
TLSH
T10165120EB3EC20E4E96B577589374B924574BC70275067FF21A1C8BA8F3B5C4A939B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/636-72-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/636-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/636-74-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/636-413-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/832-141-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/832-134-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/832-463-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/832-135-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/840-104-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/840-22-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/840-23-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/840-14-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/984-476-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-475-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-479-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-486-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-480-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-478-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-481-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-482-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-483-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-469-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-484-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-477-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-472-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-473-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-470-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-474-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-485-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/984-471-0x0000019BCB9E0000-0x0000019BCB9F0000-memory.dmp

Download

memory/1388-399-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1388-51-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1388-59-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1388-57-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1596-112-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/1596-457-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/1596-111-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2052-28-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2052-36-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2052-130-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/2052-35-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2052-34-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/2452-458-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2452-125-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2452-127-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/2452-119-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2488-167-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2488-414-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2488-173-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2716-77-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2716-83-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2716-85-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2716-89-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2716-87-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2968-407-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/2968-194-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/2968-188-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/2972-198-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2972-204-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2972-209-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2972-207-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3044-92-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/3044-99-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3044-456-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/3044-93-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3172-459-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/3172-132-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/3244-47-0x0000000000A10000-0x0000000000A70000-memory.dmp

Download

memory/3244-41-0x0000000000A10000-0x0000000000A70000-memory.dmp

Download

memory/3244-40-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3244-62-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3244-60-0x0000000000A10000-0x0000000000A70000-memory.dmp

Download

memory/3884-178-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3884-406-0x0000000140000000-0x00000001401C6000-memory.dmp

Download

memory/3884-184-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4004-157-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/4004-163-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/4004-404-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/4116-464-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4116-465-0x000000000CEA0000-0x000000000CEA8000-memory.dmp

Download

memory/4116-258-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4116-284-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/4116-300-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/4116-268-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/4116-412-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4164-227-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4164-409-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4164-221-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4592-247-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4592-411-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4596-462-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4596-461-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4596-151-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4596-153-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4776-9-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4776-0-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4776-71-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4776-10-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4828-211-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4828-408-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4828-217-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5092-410-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5092-231-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5092-237-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download