5f24f26e3dad3245188937e1f1871de6af9a333e71ca8ed06ffaaacab9a43a5c

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 1.9MB
Sample260811-lctmgszerf
SHA256 5f24f26e3dad3245188937e1f1871de6af9a333e71ca8ed06ffaaacab9a43a5c
MD5 b4fa2c3c83902e8ffdafbe3cd65a57d6
SHA1 eb25ba50e1234928a1f03b0bde1b15110a1e6f45
SHA512 940457ea232ef08d6381fb2d5947b0b4496233e8ee77f43f0802c8607b8575d213b09eca2605d62cc8c880ff29515f92918a4b537ccf14109a8303704abc30af
SSDEEP 24576:rx+SoVjfoMLsFGko6oTg0FuhbzWMdqOZqbYkBhYHpdzQPI9hAH8CzQgAqvuG:rUSosUThub+OuhgpdzQPm6YgA0uG
TLSH
T1F4959F16A2F802FCE0B7D3B9C9754946EA727C054B349ACF07505A5A1E37ED08E7A723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4532	elevation_service.exe
2608	elevation_service.exe
4020	maintenanceservice.exe
2312	OSE.EXE
5224	PerceptionSimulationService.exe
4184	perfhost.exe
2036	ReFsDedupSvc.exe
244	SensorDataService.exe
1276	ssh-agent.exe
5516	AgentService.exe
988	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ef2c062ee05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\ExportRequest.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000986da4667329dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac4eb62a7329dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c74d8d287329dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000777917287329dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019046e667329dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	5516	AgentService.exe
Token: 33	988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	988	SearchIndexer.exe
Token: SeBackupPrivilege	2036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2036	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2036	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2036	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2036	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2036	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4532	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4900	2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 3420	988	SearchIndexer.exe	101
PID 988 wrote to memory of 5328	988	SearchIndexer.exe	102
PID 988 wrote to memory of 5452	988	SearchIndexer.exe	103
PID 988 wrote to memory of 3172	988	SearchIndexer.exe	104
PID 988 wrote to memory of 5576	988	SearchIndexer.exe	106
PID 988 wrote to memory of 3632	988	SearchIndexer.exe	107
PID 988 wrote to memory of 4480	988	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_b4fa2c3c83902e8ffdafbe3cd65a57d6_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2608

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4020

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2312

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5224

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4184

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:244

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1276

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5516

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3bb80d14e36ffa6d5be1e939231281ab135753fad0e8e8d972a6bb4586f002ca
MD5 3e13d434c27bbec34232bec714621743
SHA1 44ca0d707ed3463290a6aa64c9b5e8d19821f426
SHA512 3930e91256324524396098e943e4956473e8378f96a30baee36bc81a1f294a3930ac928f8b3e38b283b6eb8daa994e4cad76cdf1af823f994eeb7fd4ac65b50a
SSDEEP 49152:tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnmzQPm6YgA0uG:z3q6sjBd6YgAn
TLSH
T11CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 31e65088b094cf0da33c7704b6ff6472170dbf2837be5ec5a3314c39021c5f45
MD5 28e56a5fa3c001320f67ed1c972af5aa
SHA1 c39c016406fa8f8920410799032b9379550a36a6
SHA512 58084569fa7e63e9dc25d05b5af392e66527c4ed77ca722ec4092fff21d2e0a2ca2be4de161e6be46219386a6e824a46e64954342f4716d3c5d87e07071bee45
SSDEEP 12288:d1XLsswWkxy2lRq2czA3RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:TXYfDtczABzQPI9hAH8CzQgAqvuG
TLSH
T113750129B3E409F9DD6B827DCCA28951EA73785047A0E79B03B489754F332C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 ff64858941983244d5d4d1e3fabf2b9ef9be634417a4442f37d720def85f52a0
MD5 a0e6c2fb089084a6a6ebd4f04902e76a
SHA1 b52bc3e0604977e28ac8a66cadcc80b92fc77770
SHA512 72c5623b4e2f95949217e24280c3d90abb21333c1450455df792e58a5286982dda3bf37fe1b2b457cb1356d54b4d9a8517637917b77dce8215b024ed6a50f0e6
SSDEEP 24576:d0Le5ji0hmxsrM+zQPI9hAH8CzQgAqvuG:dPji0AKnzQPm6YgA0uG
TLSH
T1FA95AE16F6748371D073C0B9C5D2A69AED7230811B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3530f532ad624b68de669f4eb58dd07d8cfbaf758533f7d36c299134d4485675
MD5 e879cdac2accbb19c0271f3124d00a41
SHA1 aeac53e6ebc27ad402b06c0ef1f89ecbf26312ec
SHA512 65ebf0fe179c7b1eb6d6874db584b31dbfb9756d4beeac3db4ab16a88d69e329bd6fcbed3eed04aa8f21a83ae0b812741a0369b7c88873871d4a4aefe563fa12
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWn6q8wyu4zQPI9hAH8CzQgAqvuG:V/ezSC6vUzPveHjy7zQPm6YgA0uG
TLSH
T1AA756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2ed44f135ac98176eb856874db6b80b58007a74903cdf4bc726f4a3b17623fd3
MD5 15cafc40c1ddec13d7e4a6f21a1e4ef4
SHA1 af915836c2177cd52ae8e2f7bb18c6ee779bd3f3
SHA512 04342aeef99bceb3280c3d0a406dfb0806dcd43394e3d51908ab5437e62da612da442ca6bd60f2eb6c2b63ead8ba0d699ce4650438f01810eb36a6c8e83ef8fb
SSDEEP 24576:YVbqPb88hv/l+YtzQPI9hAH8CzQgAqvuG:YVO88hXl+AzQPm6YgA0uG
TLSH
T170559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 1bbff8726fa8d8c32fb0be38905f31cda2f7f6954fa372925c8b1d13eb2afc98
MD5 c93c5e316902ed2666f7f308b8e15d09
SHA1 d53b15e3a1ea04d4da62d5e4a365ae871b86c18c
SHA512 c60651ea148e8beaffb3e3bff5968c90ff58a580da27586e73843c19ec0b47e6044c88ebaf67224ff25ecd4588e77b694558a0d7861a725a9ef38c79b9b9cca3
SSDEEP 12288:bfkRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:bfazQPI9hAH8CzQgAqvuG
TLSH
T170552347F59805E5DF5F0BB2586B5FE2087D8DB03BC4A76702326DA68E7F084E906292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 c74b2d51c6725f329e62063b0983139e7bc72e4e27f010a5e74b36e810b24935
MD5 f7023e5850aef824285f92ef0d68a479
SHA1 c4a16044b3597878385e34a02df16d1263658ec1
SHA512 ee53b8ddb7b8ee8f745a08357058cab9d31e8d71cae5deb51322be5fdcc2236075ef0e52df3c54731e696b3e5ef0387891551fb0579a55ccd53cd1651fff6340
SSDEEP 12288:WeBNUbTVO86ULRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:WJIUlzQPI9hAH8CzQgAqvuG
TLSH
T1F775CF3BEE28FCE2C67E4DB95A918740977278704B51A3CBD135820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ed353f6da38503ec8a3d23b7fc03dbc42bf7e8d763ca9d95066854ff82f77516
MD5 47d9e43b52dd92f9a36f2aa035a93150
SHA1 830f61021dbe4eeff4629af79eef2eb9b8f12207
SHA512 24322e23f0040680c2590779bcee1afd21094b8d3e7e00fa32786401b9d05d027a00146299c37023ac7e88efd235f2db2bcdbb47756fb99e02e38ddda6f37f5f
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH8:wQvGAdlCEL8c/DRNw5CC6YgAn
TLSH
T1DE267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 92fd592cc657309b3e9086fc64263d86c27be7dec587aba1c3acd0670051b0d5
MD5 1fbcc7f5c21c548646954166e74fca3e
SHA1 2697a2f780aa546c4ac8e548db10947356cf8a9c
SHA512 0aa8ef22a79820ddcad25dc25a9d2690cef76a264a97cdbfbfa5f4d192043c2b11eb55627a66ff14bcbf0d1f68a9d96ed61c565017d7fbddc21fe7837b585245
SSDEEP 12288:nAwSfxL/2Dc3FDLLmt0LDQewsAjhRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKole:AwewsAj3zQPI9hAH8CzQgAqvuG
TLSH
T13385E031FA74E436C77F0DB21B36CB16187DA9204B912AC3E3B84D9E49342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f2f1ed85cc14be98c8fee92a77fa35cf231a59975cdedfed937d224325ca05c8
MD5 942bbda1bedb9a15967fa32c6ff96d38
SHA1 57b463b0fa5ed380f29610ec65a9a79a1448e145
SHA512 6df8c6596ddcf31a048b5ba4cfdd9c0a9f3b3fa9f9a4ce35478932ff052bff070ecbb3d6ca851a19bbd257c658137eefca4d72e3f16851c276f3c51d17e95f92
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHip:YUEtQevvqc2W1cpV2tI32ip
TLSH
T1E9474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fb3b1d4e8ce8f122f96e0002ad3548e29894d461ad7b47f24e88cbb32ef9c9df
MD5 542a5dfbe48419ce1730031256d47285
SHA1 6365283ce9a4308d9c76a6c2a59025d08c7ab22d
SHA512 92d981384de6dd89461cbd89bed105d58fb742370387d52b1dc01ec32507716bdad1cd76c1d8657412905e2d8b65ced3357e4881f81873616ed7875c0f847ba8
SSDEEP 49152:2CbRquA/m2yL5zTfFiV+XenmE3/zXzQPm6YgA0uG:7oquVjnm26YgAn
TLSH
T15DD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b05b4ad507a5c3f9c3cc163bbbea6695ae523182b9b9b15bb6b78e9960ef52cf
MD5 7d8a583fbbe10129e61ca934d29ef4e2
SHA1 7aa1f0e4e045eedbd72fd0f85b30fbc5fb5813f8
SHA512 a951c15ce9ceec59faf306fd701c2bcb1817957640fd2e68d5ba8132b034c138e6d785b609c0065d2d0232c4666653d82067fec201d69720466a3018d20d89c7
SSDEEP 24576:kAhGL3IFoiwtA5l7S53czQPI9hAH8CzQgAqvuG:kAMUFoiq5MzQPm6YgA0uG
TLSH
T1B4359D81E7F945D4F5B3ABB899B68571EA76BCA55E30D20F2160D11F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 bca06d9af49928d6f60fc46bdfefb50773fc93f8d60a944c0519c59e2280a913
MD5 af2eb66ebf7132aa5b52772b94f92131
SHA1 6914baeed23565f58452abf7c439b6b4362e1aec
SHA512 7f7a8712029774ba65b01b91341475fff791aeb43187a8eafd5039820d6f4f9700ad985fefcb42e77ddfcb8fb4d378f7fa684bad0840dcc6f2f957aa4d4ce9c0
SSDEEP 12288:3mw5HEjsChN5BFgl0WDm+CmRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:WwucOWbzQPI9hAH8CzQgAqvuG
TLSH
T15475F14A72E80CF9EA6B46398557C632E7F2BC112B61D71F0360C65B5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 93f7552974081c9aa358395020c24eaab9c6daf2a3a7fa9533ee79c2a3e46941
MD5 289701b096fd1ac38d7f75808a193175
SHA1 8acca239281a5b8969e55d839bc74aa61ba7792c
SHA512 cca10ae1a372950428e6b5efeea0d4ff5d0fe2816958723eeef1df09072fc28763eb586b5ef7909c99035b5273802b62c049f547e0560da0e5c627fb3e358e5f
SSDEEP 12288:Q6Z1IyRRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:tZu2zQPI9hAH8CzQgAqvuG
TLSH
T1C765128A72E821F9D6AB43798CF64F8187767861377193CF023106A65F37AC56D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b387871e2ab147df7d653f0588fd677c293b7bde6ea32f6600d0ed3ab78269b1
MD5 f284e7d4090015aadd9f3b200b67d03f
SHA1 6ac1eba6f7599df1bcafbcda37b2fceac5e16938
SHA512 9ea99558a4276f9c19198064f08c881c638b3bb026077e4e3ab9015958ebbc13f80de12ada6a8fd844cee7157dcde62c014b2b5cdc32936893914058880018e9
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UY:vQRQyi36YOcPbLvw2gAf+PN3Z6YgAn
TLSH
T1E7666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 064661a32ff3db8f4ac9e3967522f8cdd8b71cd31d1601051f7c75611f121630
MD5 d8d9e45390aaf307aaf2a6481a28149b
SHA1 227d2d4d0ba196ecf6dfcfc30451a89bb698f116
SHA512 f6dda40af8b8450e92dae4421b8188e1a1b3085e191ae9ba38b3e7407bab632d02dfd4c05e518adb43dd245471086557e63574cf4bf08b4b20c26acf74a28693
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UY:YQRQyi36YOcPbLvw2gAf+PN3Z6YgAn
TLSH
T162666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bda3967d6b6c7d88d8c9da9b82d610d16a59fd83d01c699b599dcdc459c6e484
MD5 369243dbe33fed156b7141e37aca27d3
SHA1 9ab6d4b2cf749be1388fd8cf796725399a565fdd
SHA512 e64b39d63191a20477a7a9ed51f61fdb99322338ede646de2dd67668c13dfc096539a7061fc2fb8e2026cb7324e6f98bf5dc3ea8a5e515a6c0c3e29a14c38a80
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0mzQPI9hAH8CzQgv:P68Qg55nhceWu7PNU3/nzQPm6YgA0uG
TLSH
T1F5B54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3402714f77b941010f3f60ae2a3b8494ce850316c4fb9789aff9cfda02e7f0a6
MD5 5939e62c06a23049420596afd091fda2
SHA1 9e47d123a7ef7fb47e37fb72a02c46c3ec5756b9
SHA512 f234b37a22aae2d36407513c39a783ff9f15441add312ea39058a202bf92ea31027a5e682878db26cd23a0e89984a68e33266bdb183a677ccd1480b57f0bae0f
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99q:Vy5112gYy5azzVvt69nLKnhZs6YgAn
TLSH
T1BD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6a2fe4983e61f30697438d9a677013ac5eb2553ad37b65a94a3ebf6e6f8e28ae
MD5 ced358ffe05c20ae11e0a7b11e3a26f9
SHA1 877703cccb92098fea1bfde8849da60be56bfb37
SHA512 22b3f5c19dc7963eaebdaf70245e4236993f1da62ac1702fd3f241c04a0a1b2faa8fc60a0cef0bb2dee8fa2cf989f5e01874c31e8e504f78819cf2d8d6d22e97
SSDEEP 49152:EB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glxzQPm6YgA0uG:eu6Jmdxd2dx6YgAn
TLSH
T1B9D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e056a57b6b9067886596673f0e7a69aab457f276219cc85c49031c0a3549f55c
MD5 52d2373fa6e1ced5ab8fea68f6e29b6a
SHA1 8405c798350ad74e752b1d987f11526a33828857
SHA512 a0ef956cc2828eec0fb05934e7a3e26b1f939f278bdb9b5d0f2f5f2388bcf79a3ef37597b76cdf4f7b4595ff4a0ba2c02b34518c242ecf756f9ec86d8a08ad2e
SSDEEP 49152:61hpsNoJpF1A63U44CwH7R4xFzQPm6YgA0uG:6mifPWR26YgAn
TLSH
T171B5BE13F2D801E8D06ED17887569632EA72BC450B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ee938503c5d590ce037341a3a9974b686e508bd7f85b6d78cda99d37aeadadaf
MD5 222a96ab9558b74486d8ab3305a55467
SHA1 72e9e53ae540f0c61264971ea9dff147f3fea2e5
SHA512 f034f76bca41e1cd446c8b1c9d483fd0a2c9f29bb973b96cb196c21126757b5f8830892fb78c39e2e73050e08fe322e6be14191d84617d4cc2cfd7ce2a0749e5
SSDEEP 49152:/SuZQIY0Be2KcRVtOnks6NMHq2zQPm6YgA0uG:F5dKii61Y6YgAn
TLSH
T105C5BE03F2E901E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b80c79b17a41514acff74171d1337d306137728ef034f3c62b1ea9e83e8022ec
MD5 3a8758ac16cf966f461e5b7c847a3f76
SHA1 8d217bb1c98666415d6596dc1773cdba2ca140c1
SHA512 17a1d8ae41aee0e205a30fe94a6c0a29feed26e78727d28ceba69ad453c3cfc4c2ca2c0abaf4f61dd4e3d022b79eaa9e0789f5125be62ed44902d668bf7e56fc
SSDEEP 49152:lhtSn8EApI0fig3giDn0AP5wBzQPm6YgA0uG:UX2imphK6YgAn
TLSH
T12995BE13F2D901E8D05ED178C7568632E962BC150B38BAEF0A50B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 dbcb19e09086bb8b66db28d21a9b0b6532e5b6ff023046034a2f1c417d71f5de
MD5 ce4ee4d055776bb1d1d5137a8340b551
SHA1 b60aa487eafaa1199bd3a8a97bcd2c6c165bbf3d
SHA512 1d6f4e0bede5abb4ce4b3d12499a896d56606636a2d85977c7830d2b9a80adcc055f060531e49aa7eaeb2c81c447244f0132a07180c31be145d602cad9ff86db
SSDEEP 12288:ccRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:cyzQPI9hAH8CzQgAqvuG
TLSH
T14155234AF5E80AE5DF4F4BB248675FD108AD5DB43BC1A36B133218628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 06cfdfa70ad9b58758e8c9fa60aabb3ed07eac4ad2ad26b64669243c12dcc976
MD5 268251794f961811a9193093190e14bd
SHA1 2bf05463e207de44ad9aebed023ce8dff5324a4c
SHA512 c62b04e3303f90158d0e7bf213d6579b3ecf864c11aac3abc46a2383c867ab394bd63a2739aee1ea1133cc6fb2c4a1688f22166a746b8433ca1ea821df0c3944
SSDEEP 12288:ztRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:zDzQPI9hAH8CzQgAqvuG
TLSH
T10255234AF4A80AE5DF4F4BB248675FD1086D9DB43BC1A37B133258628F7F5C8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 8ec5249740af47734cf6b5f3166a20236aab3ca0c7d52b2b9ec94ec55648f843
MD5 a7db5fc1e52e554825d389b482d4228b
SHA1 477c81263fd6058576b05a1441ce6a8a38ce5f69
SHA512 945593548c9e281e814918a7e20a9cd2718a5db71b4509290232d21ae2d9642116912933688b89402087af389f73470bca8ef7cb5d8132f64f5c56f60f09a54f
SSDEEP 12288:bDRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:bdzQPI9hAH8CzQgAqvuG
TLSH
T11755234AF4A80AE5DF4F4BB648675FD1086D5DB43BC1A37B123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 74d3f0409fa8f66018d5f1c04b6f1b553c5cd00043e89b06a587f7b0cfad8612
MD5 b6c7d451fd969832b1e0ba25c90e628f
SHA1 8b1bbc3125a6eaeb9543b1b2c74209d7a4cc65e3
SHA512 b12588fa1bef660289558b02ea277b1d432347b1de7b687bf0c4d849cc21505c0998e1790ae771e68e662c992f917c5550e36b195b31b03e800a143367f1213d
SSDEEP 12288:kV6RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:pzQPI9hAH8CzQgAqvuG
TLSH
T1BA652346B6A801E5CE5F87B6C8774FD144BDBCB47751A3AF032208A64F7B2C4AD157A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 79c81117da2ea303bfb56e95afeec7751dd1892c3210d47f970d2d86c2c897d5
MD5 f5deef03b19df545d01159c3178224b0
SHA1 05e4f8800399d584e58b9bb8d311330f75c36096
SHA512 4669a36ad342c3fb8226d01d4bb151377a6495a60e4ad96b6bed51ba0204ccc3e47f8b96f7593fe6f5059139bafebec0f02cd5664a04174b537b138724d1f684
SSDEEP 12288:riRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:rkzQPI9hAH8CzQgAqvuG
TLSH
T14F55234AF5A80AE5DF4F4BB248675FD1086D5DB43BC1A3BB123318628F7F5C8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 5fb5bfa88c3a8f662da650a487814ae35ded13e043514980c014c1554e3494ea
MD5 eae9ed68bce350a5493612da0587ed0c
SHA1 803341235d89c73a8286e2c05855b2665f44ab25
SHA512 03e073bd2b5ab1ef252ae748250479d22e31ab1e327c068d62b93cf9866d5cd7544be342214742d29de99d8006cc6c17a77023cdd0f54aef29949a17d3418a2b
SSDEEP 12288:OZRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:OvzQPI9hAH8CzQgAqvuG
TLSH
T1C955234AF5A80AE5DF4F4BB248675FD1086D9DB43BC1A37B133218628F7F5C8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 3cb9325d250171518674c73b2dfdaa0eb4f70d392168bf70cb84bd3a4640e323
MD5 269ebbda132fbeaf5b8d3d080df4a484
SHA1 b1c9d6d242962c61d839e67b2e9401e51cca6c74
SHA512 eef5e144bda0d7423d05d1f3846751e33c7fb89fa8a524793cb5b250133cc7a8ffee646ebb81b22213788318a6e57b5842bbdcc7f16fbd3301854ff1833ffd4b
SSDEEP 12288:91RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:9LzQPI9hAH8CzQgAqvuG
TLSH
T1C455234AF5980AE5DF4F4BB248275FE1086D5DB43BC1A37B133258A28F7F488790A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 6e0fe97c580994c8d0c23828f077803fac375385b6c6551518e67770c5650071
MD5 aca9926dbbd94c4c8459974b0401c934
SHA1 971f38f8bbfd6afd5a2e014f80a30e13d09cd53c
SHA512 f01e47febd14fac6fe1d82f0a1e999ced356e06bb1e46be99ce37fbb7f3013628f5c2e31a32eee73cc59510b16c9fe45dc20ba0ce300c9be3a75355a492dc0c7
SSDEEP 12288:ZiZwbJzzFEoS2cPvyNRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:cZMNzFVSOjzQPI9hAH8CzQgAqvuG
TLSH
T168750195B39008F8DD67823ECC268E52D6B27C691BA0C61F03B436675F373911D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 9e0784465df9379065e761938e10f426ae7fab589df5f1b7c3372ad1becf393a
MD5 0fea2b18075f4d2580a1bf2f5b9bfaeb
SHA1 05388fbea931c862cd50622cb3a72acc4aff602e
SHA512 3eca764ef067822bbe8ad631f028f89310520ac9332d6f74576f5de2a88a1aaee7f3f7b566b70b5b32ad6c01450cbc01c96d81ed23a5e40be1e1d69e487f214f
SSDEEP 12288:AgRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:AGzQPI9hAH8CzQgAqvuG
TLSH
T11355234BF5A80AE5DF4F0BB648675FD1086D5DB43BC1A3AB123318628F7F5C8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 1b98b2f93d93dff8d841e901ff3f47008c3f1cb6a09c23bd0561fbe4e861eed8
MD5 cd03f54f0a68f1d6a2ef3df02f81e4de
SHA1 142052f9f207bbbcaafdfe87f09c034099b00074
SHA512 a16701f95d378046375dab309c9ba80029d9cfb5270513b77fe7666634ada68c9c3f7152ba072c379fff20d941e7f1577148bab3ed11741edbab7a2362f87d73
SSDEEP 12288:FURQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:FqzQPI9hAH8CzQgAqvuG
TLSH
T1F255234BF4A80AE5DF0F0BB648675FD1086D9DB43BC1A36B133358628F7F588690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 dc6fc294f85169fe1d4366f1c7897bf77cf78bd1e7ce7698a4191c0e3f46ab7b
MD5 3bc3cc70e85887b0e65482e8866be608
SHA1 1dc4b68b6973e6d41a2f4acb999675dbc4fceaea
SHA512 719c76461948db0464499b766802c0f5521a56ecae37650692cae7403e19b6389165089cd5e7ab49ccf217d7e209c728d4112c013c95b5964c456c3fe0948f65
SSDEEP 12288:byPz5L8RRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:WzyHzQPI9hAH8CzQgAqvuG
TLSH
T10D650247B2A421F9D56B8379C8631F82E776B87117609BAF136006761F372D0AE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 fdec1d00859c096b8f02dbb36662c1d4b0470e36511da356fe63110283c353e9
MD5 426c81ce44753fcf6a76e49f7eed6d9a
SHA1 413130fa8dcfb928a5f4e0fabc5dc4464ad11df0
SHA512 59bc48d17e2b1cd9d5135849fc9b69ebeeffdb232c730c19c6da33f0adcd878bab409beb2c2eba1b448d99631f8504968b566a25d9f81cf6a7951c09aca0dda7
SSDEEP 12288:kgRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:kGzQPI9hAH8CzQgAqvuG
TLSH
T17C55234BF5A80AE5DF4F0BB648675FD1086D9DB43BC1A3AB123318618F7F5C8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 0d28faa6283475c4f25a9bbfa8e20763c531f2c22aec9f5b0bdbd65c4b32a969
MD5 0b35f9bd4a9ff330d62ecc5a178b307c
SHA1 cb9878f43416e17f78812d526451bb114c01ece2
SHA512 bea4487d9e23d17d58c9b2192c38213fc71d0c1a7c8e81b456cfb19daf4bd98a8735923707a1992b7e7fd7054b2e299c439d9eb591167877cd26634042244796
SSDEEP 12288:xgRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:xGzQPI9hAH8CzQgAqvuG
TLSH
T1E755234BF4A80AE5DF5F0BB648675FD1086D9DB43BC1A3AB123318618F7F5C8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 49bbe27951791bc1e0aa334a7226d936f88153b94f01803053d0b52b5fc039e0
MD5 23f6ab36b5d74675535e30384528279b
SHA1 075fca21a206091e4de76e917ae4940e5f9710ac
SHA512 dc9272f8c8083cf4ccb64c9bb862bfe600f059bf25e922554e71786a5cfac84fbb6c55f1f8f38d7f8d4b101da492c20bc59d93cc8a290e199aa037cb73e98c76
SSDEEP 12288:cyPz5L8RRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:FzyHzQPI9hAH8CzQgAqvuG
TLSH
T1FA651247B2A421F9D56B8379C8631F82E776B87117609BAF136006761F372D0AE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 b97be0289e134ededb59732155412da19c34d88c2366986158098d085d0f0207
MD5 b3f98f025abc4380206c43e5d82a193a
SHA1 0f552d2df73e288d87b77b2dc38945a8a56a81fb
SHA512 93ae6812497dc1af2be7917805d27d1413b211a3926bfeab2f603968b8f3606441292d4e4688c4523d58da98acbb78a8115edafcc78aedf70e320553b9c357ba
SSDEEP 12288:hCd9mWYoaLHF3z0z04PDvhTRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:cTvaLl3z0zDNzQPI9hAH8CzQgAqvuG
TLSH
T11E750195B39018F8DD67823ECC268E52D6B27C691BA0C61F03B436675F373901D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 a45c947d2479d6a65a7ed6fc9bcdd0afc0457b9f082f6b9441ad53df0394b3bb
MD5 82ee84ca38dcf3cc35d98b63a2548685
SHA1 1ff6a2cbc68b489e10e03c33f3d0636a3d56119a
SHA512 9b9f8c41bc998f0a0e91fcb2ad2880fa6c36f02800946cf72bf54f860b05d9cfe349fa857309669b38a807bbdb1ffec06e227c0f5c329414d9b32a96470a76a4
SSDEEP 12288:Hi4e7mRdTfgwCHKy7GLbbdIvORQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:H3bd9CHKy7GZZzQPI9hAH8CzQgAqvuG
TLSH
T16985CF90F3E414E8F1B78A358C764611DAB67CA91B71DE8F03A4255A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 357eec76a2c596be55fba400263d506e16fb42fb8b8e8447897db01232655232
MD5 121da72f78eb89a33521611ecb7b4e11
SHA1 06856adb69956f3954d990e01e38694a71602459
SHA512 bf2684a1302f2381bb8bdd04cc87b8d39da3b031312c814a2a23d4d5725d05a0994d0e0beca67c5e5e4c0168657576f74535ebb8425a691c694956f95dfab1ae
SSDEEP 12288:KjRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:K9zQPI9hAH8CzQgAqvuG
TLSH
T16655234AF4A80AE5DF4F4BB6486B5FD1086D5DB43BC1A37B123318628F7F5C8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 e32174af1dcca122d516307ed399339acea7ce13f5f547642a57f37e5254daf1
MD5 e08a1e03b2f23b63054c213aae069754
SHA1 22433153c80e676a6f984f04ee85e8e4d840d95c
SHA512 99725eca941bfa13b328c0decaf58c6a25ffee01f7f3f085209646cb5976bf298a2c8141bc4743e77f3c525960b6143bcd42cbafc96e524e78e22235c90b98fc
SSDEEP 12288:BxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:BnzQPI9hAH8CzQgAqvuG
TLSH
T10155234AF5A80AF5DF5F4BB3486B5FD1086D5DB43BC1A36B133318628F7F48869062A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 570ed3238bbd9c8826adcb249208d9a813beee06668eeb69367b56423cb5105c
MD5 be45827359073b838c4c31c2c1620d38
SHA1 0f47524b983498c1cb8d517260a0154d1c9a6945
SHA512 46f1d0498bea310a60e268442e6f528ec609dea50e32c06fb1290923564186cca90e3ca8080614acadf169eb4f126503cb35c1f5e446febe6d4b7c6e99f40286
SSDEEP 12288:bORQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:bgzQPI9hAH8CzQgAqvuG
TLSH
T1CB55234BF4A80AE5DF4F4BB648675FD1086D9DB43BC1A36B123318628F7F5C8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 2dd6ceb857ee0ec8ccbe03c04d9bc22dbc4b1e97c8f24b11edad487e283251a9
MD5 0701506c40388d4ff8d37b2bf841add8
SHA1 e9cc098eefe5affbc282a0f5fb3dc81cb2bb35dc
SHA512 69f8c6b7cf43609267c3702bb203c4e02f9ceccbcc05cd11feaa6dd3b48500dc58c447270f8ffac1f5234d7e0e3222b7d571468fe0b0b9ffe84330d1f9242423
SSDEEP 12288:MgRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:MGzQPI9hAH8CzQgAqvuG
TLSH
T11955234AF5A80AE5DF5F0BB748675FD1086D9DB43BC1A3AB123318618F7F4C8690A1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 c6c518b0039b8923db4276cc59d43d0e838355e5857e80c76e839a909c8b8800
MD5 71dff503f57d962ff5d7e6e8486cc4ae
SHA1 c83fd430a93f37f46795306bcc0aab92a1bdb924
SHA512 382d1cfd38adba21a8c71c76396e2e4a70a24fa50c08dae8d8e078395d4113d4e4ed483d8442905ceea90106b09b37f4be451fdcc56f5511e87dc67c573676b8
SSDEEP 12288:sjRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:s9zQPI9hAH8CzQgAqvuG
TLSH
T1D455234AF4A80AE5DF4F4BB748675FD1086D5DB43BC1A37B123218628F7F5C8690A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 4e055c58b1a38e4707f3481640a1f4ec079a2eed6c4812748c9556c6bdfeb50d
MD5 d6c8437f9cd4cd3325b331a5e193a953
SHA1 46bff5483b1506ad8ee5dfea6ac6e4b61003816d
SHA512 ba1e393941a62cffce4b2900fd0d1db83fe8ee52c104202f12de3f165f7e6913e77aa5f33a0a6e021e8d68ebbeeddbe75d62a6ece3d12907fd529ff804edec9f
SSDEEP 12288:3IRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:3uzQPI9hAH8CzQgAqvuG
TLSH
T18455234AF4A80AE5DF4F4BB748675FE1086D5DB43BC1A37B133318628F7F588690A1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 5152708a2a2166c78b77c7708c0fc50fd81bba4e5acd677cb0416ca3dd7f8cba
MD5 f31be5cde0b58221088cb21a372cd8ef
SHA1 82258e1085e6d8e5e1506d915a72521454c75cdc
SHA512 35bc9aff9dd325257a2b0c8ae0b88e4a9e393e75f1be44414ec6962d39c9416d289f4ee0fa42112eea14de3e3eb0d30e2c17bf11d5db0b36f581f58971cb079b
SSDEEP 12288:kiRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:kkzQPI9hAH8CzQgAqvuG
TLSH
T18C55234AF4A806E5DF4F4BB648675FD1086D5DB43BC1A37B123318628F7F5C8690A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 b4a80c3f28d54c1d49bdc59ee14004bf5bc1ea82ad3c09e9a8ad8fdfa38c7e17
MD5 66ccbb1620fc1cd35f04f474f6f9527f
SHA1 3bfb9d8eeef89a3b958607b8da173acb7ac7f7a3
SHA512 6a5c2e414569db73ce1240834e83c9e9d0e0ea97bf0f9dbc1c27301264d07f5e06571caa62e7edd008a54bda618912c1e1cfead849b2b14bf2e61e6cea4292e0
SSDEEP 24576:Mfwvhk9RX6wkyAI6zQPI9hAH8CzQgAqvuG:dMnYI6zQPm6YgA0uG
TLSH
T1BC85CF29EBDC04E5E177923C89B7464AF6B178691B31C2CF025A53AD0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1fc6f62a29ecad2b7350539fc6b25b99640261ac8282d4c444e9207193ddc375
MD5 186054f19fbc2b73bc3ee53bfad7b149
SHA1 2b6b1849c73f82064de71042f0e223ff7ffdd095
SHA512 287edbcbebcd6f1142a61f66c59d6ebea6455610ebdcefacadd89c9ed04f3935c735af50f73d7e81ee495362873d1f4451385afc8ef7cf5be35faf9b2e17585c
SSDEEP 49152:9YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hzQPm6YgA0uG:QySzP56YgAn
TLSH
T144066C96A1A801D5C1B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 187fbcae10d29bf172554bcbb77485eba98a8ef40deafe9f62cf6ad4e5c1459d
MD5 490e674fd9e42b823d60f5082ca56dcd
SHA1 ee0f3aa6c6b1d9482a14370bb2290cbcc09e5794
SHA512 45e93a235ab35e2161a42a6f8b3bba479c8beabf3aad799f84861a4b9f28bbddb75ef9ebf7eabd69310f0e0a9faac856732caaf21ebecf6b0a37e739766ec9dc
SSDEEP 24576:t47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYzzQPI9hAH8CzQgAqvuG:t47JUQjTirIhCnDHUPfF/xzQPm6YgA0V
TLSH
T19965AE1EA3EC01E5E1BA927885154A5AEA71782D2F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 badf77c1f103002ffd4a4559fbf2f112eab93d28fa870ed41433d7b95868f01b
MD5 843e891dbea1408ee23e774233026ec6
SHA1 f83dd38f2d0621a13ea3eafeaa8b489d2231651d
SHA512 7a5dbe1da92b08ab3e9832c5b06f39e0b3a9ca6b5a663f90c8dd9c0b24947f38991eb8a051c12efdc65038ca936409a991add75fce007f1ba08b532b1839b685
SSDEEP 12288:GPsfwRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:Z2zQPI9hAH8CzQgAqvuG
TLSH
T15765F14AE29802E8C56E5276CB564A81B3377C6457E1E3CB13D0F47E0F7A580ADEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 311eadf286f2682a7f1314a080a3aae4c6812c05ae732f4c06c51390aff3cf82
MD5 1df82f16f1d5ef56385fad55849877ab
SHA1 8672e97b4dcadc85e81417b7ba1ca53c6dbd8947
SHA512 f434aa96031dba94448535d634c4742f9273c45e7229bc7efd88601a4332b0ba9f5aa301f2c62e4dc5a9bb7c61c58b0f5044c5294a534f05bae0ed37dc6a33d9
SSDEEP 12288:2bdI+cU3fOUKUyST8DRAMha1g/7+3V7wro3wAUOTpKe:2bS7UPfeeL1ga3Nw83wAU+pT
TLSH
T18E253850766AD75FC5AD40321E33C2CCAB707D01EE45AB0372C8972FC576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e843b09a87ef8c3bd56d1e5c4e883d29262ca5ed7ce82aee47023148a66dacdc
MD5 f802dcb1ec368c78bfefc96d2ff282cb
SHA1 f2fafa42a8853a669a9f237c15a42e6e2cce0d0e
SHA512 6132770b2d54c79b1f826081562bcec8396281296af55e55adef10d520336661e445d495c3f143cea35744f28ed2413aefa53e015e62d16c1167df49364a8337
SSDEEP 24576:lUrAvcuZCKsM6kV7vwVvj5pNYRUuYfy32UpdX4d8P7R:lUrAvcuZCKsM6kV7vwVvj5pNYRUuYfyR
TLSH
T16455C7816437A38FD1F66071076A5B4CA764EC07B3096F2663C8553EDC2BB62A0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 5d852d64eadac143211c7cc56963797384aab9a314721b78e3e99257943266fb
MD5 74bac4a349a6efea5f810208c32e5ce8
SHA1 9c010291b3b9847921c7001918da75aa552304fd
SHA512 0a48a969c51300a77af17567e8b78f8c7410b7ec597cf2bc67563569aaed5815c48dea1c0b84b313a9766d58fb7b0475f8927aec8a4441f3829c0425a5c614d1
SSDEEP 12288:2o7YRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:7ezQPI9hAH8CzQgAqvuG
TLSH
T188552347F6DC0AE5DE6F07B1086B8FE1042DADB43F80E3E7122219A58E7F5C4AD25252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d5cd69c48d7a9bc25ce3aa719e18cb1f9028c5cdec1da352614c8db7ba20ceed
MD5 daa6f3e9ed0c4e2a22b877c6e290a4d8
SHA1 d8b403c821ee63abd05112d07f7af876ef07fb0c
SHA512 4c0f30c0147524b9a7209bfb578b141397398a0d8b1a453ec50ac9200ff452f35bbdcec8f51fdb70e96bb730aa0ee0063403b63350147de2e942f92c3606536b
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bY4zQPI9hAH8CzQgAqvuG:pgb4mBIBhGFzzQPm6YgA0uG
TLSH
T1CD65AE1E22EC02F5E0FAD2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 782cc78d7e3843865e56f594c1cacfcb44bb11426259e3fb127451c427db4d47
MD5 359b7794ef275096b316c32b18689938
SHA1 6634cd7ac96e7186623935111bcf4077c76bee6b
SHA512 52d8f28cd029c35286ece7f455c7fdbf2351c9841a803775d1eed17898f6bb9fb2a9cc71caeab38b529b62f96971449483f036dd557e6119a6c30770794f32ef
SSDEEP 24576:uG88u8FpJqH1Hzria7/mjzQPI9hAH8CzQgAqvuG:l7ZFPqVaa7/AzQPm6YgA0uG
TLSH
T16795F165B6E001F0D47BD13889474BA3F6B2B8251364FBDF07A88A511F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 55aa81ccba26874b2462317ed487ef885cf1694eba7f83304d238f6896b62c6e
MD5 e0217337db391187eebc85d652318efd
SHA1 c1e8d0e1a6b6e71d386692bb36ed1fb4912b9522
SHA512 cc08983c591b1508629f4d63996a650aaa5c353b06988412c9fcb186a2b43b1de8eb30fe98c6992e0e02174fbc8a2a756ac11cce8b4908738d43751ab8c5fa53
SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvzQPm6YgA0uG:BG05lO43bU6YgAn
TLSH
T110D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23825032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4b6e03c237252ae804cc58a466e981c2e35ecfda04d1169806c30f2bc03001ad
MD5 2e2002238a826184816d8735b528fe36
SHA1 aeee9c2297c7e0b56b1860d61d8600545ce82b59
SHA512 e07e3053ac13cc53114487eced41b07d06d3ee40b1ac568c42d21dc1c1753fd4c3590ba288fdf7a40be5aa0447c6567eff21ad6bb3fa9d3dde548296d0803949
SSDEEP 24576:Nfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnhzQPI9hAH8CzQgAqvuG:9a5POZ3BJt2pasx2+mnzQPm6YgA0uG
TLSH
T1BF65BF5EA6FC01D5D5B9D17DC5838A1AE5B1342153319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d0d13ea84a6a142ab07996d42d9ec39f1080e3d0d0539ae5afd05529c08630e2
MD5 5dbed2d096cbeb9852673760f2951da4
SHA1 d32f9015d7a669303d3da7c73047406962c1b2f4
SHA512 63da3f34287d436d668a3ed36c01153e5427358ca0a79daebf19d75fe140fef9d8978370552f1252c6753052a123f717ec74e3e4b9d07b72c4ee46f3f2bcc48c
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7Fk7zQPI9hAH8CzQgAqvuG:9Nc/zEOVHFgzQPm6YgA0uG
TLSH
T1AC858C1623E901E4F5BBE1BE89779A46FA717865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1570d777e1fe54765eac0bc3f47fa0b2959708813b05e21f9519cae08bfbdbd0
MD5 9f6c126c8f7f8c97c6420e268fdde617
SHA1 a670d5dc1aaf3d93c14706d7b7ffdfac24979898
SHA512 c2b853f8a18f07767fef979b5a379fba89f9fd102f0f1d7452f63eb6970dc3f510ec3e5ad861e880f919f9b855612b97c40377a9a576582e1809573fc33e2f92
SSDEEP 24576:sTkNvNnaFeYhJNtmZBm1zQPI9hAH8CzQgAqvuG:sTMwBtOm1zQPm6YgA0uG
TLSH
T1FF55AF6EB6F806E4D1FEC6B58D238512EA727461173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 dfbe34b50efe47f98c10d7b4e15f611df09edcef69d5124cadfbb57003493ae1
MD5 ff1793d7788902b9062ccf75199f1729
SHA1 4bf241f65805320aaefe949dbcb54d1baf17c8d0
SHA512 fcf1377b9e492bdb7e5af1aed64642886b3eecb117f6a6847cf01bde643adf22c922370b745a2eacd7ee0ef6483b26d870f6a98857ca682fb28a0d25fedddc9e
SSDEEP 12288:6HvUrBFrEjwaQJRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:6PUr+NQ/zQPI9hAH8CzQgAqvuG
TLSH
T17E75F11F62EC18E5E67AA17D89828749E771B8621711E2CF02A1817E4F77DD8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 071c04fc8e1d4a680a529fcdcf4f941bc7ae73c74cb1defa7df9ec166f81a659
MD5 352140f0be3506b4427390f6d58b763f
SHA1 19f42eda529f774e5e342492be19c4f9497b6bbb
SHA512 0ce24ffc4f14c36ac050174a0aa33c9b3084a2aa931860588e9eb8c25cd603d27fbbd54324af9a79de94fe63b42df843aa7c0d68af605d4ad071f06c46857de1
SSDEEP 24576:KD3FHshBIYQgASzQPI9hAH8CzQgAqvuG:KDVHeBIAASzQPm6YgA0uG
TLSH
T1F585E27EE69C04E4D57BC2BCC9638A06E67138B8032166DB029481B65F6BEE47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/244-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/244-306-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/244-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/244-94-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/244-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/988-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/988-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/988-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/988-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1276-309-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1276-107-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1276-109-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1276-115-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2036-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2036-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2036-325-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2036-88-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2036-82-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2036-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2312-249-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/2312-55-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2312-54-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/2312-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2608-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2608-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2608-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2608-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2608-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4020-50-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/4020-52-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4020-39-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/4020-40-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/4020-46-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/4184-78-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/4184-288-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/4532-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4532-16-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4532-21-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4532-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4900-77-0x0000000140000000-0x00000001401E7000-memory.dmp

Download

memory/4900-313-0x0000000003090000-0x0000000003180000-memory.dmp

Download

memory/4900-1-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4900-9-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4900-0-0x0000000140000000-0x00000001401E7000-memory.dmp

Download

memory/4900-304-0x0000000003090000-0x0000000003180000-memory.dmp

Download

memory/5224-65-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5224-73-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5224-67-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5224-272-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5516-120-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5516-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5516-131-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5516-126-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5516-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download