39241b81348f3b536c6e2f48eeee1c338ccb7c296e529b107ff6679c49ee2665

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 8.6MB
Sample260812-p4ffqagp7x
SHA256 39241b81348f3b536c6e2f48eeee1c338ccb7c296e529b107ff6679c49ee2665
MD5 c9d9e1ae78461b9d5978ff917c5ff366
SHA1 52370c373940e5267d0d090a4f71d33be7936a0d
SHA512 119b2249f0f8a5aa0f292bec24764a4a4bdad6260e65c004cd23b091d21d786cc2ab84b17186cd65dd4c4d0bf9a4909696cfd5322fa65a3600ec1057d29707a3
SSDEEP 98304:dlaE18pesXr9vKxlhVaBxnL/zupf7qjFxiSKXHOCFD527BWG:dlRwF79vKxfVaBhzuUiROCFVQBWG
TLSH
T1EB96BE5373E940ECE0BAD179CA968963D7727C550332ABDF029099795F23AE04E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4148	elevation_service.exe
3056	elevation_service.exe
4536	maintenanceservice.exe
3908	OSE.EXE
4456	PerceptionSimulationService.exe
1648	perfhost.exe
792	ReFsDedupSvc.exe
820	SensorDataService.exe
2968	ssh-agent.exe
2340	AgentService.exe
6080	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\535d386c238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca830ac9592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069099786592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014fef8c8592add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b244386592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a117a986592add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1965786592add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	792	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2340	AgentService.exe
Token: 33	6080	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6080	SearchIndexer.exe
Token: SeDebugPrivilege	4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4148	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
4668	2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 5876	6080	SearchIndexer.exe	100
PID 6080 wrote to memory of 6076	6080	SearchIndexer.exe	101
PID 6080 wrote to memory of 4588	6080	SearchIndexer.exe	102
PID 6080 wrote to memory of 1696	6080	SearchIndexer.exe	103
PID 6080 wrote to memory of 1440	6080	SearchIndexer.exe	107
PID 6080 wrote to memory of 1040	6080	SearchIndexer.exe	108
PID 6080 wrote to memory of 3420	6080	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_c9d9e1ae78461b9d5978ff917c5ff366_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3056

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4536

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3908

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4456

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:820

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2968

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 32ee745f564292ec88ddde0344e68f76bf4c83b5ac79820a33d8f38489a50abe
MD5 0c42e3a2eafcdfa10f654318db2d2caf
SHA1 03f3212da99d539787ff72815389c958e2811ccc
SHA512 8cc7ba242c47aabda04ec98febd5eeedf73c3a3c80d0b9eb8ac4fdae0be3eee10be903621842c1c4a287c1ec612329a0ecb4d9737e155d24410a37c7493b0983
SSDEEP 49152:6b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnRDmg27RnWGj:s3q6sjBiD527BWG
TLSH
T121D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 468a2f007dee9cb80b0e2e2e9d686f93162a25b78b7e9bd0cacba9a5cec0905f
MD5 1c346cc49ade6c700dea7bc5648fa988
SHA1 4c1b4fd7c7debd7cda287419c0e6c773c7a954c4
SHA512 4a778c882415c703b4661c96daf33cb635d2cb2bf094a0892e5754deeac6fef496fc6bb434f1bd98df23d30133ac7c53fb41999e247608a62060184e3abac668
SSDEEP 24576:IXYfDtczACsqjnhMgeiCl7G0nehbGZpbD:ftcrDmg27RnWGj
TLSH
T191650129B3D408F9ED67817CC9A2C506EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 7eb177afe4d86d718da5cd4cf460cb6043eeadf502ef4cd3d088d3327d2efa36
MD5 e70f9f7b6d96bd2fc91226153a7cc6b3
SHA1 9594e4fcf87a310dbed415d80a80289777b028dd
SHA512 bac94346abb5de4dc833163bbb2bc47d6937aa632df4575885b55cae7c695650eb3af77157f9454da2a66ae021d2b662fe3ccd0c46965813636cd13bc7a44173
SSDEEP 24576:A0Le5ji0hmxxrMVsqjnhMgeiCl7G0nehbGZpbD:APji0AjsDmg27RnWGj
TLSH
T1C5859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 33fd34bfec1ee0c989caab7c09739d4902812d54e7a8063d50b048e399208d00
MD5 f310b9b3a03127867e37177936513884
SHA1 091f2df9ff3586e3ead9be887b5b082a52608bb4
SHA512 eea9bc31a39926d409bba4730ff6116c9712d46b104376b4ee31c92048f9c6823eb639a1f2c228fde4809db5438c141799a0e122d34eba95f4cc907ba2208e90
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWn6q8wyunsqjnhMgeiCl7G0nehbGZpbD:g/ezSC6vUzPveHjygDmg27RnWGj
TLSH
T109755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6ad36320d3f29b68306e531f0e8ace72b34e1ba8390d18aeec0b0fce6dc92bd5
MD5 5055f8697db3ff96425ab0383cec183f
SHA1 72f4eafc3bb43d96f4f05e93c8d49afb9a669c67
SHA512 6042f4d7baed9aebbc60db1cd8f19cbaf991f4a99cb83094e0015882eb47a7ca91e13b42aea02f417fa3c352be11fc8f530fa257cf175c45dd766fba001f94b2
SSDEEP 24576:AVbqPb88hv/l+YesqjnhMgeiCl7G0nehbGZpbD:AVO88hXl+DDmg27RnWGj
TLSH
T1BE559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e2c6749cf8acb7dc4565621b7c41a96026b734223bbcead723aae6efd858d79e
MD5 ad3d77b8e950042781bb373ebcfe4c14
SHA1 10c9e3413dab927167e575ccaf1d78026bd2233a
SHA512 13fce41d44e769040ae2cf1cea0bfd1ff7b53f059f8cfc3c1d2324d503856f02788e5256e6b379b6be1d6733fdd9030acc524afe875776c56ba8ef469f6fa7eb
SSDEEP 12288:3LRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3LRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A4523BF964C50CAEB7608B5C3E9F11EAC137E56982008536AA37DFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6792c4ba81d189674293ba00fc77273506b618034385c37f8cf3e0dcc515900b
MD5 ea7beb935f9d9d2e5f3df2c8533574bf
SHA1 a5600682a1cc8a70068edf440474a8a379a1f1ce
SHA512 0a2261eebe7f4429d88b98c889940bd4f2516abf9372fbfd7116a0ad7139f33896adfd6206329bdcc712d446783d11e6000c95685aa21b29fe608e3e75fb1934
SSDEEP 12288:QeBNUbTVO86UmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:QJIUmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D365CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1b67595278e65269e4a1bd0fc427fe47c06c202f22d1b18a7f1bc67d5caddeae
MD5 3ac5717dcdea7e271310454550deedc3
SHA1 86ad2b418dcde6dfa51e2086ec075fb9391dc706
SHA512 7f92fbdfe7c7b30c17f465c38900cc36c00ef14690fb6f7efc24e6e44c56a0b1bc1d99ed51d27eddf4d529966c71e6255e05012686ec144127d4eb1f97c0232f
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THB:aQvGAdlCEL8c/DRNw5CLD527BWG
TLSH
T1BC266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f54220a66ee827febb129a1bce4143aaf2b522b51bbd195fc0e69fc25f465b5a
MD5 ce2d861ec89abee954cf47629df9a330
SHA1 9e637be726b3002584262e66b3ad972f396ca2da
SHA512 9c27b239e2ab2ee3d5b097a6e84cbfbc10db4a6293f24f08a2bff79a578937b154125ed550a4cb54f05ad2851dbf15676031e4a74d73528d3c0f57bc645d5178
SSDEEP 12288:+AwSfxL/2Dc3RDLLmt0LDQewsAjAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:j0ewsAjAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF75E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 74d771300b050155f53d2ea00a0929f3787bc299e8b86d11ccac8a37487af2ca
MD5 05bcbac3829c29f2d77668e85180c546
SHA1 4480c85b1bc9e349e17186f7820f540d637e4ff5
SHA512 90fde5a6500dd20a8738d40dcc1eafe5f25dd3148b3937feabe9652b93fef98028bef66186ae1a5d47ca783132a884670e2030d3020b842b495cb7811656cf0b
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHEVQBWG:/UEtQevvqc2W1cpV2tI32LB
TLSH
T1C6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 93cd62b67ef97ace89c7c3ff636c88f374b255a0135e876b23f1bf65f9ad666c
MD5 d68a8d5ff186f36bd2a8bfd9b4916855
SHA1 d9dcfa50555ef37d26f0f551a67bc61e1a1e537e
SHA512 93a24ebaf80898587865c2cc4a736e7b6da639dddba02f8b2bf4692722dc4755d012dd0e863ee160bb7f211462570cc9a41edacff579b54f7676c7e58c187a0b
SSDEEP 49152:YCbRquA/m2yL5zTfFiV+XenmE3/zcDmg27RnWGj:RoquVjnm/D527BWG
TLSH
T1E3D58D1976B8C1E4D1F6C77886A2C647F37178154B3097EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b6df8832dd38a210ea6ca9764cdb930cad2e9d35f6813379158e0e8e13e4e0ca
MD5 1500c0bd048e88b64ae3be2dd4a9ba29
SHA1 7c23550b24283ab59ef106ed1098d18f3dd2f008
SHA512 3d27a058be2f20798a431db665d044230178dc59eb929d087b8d5d55d467aebda4c79f2e87694da1d4be7c4bb6f31ee5784d8b40a000ea046541a3d1dae5a851
SSDEEP 24576:JAhGL3IFoiwtA5l7S53rsqjnhMgeiCl7G0nehbGZpbD:JAMUFoiq5PDmg27RnWGj
TLSH
T100359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6e9406f14949cc71050fc27bf1d200ba420243c1d48e92c96d5d102582bfb80f
MD5 fd84658fc63c98583d22a6dcc8dac890
SHA1 20a207edf44ef34283ebb2ceebac62ad16520a8a
SHA512 9b8238cdfa540dd62ac407fe93d73e6fec0032f0ad6f80a454eabee7118fa4042e87f18959765dd0b420714f11a775ea8cd159368b421bfa2f4da8fab0d88d20
SSDEEP 12288:Pmw5HEjsChNVBFgl0WDm+CHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:uwu4OWksqjnhMgeiCl7G0nehbGZpbD
TLSH
T16965F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3ddaad24ec2a470c0e0fb3ad3d8c6d8903af49f5e54c1c2a2946a98a2d0946ce
MD5 2b83b76d2dc207063c98882692bdbe03
SHA1 c46380f882068d5fa13e7aac36bf791d6b637e91
SHA512 2870def8744f7dda0733cf61babe1a28b078224ecde1fe1388500efd33b35e86d1b70b9732236b07574e78a46bf6a3ded39ff57cccbc1ad2204a02b4e5440ccf
SSDEEP 12288:xeZ1IyQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kZu9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B55512AA239820FAE163417CC5E5D609E7337C62673043CF166659AA6F73AC44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5934b111d0a7f6cc75c7c18281c8f08b62f83c99c78b4f6c8ef1e147dd4633e7
MD5 9d0ef2c4e47970c59e667c1b98967a4d
SHA1 5094d7a8764e0a8e7e3be7374c97c99f620bb878
SHA512 4c4a4856866b59b32d5e595b306c8c2f26510c2b9e5db127b6e87f9722ec8995480a49ebb31ed3d68897087c29b83cb60ad10b16b7e17b808e67986a30023e4d
SSDEEP 98304:fQRQyi36YOcPbLvw2gAf+PN3+D527BWG:uQyiKa/X+PNuVQBWG
TLSH
T122667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 207c8194efe959b7e9d801ecc185aa2a0c2e8a89842ff5957274eadb356eabf7
MD5 99d5732c5d540b34c727b74c68717295
SHA1 f89e33ddab34a118f7888313c693b16da1d2868f
SHA512 7bd2400c5158b58133ef4542370f7639213391536b997bbd24a45887a412b986919db0cd6d45c31736f8aa7bfb72f9251caef0132d3a50e386e40ee51efab179
SSDEEP 98304:TQRQyi36YOcPbLvw2gAf+PN3+D527BWG:CQyiKa/X+PNuVQBWG
TLSH
T162667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cc9b551740d76ec55075ea7a65f691e1b9e1f2c97394d6d2c68df381652f1c08
MD5 8337a4468da3e9d034fa366bb5bcfe6f
SHA1 b49fea7421fd69f5d788ec654380a8194ee8ae7a
SHA512 d8290f874569438b35ead61182418996ed403d12d971abc0ce17ac7f3af0ea8778aa656c885798dca2c5fa3ee34300d8c1f27a335309a8a891b860c99bd00aba
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0tsqjnhMgeiCl7Ge:g68Qg55nhceWu7PNU3/sDmg27RnWGj
TLSH
T1BFB55933B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1ad65111ae701fa3b3c5da93c67a77d623fec586219c8d69cf9a5ec9e06e335b
MD5 a1fbd87f1cc65b6852ece62d95626434
SHA1 7b5cdd585814c1ffe63e85028df843cc084c1f35
SHA512 b778c6bb922c50b9a5cff2b909a234d40a82e1b06176ff64071a06daf66e71aa65356713ac400987ad198093f693ee04c350d3801c83367edd8cc7a5573691c9
SSDEEP 98304:Py5112gYy5azzVvt69nLKnhZlD527BWG:CLIHEWhnVQBWG
TLSH
T10D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bba941b32373f8aed87992d2d773dd41a0eb4c21730971c751cdbfe6a052a9f8
MD5 3cc3054e83a084f69c6c5a50c5929646
SHA1 b79a2f9218b90f3ab63e69198ebc09c25cfb778d
SHA512 d83d15269f199d4e1af817b884463232bffbc1c5ca19324738ffb61332566475e5a9d219881ceb99fc3b973a792cdb2596530460ce0364cb884cf475cdfa91ca
SSDEEP 49152:4B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl2Dmg27RnWGj:Su6Jmdxd2d2D527BWG
TLSH
T151D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 156bbebf6f265fc3872ac85a948353d3644f0b2e1781da2a3d3cf096735f1bb5
MD5 8ee1510bdaa53f5a141105b84a7b6eae
SHA1 e4df1ef3f397c2960b385fbaf220743fd621cce5
SHA512 776c35cbedb437871997372d88f4cec3fa1c30c42e77f4258769e0dd2135ca61e58bd3a9f53f9c17f68f1e0087e79f662ae3d7cf5c4027e1a54d537f231e5dde
SSDEEP 49152:Z1hpsNoJpF1A63U44CwH7R4xKDmg27RnWGj:ZmifPWR/D527BWG
TLSH
T170B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9d8b3726804c452c0b798ca07f719812a009fb1791f19dceb128298bdaa484f0
MD5 2234f9c9803417002b5149bafd059ff8
SHA1 9314fc09c3c402b936888a6960664c63241944c9
SHA512 07aaf124f711f5063cd447ccdf7c378956fdda7e33a7018db056400567e57cc26b956519d1f43ba507ddfe12176a92fed9f51d9db40ba15bf7e50a56c58e0f9a
SSDEEP 49152:BSuZQIY0Be2KcRVtOnks6NMHqhDmg27RnWGj:P5dKii61hD527BWG
TLSH
T1F7C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 19d131e6e920edf4d410bd0b0739bf1f6577224f7d0b2482e4c2a39970a910ff
MD5 91b1ad59fdc9268b77b96953c67f8169
SHA1 6c3c81c86d7b592af0b249cbc68211f2b0b9daa2
SHA512 135a6b4466e2e4ab327c8d199de72b83596c882f2aa24c489e1b89ec20dace48d21405a6038b9606435e1fee159e89e8af5ada06eab686410918b60a825f0fa6
SSDEEP 49152:nhtSn8EApI0fig3giDn0AP5wGDmg27RnWGj:2X2imphTD527BWG
TLSH
T1FF95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 61cd32fe982d7335bf80e31a1a1cedfa391227347fc6eaa6f828c38fdbc21491
MD5 eeb1895f12b6440f40e3bbcaf0cd0da6
SHA1 074afa3e57849730858e93dc60a7166e830c2a9f
SHA512 25d5298952808d3efbb3fcf1d586607cc3113f755147ae49cc36ad95a4f8bf2d45746fb161d1668d204132000523e21cf8ee749730e11e2cb492b1eaa175a198
SSDEEP 12288:85Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:85sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1874523BE964C51CAE52648B5C3E5F10DAC073E5BE92004937A9B7CBEF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f348719b448a2f168ba95403163e0dc424484c0fe4eda5bc52ddda9b9ae87702
MD5 79d12a467bf1e5b73f871fccfbb73b90
SHA1 0bcd0371379f412a1a4b247d1ab0d1f27987fe13
SHA512 366b26ee568e8ea8107a6dc05f483740da33d27cd4f580b4d5b763f27b934822bb4d4ed5e52028fc0cc4e608dd804935aafa0397274df9a45657b7da698d4c1f
SSDEEP 12288:V8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:V8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1764523BE964C41CBE52648B5C3E5F14DAC073E5BE92004937AAB7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e45d960227e4517939006d1325a6833915aae0c943863888dd6cf9f85eca30df
MD5 162639a4fe7acf4aab3e02813ee955c4
SHA1 02627bafa6e279070533b3c92ea874f43f65e294
SHA512 929586279ac14b32d605794cbd03e310e9fd7ee20bb43339d7461cb135e4818a4c099f827882ce5f9f2480fb69eb061d1ca576a79fd10ffd053acfa6cf3df27f
SSDEEP 12288:QOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F34523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d40cd0695d1ed0434036e867cc2ad6bb4b91e596db3ef9b23ee0e454b7e5d5e3
MD5 968d82fd70ac23795f8b6a1947ffc2bb
SHA1 ff745888368173b06adce1258dad851ee9c543b3
SHA512 5523fa8d649f8e64990f0da475b32aee093e416ee36e6f9b14d77bb42ea44127f481a2048e44521bc6cfed90951a8c21416febc839824c4df470e389f079cfb9
SSDEEP 12288:QVLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13645236F675C00CAD83285B4C2F5E11DE8237D56EB30059B6B532CEE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 39638d31aa0dee61a80a4dbd544fc22a8a4679ff21bfe2f372e6fe040f7575fe
MD5 a56983d35390787fe3457065e4f96a3a
SHA1 9c25fc3702cebacb520f82c44ff176fbe311162e
SHA512 75dcaa534fb94cbe238489d6ee8fb009ad544d640cf035eefa16789c4832e7b89ac6dd0c32d29dfc0da1d1394e3cb48567452690ca12dd8d9f1b6f38d3a05900
SSDEEP 12288:ZDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1784523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d45b21fbd137a25e24b88ddd1f34f7db336b58abed9efb54b37a98ba651b2562
MD5 85d6ff5cf1ebc74418d004b65b87b5c1
SHA1 8cacaac0ceda355837d26c6076ace11e5dab7736
SHA512 24f7efc158e37aeb225a75dc9cdb3c051fc2716229d93dc8a91a29af288e61c50296e94eef6a7642c7636614d5b360c1d2210128779ce90d5710365b8e633d50
SSDEEP 12288:voXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1274523BE964C41CBE62648B5C3E5F14DAC073E5BE92004937A9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fbbd59d3ddd24cc49409eb12ea89766476df73c27cc3a398b96e998d239f7e3f
MD5 5c77abaaf58365bede46493fe2763e31
SHA1 b2aa61dd37da5e8636cf7f8d9a4dd433e2dbd8e1
SHA512 e6d79b109f39a1e8551b56be21a65f14462a3cab4fb2b6a943b7ed1d87e5cce59934bba9ff802433e3084f2ea12d0fb058faba7e8da45c914730be5febb8279e
SSDEEP 12288:1UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1874523BE964C41CAE52644B5C3E5F10DAC073E5BE9200493BA9B7CBEF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c190a025f09e259ec69fe219085412f50009260d3cca08e9eea40c99aed9d4f1
MD5 69e7d0bb270017d7d8abcefc329b5f2b
SHA1 30081a8724f1f5d91836709aef215bf4645460b8
SHA512 8efa0269c52428cdf8a2f42542761367b55835dac9fe3ab1d82a1f21859fd4b5c5883fd8ca0c15c13119ff70c777229442cfefcf28ba21418af9700ede3936e9
SSDEEP 24576:7ZMRzFVSOcsqjnhMgeiCl7G0nehbGZpbD:7ZMRzfkDmg27RnWGj
TLSH
T1196501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5521467f7ea34787d2e3c18424f2d1ea38d5b1356b82f3d91771c7b03c815606
MD5 24ee8148f4ad6f1e626c6ab44537d878
SHA1 aa0b638bef65014458928327177c7b8a82a842ef
SHA512 3e0897ecd1af2316f094c9ff69159c16f502124473327c5d75890b3dbcfadfdef44136a44afd7981e34840a52fb747668f9ce77893f0d973ba835f10ec63b636
SSDEEP 12288:4NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A64523BE964C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3af01ba8093e9ecd72932ff5b7fadf82e7f4b2464e9f17624cc39ac0567b6cee
MD5 9cc61da0e3d57881b56123b4bb4484c7
SHA1 d19036e0893bb45d5def517b762e0b96a2e921d0
SHA512 c0a8c6c0fd2f2e3283133c5d3d8a59c959e59bcc3c91ada0eb3a6de2c25f47c303a32fbddaac7b5e8b0e66fc940e5d0d8d6f7a454d3ee058990f2553058a9c6c
SSDEEP 12288:/hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1274523BF964C41CAE92644B5C3E5F14DAC073E5BE9200493BA9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 387336eab7d75bc4939ca8a34dccc50ce691890836ab2d540646968dc737e7e0
MD5 7610dc82348bb6ad918f8114d10200e4
SHA1 7339e3ae165bb8164488728586a13d60a7debf23
SHA512 4a1f2060d151b4408b57980854460dd7b4c60213a8b0398385a2120224c6e8047d3230985abafed31bc88dacd87cbb233eae6c40fabbe3b6de0681300e348863
SSDEEP 12288:dyPz5L8QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzyQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 63a2563e6a8c4428fcdbbc1a8c781ebcab61850174cd6bf87603e6d233cdc354
MD5 fcb3d7b5b941c190970638f23dd45257
SHA1 361ddd87ef6e3272e8738ca567967db961b6ba40
SHA512 65043dfad2febf25f80e241e021b497527826e50c1a722d700eff9f7544203cbdcf7628c41482ef08f55c87fbf6ec42d4d94ba18f369ad54f1ec89e71b3f65be
SSDEEP 12288:YNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1234523BF964C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4b89063e56431522e2a7ba231d7d03a3a78b001442586b13449a08a012c0f377
MD5 fbdfcab6f8c01cfb577786d919fb0c6a
SHA1 0c452f0f8445c8a13fd447e9e72583afe32be10c
SHA512 2c76eea28512e4523c2baf40c1be2081a0456bc28f6c0f726b281c500db606cd4e12e868fe9413baeca3e69a40d1974f5e0da511ebc0ae55ff2728fec430c230
SSDEEP 12288:pNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C4523BE964C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a417b7f21b2e6aff3aee2bd93b101fe0031a5283b84694a1164ae0e182ad3216
MD5 32d46dfab6f4b08afbe6ac29dd7983b7
SHA1 30c5704865f5d81cbf84eccdcc8e0619e744fa9e
SHA512 bd98a4b57564a01bf7fd548ec154cd32549312a8a41457ee95e07c928c56f9be63224e259e00bc2db2c9359e16dd9a65be9b29942de846dfcc7ef5f487ef5e87
SSDEEP 12288:LyPz5L8QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mzyQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d5a106c3984aa445030fc2c874c5be7ca42290541102fa96d9aed0dd8ce71b5e
MD5 95deb38af071ebcd7ac09a57ef405ecf
SHA1 69ea53413112a7d25388915786c729c7fe48ed22
SHA512 31ad11e78abfab5300c3f34c4165636b2d34ca5ad24d7f779c3f45f91a5867038e0b8a09af68092205d688b5f91790f11da80e73dfa195a644eed0c52a7f5a27
SSDEEP 24576:/TDaLl3z0zD+sqjnhMgeiCl7G0nehbGZpbD:/TuLlj7Dmg27RnWGj
TLSH
T1376501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b80f160c93a2e78b221920676504704931796f98d941f0482fe309c6e8ed4d59
MD5 d7fba362efbaf3a14146793502eb8e61
SHA1 d38dccbeb9c686f5487f19750bd0f1068a8e742b
SHA512 ef7aa52609b0722ded6117f6ac7d4f53f085d9f3e817c20f5b2182ef60dc4c13a0d58f24fcd30d732e4fd94ee4aa5c8c319f265cfd7e9b79ce419b11936a9fb2
SSDEEP 24576:L3vd9CHKy7GZKsqjnhMgeiCl7G0nehbGZpbD:rvd9CHKyakDmg27RnWGj
TLSH
T19175CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c8a4f1b3914bdfc495886e292d76be94de4d6760cb67a73c9077e701554a504a
MD5 26af3c3eedd166f09e9d853e655741b4
SHA1 2e18005be2e6d0f7051ec8b4756ae3235b6966aa
SHA512 5b406e9e4a4014cb7eff5475019a2ef49b3a2ec9e8c927e57190bd03c123d0a2938a45d8a711db625632ba2d3e12a22fc3d9d8d7629ee3aee40f391635d3f282
SSDEEP 12288:UuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1654523BE964C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 95bb84d65419a1ba8b0638197e9e4c6793de21773abf5e08c210475497267ad7
MD5 c2a80df983dea745305d2a66cae51fa0
SHA1 952fab9fa3b6b270cdd7bbe30baa0383785e3aa8
SHA512 249a02c5733ef1fbcc428bef365556104f27f8136de9c1c0dd5526ce6962b64ab2552c42ab6fa9c12386f1f5e651a1e14cb5840c35bd17a073b2999f6b538b68
SSDEEP 12288:mwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA4523BE965C41CAE52644F5C3E9F10DAC073E5BE9200493BA9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 192314db1437c21ebc0ba8812ff60e7aeaca16a6c0d2093e995b2c615060665e
MD5 79d8cc603e342de1bb665de68b53d401
SHA1 cf0e29c6578809711d1eb6372530d4c58fa97d63
SHA512 093aeeb030c4a7721e97492725f923760c4d5358766de418ae3582c74fa9c85d89aa2f6fc3283538591707755ab8b3ae2599d986f4a8a7e119c5781f50632d1c
SSDEEP 12288:2/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1944523BE964C41CAE52644B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 5fca29ca42db5288ce4803883444a586c1d88e50f9bcda4adac40ac9a892336a
MD5 c174c4e3c7a22bc6677d73cdc082944c
SHA1 8d01093d88a1e0206f1a88f51f30cb3c34ab9a78
SHA512 cf94153e7cfc04fbb32c09d2a10013b1f31be1fabaa473ab25fce2963e3074d644fb0c492a43a7e47faeb9d6d130111b6ac49e25e5de654ab555532dfa81f13f
SSDEEP 12288:XNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E4523BE964C41CAE62648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2a788872aaacec2b0f57db33ec7b72ac126393c870b91bfa9803b76833b7278c
MD5 8a56397bc4beaa4742757e31ff1d96b9
SHA1 07a4a18fc9bfac4f5ffcf332b19d7d033c1ba81d
SHA512 0fe6a061c4482ad00910a51f5ab3e46f9a818a6916dd7d036d05d0874ffb283a0228cb1f2541d646d28f5476e8a492d6b051b1378cf0eef903a1c82374080ca1
SSDEEP 12288:yuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9abe62c5a19f7d94706c57359a1f749613dd25dd864903a2f811bedd8774d326
MD5 2793657ad7b94e6809c0e40da0ce2ec9
SHA1 8818e5f430277701daa1d74d80e6736dc9d8086b
SHA512 d4f35adaf215a0e530717ca2eb136e5fc0ce35893846db63c2b919a2db59b16b0e2dbaf629ff228c9e7433d66dcc00d58b853fd63bf642331710d6fd8b2cc2d5
SSDEEP 12288:gFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1154523BE964C41CAE52648F5C3E5E11DAC073E5BE9200493BA9B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 fdbc96ce8e6f0c2a7dd4ece2ba8b01a27f7484e5bcce25aa83903334da5921a8
MD5 7228237cd483e550978857314ba46ecf
SHA1 dcee1c4552642f7bef24766003dab21ce4cea20d
SHA512 715a2333a0a20f1fd33f6a16f2be7a10f9f784958538a75417d9326120379161cc80ccb2b5cc4c852aa74e6677f4f0d62b3721f16b590040df28babb3f772d0a
SSDEEP 12288:2DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A04523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 9ac1208d2649a4a7a40f0db93df2a77533e49b1a979abe9138c0f58e5cffb40f
MD5 ca070468c30e9deaa54d77c55a53a58f
SHA1 ee7ba3b27f09edcf1116633c7748bb83cfb7759b
SHA512 c3ac0a641eb46c9952cb4481fe1b676aad34f2e9e782e19152ca6140e88f53c9e6f8f53ffadf1882e3694d96b2137abf245ff89b445d075e7cbae97d7f21e3d9
SSDEEP 24576:/fwvUk9RX6wkyAIxsqjnhMgeiCl7G0nehbGZpbD:tMnYIFDmg27RnWGj
TLSH
T1E685D029EBDC44E5E177913C89B7860AF6B178691B31C2CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f27702dbe7d81c0734dd4eb823d8eb921d04ab6edbf58355cf5fc02e6822bc3b
MD5 a27475dc62605482dd7cca82a61517c8
SHA1 078000215be6dbbc12dd02f9c660400057272dc5
SHA512 4835846d681f1762a44fc4be623183f8209d9fa7800fb729230d0ec08040642724d831767d69184a747bdb945fb7da81489c7cc07eabdbaf7debde10e0eb8212
SSDEEP 49152:IYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mDmg27RnWGj:fySzPeD527BWG
TLSH
T1C5066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c4e0ed42d892bda929126f60774834ab43303152b744c59c72f834e29ad3f8de
MD5 238b56e8c872a4d96d4e3bcd65d5a726
SHA1 4f244869724e4414abd432cf3ab72e0f07ff9bf4
SHA512 a90f4f11c205e6d108264f28e293cb7f70f0dd2aa973eb94e501bbef24ed685a123efc319a1861d0410388fcbab7f746f0a2d7c808d755bfb24101e299c78db9
SSDEEP 24576:p47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYssqjnhMgeiCl7G0nehbGZpbD:p47JUQjTirIhCnDHUPfF/2Dmg27RnWGj
TLSH
T1D965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e9acca513058602eb25d1688dcd239565bc706eec448da4ea879a49aa9fb24f7
MD5 c566381111601e2fb68f8e9e3f75bdd5
SHA1 a139ceb226bd7037a17fac5c0d6105ac8400a7d9
SHA512 a8fe09f33af3e01057d9ca7469b9a309d8a871e5df077c3e0f73900fdfb6b413ec6f9e8c75c3ea2ef4abc7499b7008dc8f706712ba8f91e5d95aa00d0376d0c9
SSDEEP 12288:Ubsf9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7dabb2ec5ec3d89ba7c2be3c4777fae6e3edb57c095d674238bbe107e9d8ae3f
MD5 edbfd3efbd00203ba87af94f21abb74f
SHA1 10f83323e8a4fb9c7ed1f6245547b50a910f29b4
SHA512 f83b84ad71e2b56cebb83101e6e8e1c365036cb0534cd72d9d97b875776caf5242b652cb4c5d262fb26b91b853559f65d605a1a5b4e3da459ab707596861c9d1
SSDEEP 6144:IsBC2na289VerERvfKDexHE4Fy5nY5PTlYuI4Y4ULuNtI9pJ4I5E1YfeG0mYUhfK:JjCW2y5nY9Tle4U74I56YfeG0mYCi
TLSH
T1D9351711B66BD75FC6A940325E32D1CCAB707D01EE45AB0772C8473FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 bf24f2ee1b8f3df381a647b320b91069d36c8e4ee00e1c0dfb18157859eb861f
MD5 0cb408495eb191f12b3270f40b1f485a
SHA1 ecd4a7ec7310ef6c974dd5bd01e74fbc6f31f100
SHA512 d326579a65241e966c70535146b0a219b5291b6327da867d7a12ed429fab29762842e0962148a19fd429beab237eed8d4e2c7e273195fe79063e035f0f55f0db
SSDEEP 6144:a78lOlgFiIuIa0AJtzM0+KDexHQfe/urSD+KDexHZ3azP9crbrGNnJwpyXd:zlOlgFCzfe/urSDg33ewyXd
TLSH
T19665F841A537A39FD1F76072032A5B8DEB74EC02B7056F2663C8453ED86A725A0BD3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f74592eb59a670c1453f2e71aabbd0cf5da1e05cada860088172969ac63ced62
MD5 0b4560c7e61207502285d22f479c6b96
SHA1 8913a854379003aacd32aa8aecc7a9ec235c8039
SHA512 ccdb77ce36eb7987bb55d994e30440692200e7e5b77de660ddbfb20881106334c3daaeeaee9f50fd77f4997a417d557f635579d1dfa1c556e33e904a6ae79376
SSDEEP 12288:E071Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:51sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1694523BB934C518AF93605B482E9E12D680B7E669F1044C3BA4778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a32218d7ef7ec11dfce755a7853770fd6c11132184a6263faa5c31697343fd89
MD5 660f83295eb03d24bd17612be095b91b
SHA1 107212e686b8f86b09d4c0fca159657890aa61ae
SHA512 b3e61357e97ccf29b7f009ceb7f51a93bad358bb81c29fd28e608cb0d50fb37e87376c5182b62c809264b9a8376e5c96e73f1c7615cefcbf87d03aa1407f7853
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYnsqjnhMgeiCl7G0nehbGZpbD:/gb4mBIBhGFYDmg27RnWGj
TLSH
T126659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 af77436a6ce38547af578c81fbe63608d2e1b367a62c8c98b6c3387348a99b19
MD5 0970c5fc8f351c2bd2d82eed9fcfc232
SHA1 5bcc951980abac51ecd77455d530a7e4658fa5f1
SHA512 c5d777299af813f88b5d61905b2a3a2d98318bf7030829493093ba96ebaeea495a82aacd18b25f8ba2707038171772ce5de08952870ee6ec3cf4d1092d1eb161
SSDEEP 24576:OG88u8FpJqH1bzria7/mcsqjnhMgeiCl7G0nehbGZpbD:F7ZFPqVea7/DDmg27RnWGj
TLSH
T1E185016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 4d8c22acef983d6bf81a061d599ad5e3a2538df65f563ff85d2d2ec25c0f2a44
MD5 64a84ec9fa62b7045ef55958f284e34e
SHA1 c4b777125de5f7ccb3f4c2a4d605faf37511fefd
SHA512 38ac2a551ec1972653000f69e18b58941880ed7133fea9df259e57cad2174878a1675899551c404b03d55e6d140c8d2f9aeb4901572b11de7248f4935b047eca
SSDEEP 12288:9HvUrBFrEjwaQ4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:9PUr+NQ4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17365F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ce663610d49d2f0864d649d69c3a4072b3baae3f384e6f4c934c126be59ac3d2
MD5 f8c3917c819f6f4267a122de8c0ff0b1
SHA1 a2328afbbacf33c575ea5fad57b43df475e2d361
SHA512 461a2b723f238ada277f1477bce8ccc3b1d974c473344be133d4bea7e5d93085fa6a3d5bfdbf02ef1476f671d0138eaf4fd17778ff142b598888e44efae51288
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUDmg27RnWGj:dG05lO43bND527BWG
TLSH
T1DFD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 08a52b40b5d0d2b4c775206bed59170ce7aff2223286a3ec7107a5993b149fe0
MD5 c926dfa3840ad22f518b1aceb4b298d1
SHA1 89b2a9260b2896b38fe385dbc53e98ae00df6e18
SHA512 0741202bfedb6a39bbd30d8ef5ce628b4be6773a31fe4cfdf8358e1cdf9ea7f9dd04f64ba8a3ae64bb4253b4aaf0dc988b5cf19a8d2f432a59f7e7ccf7079b81
SSDEEP 24576:1fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnisqjnhMgeiCl7G0nehbGZpbD:Va5POZ3BJt2pasx2+msDmg27RnWGj
TLSH
T18765BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0a8cd42ccc82fb1a17c44e1b8a06097fe5cca82422254a16cae62717155a7502
MD5 fd22381f39726164e368d7180947a351
SHA1 ac2c577d4e4496bba330cb4eec1c972e63b4ed58
SHA512 b215bdeab084cc46a1350d2640cac7e18b222a88bcc36b09ef757db23f3bc44a8f140ba447bfe21aadd263d98aeb8c8e3a8d9adbb0033287aadd3b653722cc93
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkEsqjnhMgeiCl7G0nehbGZpbD:4Nc/zEOVHFjDmg27RnWGj
TLSH
T1D8857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b3fddf286fbeca83edb2e731b4d54b2ea5c9480a5414570d25257227c8b99497
MD5 78a854512ff2c9e4f26411ab85f512da
SHA1 c0dbfc1ad2200c6afee64fc6398ccc9555a3aa05
SHA512 2e8199714e149de89f5e4eb8ee80e27f474cccbe066df9a1200a2a984cab171050a7b8a2f209ce5cdedb85547e219ddf4648377071fbcce7077a9bd45b74a955
SSDEEP 24576:KTkNvNnaFeYhJNtmZBm2sqjnhMgeiCl7G0nehbGZpbD:KTMwBtOm6Dmg27RnWGj
TLSH
T15755AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ed5a0401034fb0cd58b873099b6d6e284d7c23b775a83b28cd0787f9ffb604f2
MD5 923e05364d12a1a0cdd3b35478974aa1
SHA1 1cce076a17a361cd509a011f583e12c5a60bf875
SHA512 dc3a3b426209c3f58e89c211687712debad3b96967ce45769f74c6a2ee7e527daef4673e775967b85cab3dacde3a629951448b5897292e655be53bc46befec9c
SSDEEP 24576:hD3FHshBIYQgAZsqjnhMgeiCl7G0nehbGZpbD:hDVHeBIAAdDmg27RnWGj
TLSH
T11975E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/792-80-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/792-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/792-86-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/792-325-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/792-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/820-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/820-92-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/820-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/820-306-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/820-99-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/820-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1648-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1648-302-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2340-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2340-118-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2340-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2340-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2340-124-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2968-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2968-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2968-113-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/2968-107-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/3056-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3056-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3056-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3056-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3056-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3908-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3908-248-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3908-52-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3908-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4148-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4148-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4148-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4148-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4456-287-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4456-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4456-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4456-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4536-49-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/4536-45-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/4536-39-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/4536-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4536-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4588-324-0x0000023AA2380000-0x0000023AA2A00000-memory.dmp

Download

memory/4588-394-0x0000023AA2380000-0x0000023AA2A00000-memory.dmp

Download

memory/4668-0-0x0000000002420000-0x0000000002480000-memory.dmp

Download

memory/4668-6-0x0000000002420000-0x0000000002480000-memory.dmp

Download

memory/4668-9-0x0000000140000000-0x000000014089D000-memory.dmp

Download

memory/4668-76-0x0000000140000000-0x000000014089D000-memory.dmp

Download

memory/6080-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6080-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6080-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6080-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download