07620d53fc386041a27b55451cddc20a06fec2611882d4c0228be60982c8416b

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 1.4MB
Sample260816-tw3nhasthw
SHA256 07620d53fc386041a27b55451cddc20a06fec2611882d4c0228be60982c8416b
MD5 f790f1a520396acbcb842ae0225ee3c6
SHA1 0749286e2c5aada03cdcc175bafaa7c3c8e2ed5e
SHA512 82218629662e831ee164bf1bbc53c0617379db4e2d56de8229aaaea06b4d3a38e233cc6783dfbc6e367973b891951e1babce601a89d82aaedb7c77703119c510
SSDEEP 24576:lmVixB/ANeFzt7Cwwpkvnh0lhSMXlcj4E1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lmVixB/ANeFztWwMwLNiXicJFFRGNzj3
TLSH
T11565D019E6D802F8D5BAC179C9A6554AF7B27C4A436066CF1391396A3F336E04E3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5316	elevation_service.exe
4668	elevation_service.exe
1936	maintenanceservice.exe
372	OSE.EXE
2372	PerceptionSimulationService.exe
3360	perfhost.exe
3340	ReFsDedupSvc.exe
4440	SensorDataService.exe
1924	ssh-agent.exe
4932	AgentService.exe
3484	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\879d129de05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006faf16e39b2ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af95bae39b2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000423f8b229c2ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca08c7e29b2ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9e640e39b2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4244ee59b2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045741fe39b2ddd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
5316	elevation_service.exe
5316	elevation_service.exe
5316	elevation_service.exe
5316	elevation_service.exe
5316	elevation_service.exe
5316	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3340	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3340	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4932	AgentService.exe
Token: 33	3484	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3484	SearchIndexer.exe
Token: SeDebugPrivilege	4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	4168	2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5316	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 5076	3484	SearchIndexer.exe	101
PID 3484 wrote to memory of 2436	3484	SearchIndexer.exe	102
PID 3484 wrote to memory of 6080	3484	SearchIndexer.exe	103
PID 3484 wrote to memory of 2388	3484	SearchIndexer.exe	104
PID 3484 wrote to memory of 1280	3484	SearchIndexer.exe	108
PID 3484 wrote to memory of 1348	3484	SearchIndexer.exe	109
PID 3484 wrote to memory of 3840	3484	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_f790f1a520396acbcb842ae0225ee3c6_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4668

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:372

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2372

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3360

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4440

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2388
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1280
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e4f88c08172b1a80aeefce39f053c51f3c6fbd1161c30c6ef145e54618a129a8
MD5 e3372483936f844fa9a0cd595b3d3b06
SHA1 6aedbd1faf6aa54bd3ae1018e7ed2349e5144909
SHA512 f022e8b2df930341dad4a3061ca7415098a122f88aa26b8b31315f90c859fb2eee8ac73feb279c001657e6e4e8c710a715e5a6fcd1c3a05cdf5261926c4e3fb9
SSDEEP 49152:Cb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnWLNiXicJFFRGNzj3:k3q6mjBp7wRGpj3
TLSH
T17CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a6fc2caf88563751fdb135c3bdfeb45c33a1c393eec9f101368575f63af91d32
MD5 2d304c938d6945d66a87120e34743b59
SHA1 e5768a43073ed1e473a8a92766bd2a1c55746dc2
SHA512 fd9b4ae4a43050f8ed4a5be7489c8488ce4dba2a2cfa881d9d7a42a75400c90fc6363b420c1d2f59dc927aa406c99a0d0f7064ce4983755d8d0837067cd7a546
SSDEEP 24576:nXYfDtczAd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ytccLNiXicJFFRGNzj3
TLSH
T10B75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ae389803b06b67e074e5c5d61fac3c7eb21aada70c90e4e0e51262410642dbcd
MD5 298cc450f12464905eb9b4d8d6635858
SHA1 6ecdccbffc8db450f567dd7ae78f18ea1943b853
SHA512 8faac06bd55cab4b27297aeddd34c66c0e65ab0f03c63c0fa9989ac0d4dc31826f47c1b810d49dff7ab1e0f5ffe21714acf9c25ababb153d1b86e3dca50bbafc
SSDEEP 24576:d0Le5ji0hmxhrMe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dPji0AzHLNiXicJFFRGNzj3
TLSH
T15D95AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6d50d132ae1b4a3dc600346fdd01b71e407b12df730ad143a92f6c9d4e686574
MD5 16021ab776117f73dbd0519dc725d9f4
SHA1 773508d4cc5dc6b7a3522f7fbda013b78928f5aa
SHA512 0a4a84fa7ffb80296bbe71f8fb12027a4989f65503a261d3f25b65458315ff86589389f818361d2d7bfb9a9332e6e625a8462b9200ce8d1d0d80c28d7ba1a760
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWj6q8wyuM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:p/ezSC6vUzPv+HjyrLNiXicJFFRGNzj3
TLSH
T122756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 33100bc81e535d86a55a788e1154eaec6ad68951fbf07de0bd2dd61535fdb779
MD5 b381e441c6d3b4dad48daa995433d6ba
SHA1 5a3f8341e5ec5533e684969fa322e045f5f1f143
SHA512 1ad1ed3cd0eadf31a7e241ef55111c378b17b7a4c1842c95917d83b2fbb8ee67c55e7b514da1875f1eb39fb67f9f43bc105ec01c79519c1d92af4893834b5032
SSDEEP 24576:nVbqPb88hv/l+BZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nVO88hXl+nLNiXicJFFRGNzj3
TLSH
T16B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 187aa17653eaeb5d4c4801c67a587a5e14c586f1e3ee040a7a412fe85d218940
MD5 da6f5f5f5b0e81cb3762321e017a6526
SHA1 b02f09350b97cc5d9e1d869a650e2afbf9e9884b
SHA512 651701390f60bc6a6d9716b8e9cad67495db8e006a95285f56f7f079861ea917d81da33071bc5dc9e78affb31c5e7c98c916f24ac652b6cd6a3d160d51278766
SSDEEP 24576:SGa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cLNiXicJFFRGNzj3
TLSH
T13E5523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 1de4eba989edcffb76744997092a753de97d2cb423a24540c978f043a7ed6873
MD5 463d084e2983c8c5769c67524aa683d2
SHA1 39be64c87a9080ba527bcc0adf3a85574ef28aba
SHA512 10c75224e2633dc03817a7d935f56502d7d03a30c6fd91c99ee35cde5d1d801fc4bf50828560bbed5e4f1cbcde281ee72f6142042a13b99957b7b88742f7fb62
SSDEEP 24576:8JIUB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8JIUBLNiXicJFFRGNzj3
TLSH
T13E75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2f6d7fa772c8711fef7419070e1188ec60581d610835ef4acc5a2e4b2b6f5080
MD5 a79a531097e00414e9b95883a250c8ae
SHA1 7838a264453baa197d33966a4ffbb912fcee2cf0
SHA512 3e67fee0cbd06e78f0a6eda1adf072b6ecea66b21b2605334c111bb12aa10d24fe805033675c3b5e448ec983ad02b357619f0f34cc84b7c1a8121be029a52109
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THB:NQvGAdlCEL8c/WRNw5C87wRGpj3
TLSH
T189266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 14db5caa7c2ea20c0c67692c9a8c2f5d2c95dc5ea18190cf6bdaee89432dfbfb
MD5 047cef837f2da747c957f7f72da4f78f
SHA1 49d50d5f6dee4962b239312c8fd63560fb3479a4
SHA512 34b2d58b5a9cfc2bfb76c98e65c0a197c14bb16785ad4e1998173a03ea1d79504ef328bf5fb06c7fccfe3842dddb0e915e64df84c45b993f7fc89d5b7528658f
SSDEEP 24576:3fewsAj3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vlj3LNiXicJFFRGNzj3
TLSH
T1DF75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2cfb9622f4831766bfaf809e54f60644f0e17db2086567e1f94598a963d6e0bf
MD5 ea008d87e3c046dfc23ba14b915e6560
SHA1 1d08ff8111e7c550c8b5c81ee39f45d6b2992d40
SHA512 94ed6ec823a7538662f6fff33b2d6cd0375df2bd5734dbada76ec1a9091f5088f307e94edb58214e00079b28de97c4e99037aca5b0333047f484ec38666ab670
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHzF9:kUEtQevvqc2W1cpV20I32x9
TLSH
T1BC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c96b5a0f0dd22ec3ab1003ee20a0b32f13085d0a408fee404ca0cba356def6ad
MD5 0dc98fe8008b26ec07fc6960b2b83c5e
SHA1 f4b54f65673142c75799ea1202981d4a59b046c4
SHA512 4f3844ddf79ae37c8598519de78c208baa128df09c766857d37a619105adf5dbb6d3f96f30ae83e4b66655525afe65fb8af375357b147a961de258e813d617fc
SSDEEP 49152:fCbRquA/m2yL5zLfFiV+XenmE3/zXLNiXicJFFRGNzj3:4oq2VjnmQ7wRGpj3
TLSH
T15DD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5530e85532fce91c357485a9f50bf43a8a7161ed9de477edb9dec40516b24918
MD5 ecd5d816d59d5034f10bd704e4a634d3
SHA1 b155bbb34a206d77d950ea2790a44a305655137e
SHA512 7cf59f9e0185d056733da8c482ec866375d25464dc6cc04c1d91a9b01826cec1b725c28753b62195858bf4843607a400e96ae9b069a8ebd1e260bde5756770bc
SSDEEP 24576:lAhGL6IFoiwtA5l7S53w/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lAM5Foiq5ALNiXicJFFRGNzj3
TLSH
T1B0359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5aaf2a0b67799eb57c0ce789e806da45754451be08a6b027ba953a70cdb82185
MD5 785f79b1094649c0fb2bd4bc0a418bc1
SHA1 93b23b94be1b9a110562f54006a2d4f9ff06f176
SHA512 ba104fd5ec074d02bb8d85d845e368b9f459f635e1704fad415356b4d667908c1a44962cefc0ecdaeb804c65d1b7dc32580d551af609abf614169ef1ba103ec8
SSDEEP 24576:zwuROWL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zwSO0LNiXicJFFRGNzj3
TLSH
T1FE75F18632980CF9E9B641398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 891fbdc795eee8aa0c2e29cb594680d4d520ed181fe62ba5af91aa644f58eae7
MD5 0e84cbab35aaf702e6f2c4f8e9c8756e
SHA1 2e2e4c561b26bec3bea48bc9358cdf9d895debde
SHA512 90e5dd801099986d379cd05085c4554496ff99e33ce141dff1e198641057b7846fa4d166b517b8e2a07c4f05510e2bae98d4584dde824fd17b9227b8dc671722
SSDEEP 24576:ZZuG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pLNiXicJFFRGNzj3
TLSH
T18265129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 94706527891608481aaf76a953fca50153efc86939b501a859af29b73e7b2098
MD5 af993e89486223604bd02061c877cb72
SHA1 eb6cd417696d30da99ec95032e127d7a77f1ab96
SHA512 57c23bd336b9e0dea1446f5ade8b2bc9a553066a40229d91e42c1f44f8ec60dc3b7647bc2b6efe6d5c157681952dacab06da3238415080ac994ff54cadfc48fc
SSDEEP 98304:XQRQyi36YOcPDLvw2gAf+PN3l7wRGpj3:GQyiKanX+PNJF9
TLSH
T1BA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 69c3616c72b94df10342d457b15717e21548294b3ad03408e646d8bf7e7add6e
MD5 1330e619cddd313acf7f26fdd8018006
SHA1 6322f274db62d4273abc4149ef40de71553f2946
SHA512 ed417cd14a6c89d11ae9b87f111098a558c462a9979156ca8ecc1a541a17ea62b94dda03fefc2a890a41b0819112d2874b9aa0c0fe8f6295def2d97e0de2fcce
SSDEEP 98304:EQRQyi36YOcPDLvw2gAf+PN3l7wRGpj3:LQyiKanX+PNJF9
TLSH
T123667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2930ede5b6a327a20187a16e6bf095229bf82ab0c2f39979fd6a2bcbdf63cb4a
MD5 d5a250e14a468bf7f001df8efde89333
SHA1 b270fa175744e8eb98bbcac2006f930ba2bc22e7
SHA512 e3c2d3bc2e2ae6ff00f75d45481561ef191abcb9c83b1c16fbe03759872a05e8b3bb207e84c15d320ee7a684707f3f9e29a14d619c2dd283afeb9810e8aa4c29
SSDEEP 49152:G68Qg55nhkeWu7PNU3/HLNiXicJFFRGNzj3:kthTRc/H7wRGpj3
TLSH
T19AB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c3d725c8ea1ee7fd10587cb0cf2cb0410e9ae8d2960855d72c06c6efe65b16d5
MD5 e5a562b137e1a11306e5f9108fe12a9a
SHA1 0fcbe8e92c5d68423cc387e016f14e7e4221e484
SHA512 10ee5dd6f12da49d748f15b397c12281ed22721306e1efbaf3f0148b8794b42feb15f896825fff0e80f03fb19278645fe3ce00c6f2a7cc32ffaf076cdcdcea39
SSDEEP 98304:Xy5112gYy5azzVvU69nLKnhZa7wRGpj3:qLIHRWh0F9
TLSH
T1EF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b7f7216d3fa46ea211d4704d1902d301153938c41586f703d672433fa4dd6787
MD5 cd52f63ccb3b5b591f887ae7767dc03b
SHA1 6e827d11acf744372f0b73cc354c79c9a81afc5c
SHA512 95f4948b231589af82f17c4d78ee06e51803ef1ff78df4ba870cc5dbca78f3e01218863143ec7e3b536859c440cb69df01f6fdf2bf10e92944ea282296c2e8f7
SSDEEP 49152:3B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gltLNiXicJFFRGNzj3:Zu6JmIxd2dt7wRGpj3
TLSH
T190D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 60473866c0d8723430d08d08f4544766b2bb9bff4ae25e2056bcf1c016b850c0
MD5 05ac865ed685e3d6398ea6190bbda7bd
SHA1 018076b390de584a2d2eed35bbf6c62f1bd735a1
SHA512 d087098a23ba2a2a08fdad55fc852cb2d21335bb43f4e95d113a9d8797106e32ab9e9a565499d25f9929ed1c33258a540616d0b0f11f8d83bc7d378c181faa2f
SSDEEP 49152:M1hpsNoJpF1A67U44CwH7R4xhLNiXicJFFRGNzj3:MmifPqRQ7wRGpj3
TLSH
T173B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1a1315f3117995e295ed88c40cbecacaff67a25961d90e765521aa535bb39a96
MD5 cfb7f3f8c07fdbd65c8499bc4bda2d30
SHA1 d527a35f75d6f46d3e90528336c7ad699584f422
SHA512 cb91d6f025fed82ff2b935f5af3800e1222a048749c30acb8b3296b0eb12b8a7e1738b80a7014d687d41a85baead6cacd052ecf6e2e32bd10ef73cf5120a935b
SSDEEP 49152:jSuZQIY0Be2KkRVtOnks6NMHqGLNiXicJFFRGNzj3:B5dKqi61G7wRGpj3
TLSH
T1D4C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3230ea608a1dbb4ff768477b6857bec0a192c7e9d2d195d2a4cdab05bf7542cc
MD5 663513f389b4ee37751d8605d4d1ef58
SHA1 0669679551728f575de7c544aadc6cab8e8669ab
SHA512 3abdd3a0afadf76e9ea05271ae11800438e89f03d3640fda0d1d9ec1900084ef71d7e6c3691e82dfe712f223f44a8c2b1f0dd8c6ccab7bf3ebb0d375f9270a73
SSDEEP 49152:DhtSn8EApI0figjgiDn0AP5wdLNiXicJFFRGNzj3:iX2iWphU7wRGpj3
TLSH
T1B795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 647b84ed8993d443421810701001efddda5e34ea8c3302fe70c9f2b65936f684
MD5 986036d8e05d8a01e02311ca54b4ef7f
SHA1 305a686c62714e69f460eaba75db823b1d5c6e03
SHA512 2783d83cde861bbd94a6d3af5358227da70853dffa8fae5c5ad8fa3dfa008480729bcb6ae135372a29f9b88e24c687f3b3e96aacad339e5fa10225bb657243b3
SSDEEP 12288:QQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1125523D3558955B1FABC0039C6755428F5882E2DEB5618E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 b38762211f9120ddebd33cb46c6862dd7a0601fd38ff9dd1c6b9f31333d8dff4
MD5 a2ac926dae0705be684ff458979541e1
SHA1 0ac53f44ad52effb03f495aa35f6d5dd579411ab
SHA512 c1c8852030d0536a422048fcbc20e60b596ae3f20378f1d79cb9941ce2237c7018ed495eeb53804ae7272d0b9189c2cbaa4e9789f7bdb226afd480fbf5aa3bdf
SSDEEP 12288:HXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1055523D3558955B1FABC0039C6754428F5882E2DEB5618E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 cff12d63aa1f0a29ac8fa519809f61f27911f37d78e680774057ee78523d903a
MD5 fd991fdc3eb1831f74f28665d409594c
SHA1 c0ed8f2cddef675d807887379dc0aa0fb2331ea9
SHA512 a48c71a7027345280d752c7df12507ba395128ed8a148d700e3c5e03f8ab7762a82e281c101c2a7d3d1e3183f505a285533abea2b8f8360511a82bedec16f68d
SSDEEP 12288:JliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18B5523D3558955B1F6FC0039C6764428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b97d4c45fa843f2ab71c6889b813590840926e4166828ba361961ad08a0aec50
MD5 c93e4c308e0f27effb2fe8030de2494d
SHA1 49c3d5b9abba1d6e4b9e4897fc6eb16bc0f16886
SHA512 51f670ebb34efce70e24c35132cdb0ca9696b74ee3a00e8a7f3cd7d860a923e55a8087d1e5b92d6fcb46dcfafb4a8730c13ee1dcd34063726b5f001663d6a91d
SSDEEP 12288:DVmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13C552393168900F1E9BD8039CA764424F2A47D6CD7325AEBD3003D1E5A75FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 29a8f37e9450b22c1f96c7acadf918ecbf993d2cc9fd2b1788048eb2998b7b38
MD5 522ca5d4f0417b7ea10336016cd77289
SHA1 fbb58018ca57e455745938a0def4718bf0d56a04
SHA512 bce33a1c07da3e0639ef93e0f09c380b593084a1ba61eb9f49516e9049fc611371c278382c1b69723f7ef5fcd6fd1f655925943542045409f6b1c60321255f8a
SSDEEP 12288:4+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1095523D3558955B1F6BC0039C6764428F5882E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 93f64f9200db5ec7250dca154d6cba32673d0c12af8af846659447f1ec53042d
MD5 1788f317d7873cdb84f7d8f1e6b4eac1
SHA1 1f11acb066a7c659cf85107422e8743b84571122
SHA512 99d88a304807371b4100e1795ef9c72ee5f6611071a9cf2c1d031abffbd0ceeaef346ce8e305c5e3dcba533d95e63338771427344b2079ebf2e14e686167a819
SSDEEP 12288:kLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1155523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 4a0646c0174512c4b9bc8cfda82da3dd15dc779dc158615de0520884171ac5ce
MD5 3397f2460a19afee14f8a2931e2aa0b0
SHA1 99784874fb26af9a46d8bf683ef059c86c648d77
SHA512 ca8be71ea29abe59141a95a6ac970fda4f39571e50f19b727450d73d015af10f2109f02f16fb7315b87360875d95e250c216d5b2efd3da939fa241c1d15aaa04
SSDEEP 12288:SviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1345523D3558955B1FABC003986354428F5882E2DEB5659E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c9432b6d1b262c9d7e4c75687f639d4e07b59fc933540a2709b67d8fac99e6f8
MD5 94e3913488302491b6e820f5d9c34a93
SHA1 47efcf053f44d42d37ea671ae0bd2f9cf1d9bc14
SHA512 6817a0ac7cd040a5a581811bba99fcd0cc2fae9c66278b7cbbfd7aacbabbca4abd213e93c0190f84f99a97deaeecaebf14d8e1d75ed33112df2351cdfed301bf
SSDEEP 24576:qZM3zFVSOD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qZM3zfPLNiXicJFFRGNzj3
TLSH
T16D750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 c811fe677acfca830d583a0b3c1f2f0d50c8d9b955a4c9069a23fd09617b2acf
MD5 32c4093bd456a3bb4df5127b76e13cc0
SHA1 29969efdb6494071dffd7b0c70d6149bff6a6231
SHA512 b6bae45527d0c35525deb0ebc37543ac293cc1efd1d3d63c9b2b65ca644b6fff8c74e174841cc28c923238cdf212be79a18f37d21d439693bb3dfae2ba7ab471
SSDEEP 12288:XMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3558955B1FAFC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 6ce0b44a46897a8bc5c375584c4ae1dcec4debb1f3a4385ad84c94a113468ad6
MD5 4a6c7b866d00b4340a7d86bf00334633
SHA1 5b22765679ce7ba556db2625e5f9664e3dc50552
SHA512 b1dee8f55503e478c5164e4fce0595810228d31d58331ea334971b2b7231fc4b148f7bfb621a53d550b8b876e54f64912b4cb36fb5f8b4262106513e47a1fa3c
SSDEEP 12288:34iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15E5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a9bd67e02dc71ddb4b1a5b415682bcba303e46034ac061e3aef2e88b7cd5286f
MD5 a58ec8e3188264b6ab09803ecbd91621
SHA1 17b922568d981e2494d011b5d7a4a79820b8c2d0
SHA512 77a84244e53acfd661de454dbdb05c7dd2a8f96e1611b2573c75e43810daea2d932866d390d8c6c8a33d93491ed8f196dbea38e4f1790752f589361a87eede82
SSDEEP 24576:tzyn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tULNiXicJFFRGNzj3
TLSH
T1E6650247729530F9E17A4139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 9e24d250709b43841736352214aacb5bc5dafae5b17b6b80d3bd25ce82edf6f0
MD5 a0413da9fd7e2ef5b00a1c1fdf33c724
SHA1 bd642128e73fb7664afcecc0f908623babb4121c
SHA512 58b407f92b1f07150f57f0f1a71e4cf29c9af6298c73f474079a152e9e6bbfd8e98ae9e3fa2550ed859c67e755d473005d6092f6b290b5b768b38479b8f919f0
SSDEEP 12288:qMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:q2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1895523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 883a75f832865bb2abe508075002d20a826cdd83c6e3eaba1400cac5289f4cd7
MD5 d0cb72dcec56966e0129c736ed4304ad
SHA1 7bec5f9ec22be8ff9b27a8f1d59de6c9bebd7966
SHA512 d6bf331a586a09a641bb8a3ab4daf789f0cd8961bd0c1bae13cbebded465d6a4d47d10fa8850f11def54029873ee50829b2870ba9e410cae93cc6ad4dbc7204d
SSDEEP 12288:sMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A75523D3558955B1FABC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 49f8f4d1645796e469b30fe318f617d4b713c1b5b8375f4811b38e48c60366ae
MD5 c074a4c7ff8d6d6ed63892daceb101f2
SHA1 c8a88117b20c0aba569682d518557c532d5f1b70
SHA512 d97a8c4b812097ce2a270d920c158a1612aef098d81f9a836905e13fb537dd82f8c08f6ce716439e98db3f940a258430ebbc1ec80c8b72acd80f435ec4cc6fad
SSDEEP 24576:lzyn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lULNiXicJFFRGNzj3
TLSH
T160650247729530F9E17A8139C9620911F3717C3647208AEF53642A7A6F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 636540978b9cee841243ee7c9a45d78377c95e899947369322ea703cc67c5ae5
MD5 a9a38d4f744b77d44dfce1795bf373ac
SHA1 2af1c065a8e9ae046dda4418f5ac633b362c7ad9
SHA512 cde15567c16a35959f4032242846ecc202ecaad0442ccde91bc804a21477fe271b3983550d12cff8e0cd773f97b9499030eef3b7c094b5d3627c7944dcda1df6
SSDEEP 24576:9T8aLl3z0zD5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9T7LljMLNiXicJFFRGNzj3
TLSH
T1727502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 12d1aa0376b40dbbc9b7ef519692a8aaae5b8ae1346a32394ddaf2a41473ef86
MD5 12e0f692de493185704a0d34591a478f
SHA1 79c737679e0b2aaa30d3c9844a7efc4a67cc05a0
SHA512 42101bc5cdadc0daed8582e0e5e3e0442835f56e441a9f73af3d9598e8d1b8b5e611d1a16a14f7a626771761970517ba521941b05a882558eac41e64ec369251
SSDEEP 24576:d3rd9CHKy7GZF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9rd9CHKyaPLNiXicJFFRGNzj3
TLSH
T1D385CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 efa12907cc1bda0a57c893112d8e5778eb123267851a21f969bd74614ba64173
MD5 d3fd8330b754ce69ecb7cd2eaec56e12
SHA1 2495b6d8a9c2a2814a7b7877f097e47648b4694c
SHA512 063cba6e934d6edb30509087969b26525df153568bd6c6d67adec15ade5a52ae18be4c386789c199c81223bf903164e60bb36e1b619b6a356feb22a84727b987
SSDEEP 12288:dFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DF5523D3548955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 4e6bbb48773ee61e2da4a7ff6666b1ef09a5f87cbed66c27e595fdef79565180
MD5 91c7eb16cb8a1fd76b4ac1b0928b6d47
SHA1 08821a6f5c291a7e532007ceaf889d1d647de51b
SHA512 c717886ae799612409b3d21256a61d1415af89070949383c883cfdee760d440649df646fad49f4d384c079f9e117bf325f03e190d9c9cb98dd66124f7f6bcbd5
SSDEEP 12288:kziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1275523D3558955B1FABC003986754428F5882E2DDB6619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 8a3493ade996e0db0fbba1b79cd4b6f1aa1d98977b113b5646b969eea96184e7
MD5 610a2376d89c268cee2a53e5a471c76d
SHA1 548a80c89a5b9e44ee22337a1d6bb9bd61eefbf2
SHA512 dacf165dfc3b88745fe2894201f7bead5f022439441245b2766fcc65182ebc83f1e6f7eb2d3cb4bed81010b5fdd597290fbaa460ba45f23095816156120c4007
SSDEEP 12288:/CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17C5523D3548955B1FAFC0039C6754428F5882E2DEB5659E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 1aaa53ad2de2d5a4a9e5f3da6203f6bffc09d7dd3fbef69479e65bee957b5882
MD5 93997aa4db384b2a800d14931511a315
SHA1 39a5d1a443d74bd4c8632b5c611b7601fb789249
SHA512 b292416d7eb019bc5b3b2ddffbd41201825440f562368bba17bc2eb999c9a53656d6525cf48e0d8ef7c49d6ae698c4c5ef5bf8a4770e3dd8009d046f5771e692
SSDEEP 12288:EMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DA5523D3548955B1FAFC003986754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 949a17717ee8aa6b03fbbec869e11a1458cb3386d3439bb4c2356d89083f830d
MD5 fa5c08b05f001070c3f31f2295f8e7b1
SHA1 42a9b5a82604446f802a6cfef83ba870f02eb6bc
SHA512 6a00fc480f6c142d9f3257b290b72ed2599a520ba92a62c53f1e7fbf54d3700ce170f8ca2d8788c2d1b9205649d91bfab50732457a277dbf1ad4fe76a5e117ae
SSDEEP 12288:rFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A45523D3558955B1FABC0039C6754428F5882E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 b38fd0c81d5ccccc1e769a3571e51977c3a6411a2801b0ed259ea2d2782af7f1
MD5 19c1026490b3fe5c9b426f25a0a66b59
SHA1 e00cbe8be6c8a551c4d093b6e90f388642132294
SHA512 4cdcfe7966608b77d492f3265a91d5a1b48dc6a0b119e557f1e16ad445acc4ff48ce58962a98c9e36cb8369b8d76bd7b0eb2bdfc353f30d7faeb8c4d034a790f
SSDEEP 12288:jkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ju/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 78c6bdd1b4e68e13bc5c84a3993482dad5e14300593c6931da926dfa2c6d4471
MD5 b5d927f9449b02b86d883cdc39a52a86
SHA1 514beea0d9b3f5ab75ad3c869e978b2a4dd8a56b
SHA512 173c39e3142de5b64d64c922b268b3540ff2c5e522dc9dbda87319a68ebf5236ca79b6ed542544e5838517668f61a1f6bccfeaeed568982c1aa88cbfd131a2bb
SSDEEP 12288:V+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1335523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 78d657cf692f4bcb02fca1ad4a90d4971157ae79b729150e915d4691ace17230
MD5 bd0a340b3df047445f3c45f27149a47c
SHA1 641322f61f370f700c4d9311e4fef9b936520537
SHA512 5b4cb76c4dd6834fa3f4319f2f9fae8931163c25dd2f37a0eb1a257897b010a39cff0b13941bf8c9b86be401950928bece308832f4471aab2b115b444c31de52
SSDEEP 24576:gfwvzk9RX6wkyAI6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zMnYI6LNiXicJFFRGNzj3
TLSH
T16E85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6b67c01fb39ae39eb47b754cd3ea3c33de8ceb7c219d0270e024b8f482c73acf
MD5 f0a1458eaaba9204021b3f55c79dfeb3
SHA1 06adf5bc138d8da42f5c0d28fe073a4665802b44
SHA512 00d812a02782d7836035bce9059519fede28a5ba7aa856895da42065292826e763664af84c1f94f27a42b28f691eb84da9399a3333e3c879d8bdf3d9c0d477ba
SSDEEP 49152:sYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09LNiXicJFFRGN:jySzPF7wRGpj3
TLSH
T167066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 45e6a921ead0124dd1aae211e38e48edbf81c46217330caa510cd80864c90ffd
MD5 f9fe8de9b8d7cce972088646ea8447c7
SHA1 292d8582357d0d5bd595e52a362d70e154f8a3a7
SHA512 af36b3db5109254d7907721f4f6b6e3f5e234ea847a71e37e6cba0150f2ce3648350af3af158b55f86f0c37ecb1b939fbfb4cf64c00e969acc7a0b4792de62a3
SSDEEP 24576:M47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:M47JUQjqirIhCnDHUPfF/tLNiXicJFFS
TLSH
T14F65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1743539bd7486e0ff101423fe682f2e0e23011c62cfb066403384baf2483354c
MD5 98614ec4b2dedf753b44fb1fcd4deb14
SHA1 a431dda35f5a5c67225dc267c156cd436296beca
SHA512 fe4fd7e607edb93a9a07f01670e7638ff43cffc793a548df7703a7645f3861f4480d0a77fce213d254e32bf1efa13afd4edce97ccfca725eb6a3278d7cdbc229
SSDEEP 12288:9psf8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15565F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 5f7fdd046d1dfdbc03816bf4368d9ca29c5639bda862df41ded8be1dcb219b8d
MD5 a6a65d1fca22c83a44dd6de7ac5de385
SHA1 56d5c1c612332a1b566b38cf5fc6202e5fefc037
SHA512 41dbb1675a322d315d203e6bf4df867e0d27cd862f8088042b60dd115356da0ab7edfaf0e479a8bdd2562e2b12274c23f86ee9a224d5d255ba2421015401a21c
SSDEEP 12288:/1Htu+vU3fQSL4YjDRtXtxc22T5a0eMOFQAAdn4mrm:/144UPVnrXD1uReM77lrm
TLSH
T11B254910766BD75FC6A940321E73C2CCA7707D81EE059B0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 7864ecd653fc527cbae91ee508342f5b3dd823bc8956e90dc399bf30ddb88784
MD5 e5e3df1fcd82675900eb821027def3da
SHA1 89a892116d3b3e46032cbb88d2e639efb35373eb
SHA512 63ce89dc854df00e7de04c8e49757e6632774ceeaf962bcc39804b617cbfadf7acf420d66c6fcac62cde26873e0babe8e3e87da786ef04455227cf00abbe8e93
SSDEEP 6144:X4to9DEro1Gv0FJwIIMIIjBqI9fqVvHwY26tMxrMGz6L2ux5wF8PAaI26tMxBzAn:IW3waPBqXTj7+0LuFjWM
TLSH
T17165B681A537A3DBD1FB6131076A9B4CB764EC43B3056F2663C8553ED82A721A0BC3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 3a2efe7033b956080ce3dfaea9e875fcf516e38c807182b8c3a5d37e3db12f02
MD5 d1a3a9e3f98f3652c31622174cb5082c
SHA1 bee52f694ec96857326ca4eddc70b9b7123c1667
SHA512 9c21aa82acbc116f908a4c56fffab1b94d38e7a8e246a3035fdbbab50f1420141508854ca9053e1843d2f7dc124c86b54ac3d8574997d6a40c45fe13e18d75f5
SSDEEP 12288:fF7UiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:V+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13D552393528D59B1FAFD0039857A8434B5497E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2dcf3f43f057090cb9c67fb8531e070d3119d4d3b3a40d4a0816c75c7120d7e4
MD5 49d7af5f4644296265fce9b2fe27be77
SHA1 aaf1e23b5b4b5caa011f21d14cdf249f33357602
SHA512 87d688e153910bc4ae573eca1a5ba133ca715b90eb3e6e9de5eb165a74eaa71d13f44330a106a5a2955f1d7f44442fcb42bc977a328b518d6c35085209e318e8
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Vgb4mBIBhGFzLNiXicJFFRGNzj3
TLSH
T1C565AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7b90780267ab041528cfd89102b00a4c756b558aae5afeed041460f33b97f273
MD5 6d053377ea2b6c96e959b0cb5262b003
SHA1 db2648617df66e31fbc60004e6c941227a06c08c
SHA512 e9470b80460d7e3547e4bdaf46ba62fcf37a7a66906083bffbe74bec54a58c1957abac942026332bd7212a49cf372b8479af17e5bcd77dd08f7e7722fc295c8b
SSDEEP 24576:ZG88u8FpJqH1vzria7/mD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:M7ZFPqVya7/kLNiXicJFFRGNzj3
TLSH
T14795F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c5d1be4cff157a807f26d06c8e93dd1bf81d3f2e49c9be47ba1f44cb129947b2
MD5 45aba94adcb421c23bfacdddd278b3cc
SHA1 9da7091f50da064afc95eda47dc43e9bab49beda
SHA512 b51ef240d02890373aa5c0699d206517a46424bee3b4d3dee620727352506ca021a010f5564805250833ce8a92da92b7f087aa6b190847fe81ce0cd43cb6b4ba
SSDEEP 24576:ePUr+NQP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eJQPLNiXicJFFRGNzj3
TLSH
T1EF75F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ccc4323bb22831025488888be2301d1533b9374d60400d2da8cd754a979110bd
MD5 60e3a6e82b3733dfe107b77b8b2dca6f
SHA1 35e50cb0e602f83b2b6a27a29c21c433d6be0b46
SHA512 5312bc8331b6b880ff9b64ff395d8a31a586f6677e287f63ebebc418180d6c415722aa1379435b927f61748f2c1ab354760692c66895c8a205cd6ed41b7aa8ed
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfLNiXicJFFRGNzj3:nG05lO43by7wRGpj3
TLSH
T154D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6d337310eaa8d76248357d7552fd83cb996403fa7e9a632a27031cd6b5f83f69
MD5 894c1ef4fe4f57097f64a8ba77e3ea41
SHA1 aef8759e61c3cfa7ddcc6249315afd1249ea38c7
SHA512 deb133b4d68e2c71ca7ace7ecbb0d321abb601ba21a0afa2310da8c83dddac2db21b6003c2a33827eff42145142c0806a2a6db36026aaac026c97e579188c85d
SSDEEP 24576:nfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn9/TwSfVcYG3K/cJHlnFR+IGNe8jg:fa5POZ3lJt2pasx2+mHLNiXicJFFRGNf
TLSH
T1C365BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 56496ce235cb7f7fe2655f90b9c0f721a9709017e1084682e0aa2212ce576340
MD5 01f05397a7cc4b2ef7f7410911e2f8e2
SHA1 5b7cac92266deca9485ef83458760560087cb86e
SHA512 775fe27bf82cb8eac496561c578f3a3b25b5fb4d125f1480a424cb2ca9e659bc0a215ccef809728fe88c06aa8eb1799c5c64be497611af1a132715efb020fcdd
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7Fkr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wNc/zEOVHFELNiXicJFFRGNzj3
TLSH
T163858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6129450ece655c1e45ebf6418486b169fb8f85db456e486147c0753d90c8390c
MD5 f3b13d8c056a6d3bfc2a6f42c837bde1
SHA1 881dcd1c73645a5a40dc734395f140389dcab8f1
SHA512 4abe1528086a325537491f4f3f3f6469602b1853d8f185446f8a5fc2fb3b719ccc36c8aec3d3be2eaff6660701aee343f532436c68da5e10fc15de01c4d74fdc
SSDEEP 24576:dzkNvNnaFeYhJNtmZBmx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dzMwBtOmxLNiXicJFFRGNzj3
TLSH
T14655AF6EB6A846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 2858b42e20db18e2621bcf54d49b11242a381a2756111d6f0616e24cf8c20825
MD5 ac3666fae2a0706bb9635d31ea79149f
SHA1 72f69ac8ea34d8bcc2573f4cd67b0771ec84530d
SHA512 53171eeeef5afe357db1e72a7a84d28cee57ae369ef8bb29ecdef3f2557f84909ace0acdc15b8feb0add497f49e5e732fad499e80c8e1ddeac6e9c550874f605
SSDEEP 24576:lD3FHshBIYQgAi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lDVHeBIAAiLNiXicJFFRGNzj3
TLSH
T1F785E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/372-247-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/372-61-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/372-55-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/372-54-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/1924-114-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1924-115-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/1924-312-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/1924-121-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1936-52-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/1936-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1936-43-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1936-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1936-39-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/2372-280-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/2372-73-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/2372-67-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/2372-65-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/3340-327-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3340-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3340-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3340-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3340-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3340-95-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3360-79-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/3360-77-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/3360-83-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/3360-295-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/3484-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3484-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3484-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3484-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4168-0-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4168-1-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4168-87-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4168-9-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4440-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4440-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4440-100-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4440-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4440-314-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4440-107-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4668-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4668-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4668-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4668-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4668-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4932-134-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4932-136-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4932-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4932-128-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4932-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5316-23-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5316-16-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5316-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5316-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download