9c83820291c35f6ebf4ca0a6d32afeff9b426e121a26e6a6dc5c1d54c0f828ae

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
Size 1.3MB
Sample260926-s2wayaxtd1
SHA256 9c83820291c35f6ebf4ca0a6d32afeff9b426e121a26e6a6dc5c1d54c0f828ae
MD5 bf793575f6564a55641fa9258268a241
SHA1 eb5c9d461e4364b3956fc3b70247413ad64c9e1a
SHA512 a81c1077c29d67b8154b1bcba0df218617ed33a5c7911d55eca49da30633dae174cf84ff137241316950336fe710d2dfffbb615e1342bcb9082611d7a8ff37e2
SSDEEP 24576:4uzu3yio0rzZK9bbyxknw4FYnshx8OfVe247:4uzuCijr8b+x4x8EVep
TLSH
T15155D117E6D401F4D06AC139CB22A122FEB5F8850A74B69F13B4472A3F77A645F2EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5744	elevation_service.exe
6124	elevation_service.exe
2824	maintenanceservice.exe
4268	OSE.EXE
3776	PerceptionSimulationService.exe
5492	perfhost.exe
3252	ReFsDedupSvc.exe
2184	SensorDataService.exe
2300	ssh-agent.exe
5996	AgentService.exe
2884	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\496a6bf3ebf6fe8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaw.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaw.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000edaa8d06cd4ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050e17b06cd4ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd741606cd4ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0c05b06cd4ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003842d94acd4ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000be9f849cd4ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001760ef06cd4ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe
5744	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5996	AgentService.exe
Token: 33	2884	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2884	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2884	SearchIndexer.exe
Token: SeBackupPrivilege	3252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3252	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
Token: SeDebugPrivilege	3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
Token: SeDebugPrivilege	3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
Token: SeDebugPrivilege	3048	2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
Token: SeDebugPrivilege	5744	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 4200	2884	SearchIndexer.exe	101
PID 2884 wrote to memory of 1740	2884	SearchIndexer.exe	102
PID 2884 wrote to memory of 1772	2884	SearchIndexer.exe	103
PID 2884 wrote to memory of 4516	2884	SearchIndexer.exe	104
PID 2884 wrote to memory of 916	2884	SearchIndexer.exe	106
PID 2884 wrote to memory of 428	2884	SearchIndexer.exe	107
PID 2884 wrote to memory of 2696	2884	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_bf793575f6564a55641fa9258268a241_glassworm_icedid_njrat_ryuk_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6124

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2824

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3776

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5492

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2184

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2300

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1900 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4516
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1900 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 540db5a85051132a37271a64c0bc19ac008589a93608173e4c8e9f532918c56c
MD5 a9d71d307a95e98747e6c253e7a122ea
SHA1 f545cd8f28dcd645fd57144d385954586fd745e1
SHA512 95ba65e43b44d2ee90de339bd912992137b851d0c6cb3da6660f2b777ff01a69673d3046ab8a75dff773278a0c8c7d531aa630b15bfb098ccf07d21a1c136f8d
SSDEEP 49152:5b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnEx4x8EVep:P3q6sjBjix8EVy
TLSH
T142D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 66ba695fde7b42f8b49ea03311953217b68ea8feb5d0ab4ca73ac7e29d6d6582
MD5 9175185347d32ccc482058ecce7aa7a2
SHA1 e663fd98b3ab3147d832221eb98939335aa544ee
SHA512 b3c7eb2c8cc8bdffeef87fa543d57da6fe6a67514b3b90cccc413ecb2030964eb2504ed7450b1b9df3a7073f8c4cf08abf60175d540db8ef70064c56a334d1c3
SSDEEP 12288:+1XLsswWkxy2lRq2czA8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:MXYfDtczA8yxknw4FYnshx8OfVe247
TLSH
T1F805F12877D548F9EC6B8139CDB28111E633B8954770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6598963ed8b0f663447e5a4bf0bbdd7395f524be93192aa3db156b3684b8cfd0
MD5 9634d3fe5f2ed029cc45cdb5a0f2fde6
SHA1 585fcb31d83a647182b76ab8087d206f13469952
SHA512 dcfc56d8dbaa7dc9993beb0037af239fd08d14ee3a1bccc17c79dd21923c2484a12c71bbfe705583af9c76cad3586b2c605b861ea2ab7333708afcd6dd2308a6
SSDEEP 24576:G0Le5ji0hmxxrMZyxknw4FYnshx8OfVe247:GPji0AjZx4x8EVep
TLSH
T10835AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 33d580db38fd5c3634789001e2db777ef29223a0570e1739f02c4cff4a399fea
MD5 2249f7bf427a7d1335bd6488b8dabf80
SHA1 980bfd9da7d2816a37db3d44e85992ef03e62f4e
SHA512 79290971a11d6fe35801e2144b98275675fb91bebf9d9c3fffbe034933d2901308c132a4b470587da46eced3df8d110e8ad7df554930e20fb1112114d524c4d2
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWn6q8wyufyxknw4FYnshx8OfVe247:E/ezSC6vUzPveHjyNx4x8EVep
TLSH
T1D5756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 25405a8b1e8bbba8daa833a0484efedee94967d287bcbaf91e56f116d10788fe
MD5 60cfc7cc0b413803f6f0156f8b129110
SHA1 b16f4d114e95647ad56084a91452dd5dfe92968b
SHA512 bcc1522f3e869e5309ca8887a9288d17449008b0344a3c7268c4d4daa2aef0459763d08ca63f2247dc031339e66f1990371563d802157f4c96048afeb2bcfe0f
SSDEEP 24576:WVbqPb88hv/l+Ywyxknw4FYnshx8OfVe247:WVO88hXl+Sx4x8EVep
TLSH
T172559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 869aee9cb3937c55f3a0d74435240ea2c3d22ffdc1390f23a86095469a54d5fe
MD5 ea84acf549d4ac1c0d6e82c3edbccc39
SHA1 5253df4c594548d9e7da11c162a96ddb1c4fde40
SHA512 b820fc03010e5f634843a9a726f3c83747c471d619e74a14c0bb1cded182abfe512196980722a20fc4852a24385d3b22b84b0d8272472230ce5c93a8db26e779
SSDEEP 12288:xLN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xLNyxknw4FYnshx8OfVe247
TLSH
T12CC4237CABDDE4E1F65E14331A7172223616BDA4DAB4C11BCB78B54EE0B0C50E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 33accf37d24c7afa354b04638f446472b3adea6dd657c52c79d2f1bd4190b380
MD5 8e8e36b3ac5201e300e929eb055b67d7
SHA1 b3bd56855544761d265017fdb53605b681ae9930
SHA512 1ad15ad5712ca74c46af28078bcddc18fa29363b7ea1fdfa4ea6275b2a5d0e489121359d53c752e63fd7b24601d3e9db9cfe2a8a82d64d13890278bfc82596c7
SSDEEP 12288:geBNUbTVO86Uo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gJIUoyxknw4FYnshx8OfVe247
TLSH
T14805CF7BEE28FCE2C27E5DB95B918200A77274704B6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1db10097989df1efcea5aa6f469329497aebff1c626f2a4a6ea78996c0b74a6b
MD5 ff342d20f7b1937e5bc079b5f203eded
SHA1 fc1b274ef8e96dc0907bb7b6cfe52b8ffbce34c0
SHA512 aaa419a53ab514efaa656b45da19ffa4c53712a9a09be8da4ac184cc8211d1e909e3b3baf80a08edb2b7dad5818a2940e69564918ad230d1d055839e316f4f20
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THD:ZQvGAdlCEL8c/DRNw5Caix8EVy
TLSH
T12C267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 1f6c637c6eaec519550c4162423367dbe326ea1f07f103d8c24b539f44315baa
MD5 49bc4f20c91fd96dab5c9c531138c1d9
SHA1 dc15514d448de3f04d123d08fb1ba67d5a5098d0
SHA512 3e4777acff49d28c71aac165697ce99f539095c7558982cdce1a3cd4ca5b078a99faae9b331da27dba7343dcf242598f5d8d36b7088ef43d051db82e1ed50b13
SSDEEP 12288:mAwSfxL/2Dc3RDLLmt0LDQewsAj2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:70ewsAj2yxknw4FYnshx8OfVe247
TLSH
T1C015E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3E89E9E99705D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 771c12c5badda5c3851d625a42eefcd8e64e6ea5b01c89d07f83de2924186c85
MD5 aff0056a0965361db6d2a8cbe9818331
SHA1 799e69fb60c5b4f3e2f684131326670bd9e59b0d
SHA512 b6ff80ba5b67548e6a25fd2929c1493135514803f0199a7ee45027cf1e75920d4d47011eacca7df48f728a961dd5b500b6f2f3d97b032e80d0ae4051fa6540fc
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHc:9UEtQevvqc2W1cpV2tI32
TLSH
T1F1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7e1ca29a7b43e4a62408718a5f07d559aece68a1ad1a12b81246078ef71b94a6
MD5 b9b7987fae25bcd7ceda6a6569c6fdbe
SHA1 1527e1103f74bc804b85d23c571272884dd71a28
SHA512 e7c7ede9cc2bacdd68f95a54b8581ca70d2ad03773f5f033eb3f17495a8c7f3d4fb5e2312b69bd1572b0fcc4f46480c68b1720e334b7d196344f3a8bc8d6082e
SSDEEP 49152:zCbRquA/m2yL5zTfFiV+XenmE3/zJx4x8EVep:MoquVjnmOix8EVy
TLSH
T114D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7630edea7229c4419774d45225455b0a8727a2547bf43b93865175459a05f1e2
MD5 74b848dfb073559d1a26a9e4d93b1b6f
SHA1 ac35a904827df766b6e14a38cae48d00f32629b0
SHA512 9f9354383a4b1ff970ace25188b5a7a9162b5d198cb6f3e8549dca53c5025589f7fc781d94090bda4a9ada119d93373f099cfa45f3e05f788be7e29fdcc588c5
SSDEEP 24576:VAhGL3IFoiwtA5l7S53Lyxknw4FYnshx8OfVe247:VAMUFoiq5ex4x8EVep
TLSH
T1A935AE80EBF955D4F5B3AA7899B69171EA76BCA65E31C20F1260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8eced64195bc85054e7ca43e21a9493f5f964e1fe0073e51015375675f57df8a
MD5 b8e373298c5f86513fe89cf15374cf00
SHA1 ff79d8ac7e02808c686b3b6e0ce08240ded1ecb2
SHA512 b1d221639481a463976bea4d8a7b21b60a68fdaae19f98134066fe5eaefa134fbe33065327fabd86c184b27eed55788fd7e2988480cc5abbf209b050c8971182
SSDEEP 12288:smw5HEjsChNVBFgl0WDm+C/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:Jwu4OWyyxknw4FYnshx8OfVe247
TLSH
T16905F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 52bf37fe73a698ca77cfd1fd3f7d3ee30664fe63aeada7ee8ac509f596045b5e
MD5 43521a5eafc417e87224196297f31434
SHA1 716e601b33965fc2579adfc5eda9ed4ccea35cda
SHA512 e88e80ca23610ef798dcef443dd7d1d7bfc59b4a718e661ead0b714aefe2dcd32262eaac9dc08c62651c25d05039c043a8069184ea39352bdc98fa65b162405a
SSDEEP 12288:OeZ1IyG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TZuRyxknw4FYnshx8OfVe247
TLSH
T1C1E412AC33E860F1E1A7113A89F15206E76274A2677183CF4768625EAF72DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e775c816e60d96957d0bd68542666cf7e9f8699b04a51d1d6f8e051b0dbe393d
MD5 4e045e17f1255c9aae385b20335f55a3
SHA1 089c89c817b544fefd32b586a61b4104d14f3b3c
SHA512 4f10488834b1f02b19583d8f1f12b70af014a49e68ff98508dc8830a80b9b7b99f15cb8d8bf7637b516f2fb5b96d4602318e0b1f61de401bab007584a00e3aaa
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U/:TQRQyi36YOcPbLvw2gAf+PN3vix8EVy
TLSH
T1C9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ec5631f7ab7b32a2359dde1868d924c815393eae6509f08ad48bcb92b0f85895
MD5 a114450b37f9b0af850e8520b806f8f9
SHA1 d42138106c4525b8c0c42c3086a29b5233388e50
SHA512 b9d6de6c7d8290e1b96dab848836bd42f23a47760484fc5fed0aa1ce70e7f2376cd4579fedb7f4baf9d6d6f9078426ed6baded6c4e2e4d42ec83d40953d90aca
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U/:qQRQyi36YOcPbLvw2gAf+PN3vix8EVy
TLSH
T1D0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f495e4f05d8608d55090563ca8b6db09a8bc3831832dcebca64683bf54f83501
MD5 c70b9532b2ba6fe8cb2b5ba3e0ed306b
SHA1 008823d15361a9f9967e7de2cb383023b3b451a9
SHA512 98e175c9f4d7c616c25bd907673b00c49e49bc34c8b42c3cf8390a4988b07b5f1ada62753a6b2a872c008c02b86abcf032f66b4290a009a91717e9f387fb5012
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0Byxknw4FYnshx8Z:g68Qg55nhceWu7PNU3/Zx4x8EVep
TLSH
T1A2B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b1f0fa36a2d124ca16a4bf5fd281f53825f8b33cc699b5263d61447959ca5255
MD5 4d2f098dc66962a8a1ffb44181e2dc6d
SHA1 7c497c5c9079785b103f0847bf7f6442ab7f19c0
SHA512 3f99985e6e778dd5562d1f6669067b47481cd947ca4257991cc7a2b1caccf268f4430dce59fa2758904efa39c7309db67f429995b749179276d55cb8f820e8cf
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99J:Hy5112gYy5azzVvt69nLKnhZ4ix8EVy
TLSH
T1E8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 386493fdb0d482e20c5e6dd35dbd5913725942f6d1bbf07afa889d4576577316
MD5 f7704eb01e594b7f2a79a248a83da2b2
SHA1 a939733e7e9480eac6915af9f694c38a20cf4760
SHA512 97874c1cb073af8dbe1cd353342980db6f85af4ec3c95306e6afd236af7150f6ea29ca066bc35568d27d2f540f0f9bda78868d89a017cb4d7cdc4b0244a2995f
SSDEEP 49152:MB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glHx4x8EVep:Gu6Jmdxd2dHix8EVy
TLSH
T10CD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 912a54bbbbef0949ae7fbc902e0fbeae34b278841b7ac5b40c4e2ec235cc54a3
MD5 890aaabb1f3d3cca65ca624d1b5f8f12
SHA1 f8e3726fe689f7042c2a4233c63135f3918cd3f6
SHA512 623832040c3f029196cef198abf58bf50fa645b0e1ec0043e73d9a3b381d8a6971b95e5f02b6e9f63ae3cc934e598af660f397b4824fe00089b6f95ccee86062
SSDEEP 49152:h1hpsNoJpF1A63U44CwH7R4xrx4x8EVep:hmifPWROix8EVy
TLSH
T1D8B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fcb7139d12727d90cf052caf0a46743b809029fa3ab31f69d85ede286217511d
MD5 3ce6681e2158e28f035f2850ab6ed5b7
SHA1 b38fbce5a0b2762c98c0714a4e821da35d925c96
SHA512 7ca26984fd39dffd78abfbd87874b07c36be1b8f40b4b533ea18e99080e1f5b02206e396a62d5498821f6a7cdef3b34358f38ebc4c60cca0d26fd829df9ee969
SSDEEP 49152:qSuZQIY0Be2KcRVtOnks6NMHqUx4x8EVep:05dKii61Uix8EVy
TLSH
T100C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fea76cc86913113fc84a25aa3eb64ab09b0c498a5979e3c35c334450bdfce962
MD5 e772ac9e4e0fc4dfcacfd1a54dcd58b8
SHA1 652e3be40463975ca4ec9156836ad744b2090d98
SHA512 226d1df71454ae98afae1269254c79ba91d87f2366a7e37b0176351b93eb23cc950445654ff73d2eb9c9cc6ee67a923565512c17215d6d3f06c51fe1d861b727
SSDEEP 49152:whtSn8EApI0fig3giDn0AP5wXx4x8EVep:hX2imphiix8EVy
TLSH
T1DE95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 be38f26e426f7020e6574d61aac6b1612938682c7bbea5ed8e6dbb620cc8dda9
MD5 d3c5c139560aa5519501000f29ee4e95
SHA1 2fbf64d1abc64c78f0b0fa6a86a834a038a9dc29
SHA512 f5030c42a211e02ccf44ec4022eee7b9d370d322e8ba00c37f3b0f2666990952ee5b184fcef4eae6b4259451a1464270c3ce9ebdfcb295fba98931c4ebaef860
SSDEEP 12288:+F+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+Fyxknw4FYnshx8OfVe247
TLSH
T10EC4237CBBDAE5E2E50D11734A7133667609B5A5EAB1811BCB6DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 fb01e2e90da88f5ae29395901b4e6e4b71179576b7e1ccee46d2ffc0d3024c8a
MD5 fbc0496bf173b438bfb5f3cd7c0afdc1
SHA1 ce881b3920ddf8468f7dd5f00d5fc3be8333978b
SHA512 85273e36818b7e7b3f1605406d5a3c3d691713e902f95947e07e1381390e7eac6129ee2cf557f4efd7c8bd25adbb1cb3c17b8be9aaa5a01669908cb1149974e6
SSDEEP 12288:ha+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hayxknw4FYnshx8OfVe247
TLSH
T1BAC4237CBBDEE5E2E50D10734A7173666609B5A5EAB1811BCB7CB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 e2467488c994caf1f1c1df3786810a5287797f7667be50b9f4186405ab50f01b
MD5 3bb4717900c35b1900be8d54d0ea8b17
SHA1 9f0772528a95a85453d79be165b2611d87c742cb
SHA512 efe9ba85653f01fdfd1aed029f54f0c6c0dc250c10b6752e358229a51f10ab3b6ee4b215cf82acba11af96a435b852e9513eb3e5adaf926dbbb989596b4021f7
SSDEEP 12288:zg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zgyxknw4FYnshx8OfVe247
TLSH
T1DEC4237CBBDFE5E2E54D10734A7123666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 1d06abb7b1875ab0e7f2c0d93da0a89173cbef4884dc476212593e2dd146f8bb
MD5 e84e66aca48689b9502ece0d1fee0cdc
SHA1 df7664d4376bff26d5cafd860482afed66da14a6
SHA512 eba09947a09ec43048efa04d21c70fd7a33d7ce9837865033b793d866d0f2e1eb95bac152d9f894e31912d76cf320e03035ef253d1796c1bd2ecde9cf34050a4
SSDEEP 12288:QVr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Iyxknw4FYnshx8OfVe247
TLSH
T1ACD4237C7BEE90D1E45A51738A716222B365B8E4E731C25FCB24750EEDB0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a5ed66167d4cd1d581c7c1de1d117bd60c6e51263ed6d289867deabea51d91d1
MD5 e19690e1355ee08740e94af84516cf7f
SHA1 324bbee745028e793150dff05477e7378600ff4e
SHA512 5e78a8c857e82dc0687ca775e8927b91f26c85f660b611b0cb07f0f5b2a620c39dafdb37386a5b5b2247c4155460b5fa5f3038ba9d53a143bfafc002d9926448
SSDEEP 12288:OT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OTyxknw4FYnshx8OfVe247
TLSH
T118C4237CBBDFE5E2F50D10734A7123667609B5A5EAB1811BCB6DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 b99689dbbd1e8d0a62ac66c391f42c4744ba3162eaa3edd933d647097a0e2dc5
MD5 766d3f4408a4ff3c8aca416c402cac0e
SHA1 e3702e9c091e5395f47bcc29b9ef7071ae249c2e
SHA512 e1eae774344bc4419c889b2eddad8038224baac7e1712435e56a077dca3d5df08a20176efb146aa47c283d2be4043400d97278d5286b5e6f6055582085680f8d
SSDEEP 12288:wu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wuyxknw4FYnshx8OfVe247
TLSH
T1DFC4237CBBDEE5E2E50D11734A7173667609B5A5EAB1811BCB7CB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 8909dbae01f7e23341e5811f7588a9c46e7704bdd30a5b5864b46ff581014ae9
MD5 561d2c6259766fd3d9cc3e578ebbbecc
SHA1 93ae485bf5b5898c47584295a4bffef68139e43c
SHA512 ed95bb97c766e524f9ba2a12112cd2e6c7c06a968b864da8d018b8c2ef7b20a33b0c9581c253e71f8bd37d0978b97e285f9db7272bf6ebe9556669256c12ceb7
SSDEEP 12288:ni+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:niyxknw4FYnshx8OfVe247
TLSH
T17EC4237CBBDBD5E2F50D10730A7173666609B5A5EAB1811BCB7CB00EF1B0C60A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 24e6319c36b946c4826f693dcd8efbbeb8ea310e5a00ac6add116e44ed481025
MD5 98d66053297e780b7c2103cc8ffb662d
SHA1 1ff64ccad7e366f3b11a9deb87a461c12a0ca9b3
SHA512 3f2ee73a13fffa60f5f21d4f78d54c5ef709ee121ea209a90da43682fdfae55cdd1e88486465238295ae32d4565e1323513885c167f42a4247f1c0f636e3166a
SSDEEP 12288:GiZwbVzzFEoS2cPvy6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JZMRzFVSO6yxknw4FYnshx8OfVe247
TLSH
T1190502A8B39018F4EC67413FC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 762caad2ad79e25b25da54145bed768a77d779305e4daa9a24fc67fb8db2af41
MD5 473c078b12da3a8f5c5c8c162b2f968b
SHA1 a1fcf6fb0a0633f17a134f513d596b42b6264b10
SHA512 0f1c0e9012c2047c8870a64f671fd730cd750d20cb4cedba23be17efa3cb10132d3a7f08426471ce84ee7393d02e1db7b554c264ef8a49f235c1c7847129cf7b
SSDEEP 12288:1h+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1hyxknw4FYnshx8OfVe247
TLSH
T15FC4237CBBDEE5E2F50D10734A7163666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 ab83b516cbfc380bd663c5813d66781ac539d63d45547718216d0670574440d2
MD5 79b5d899dac6f3d59ae3dd6ba2b100b0
SHA1 b0d362efe2f1950ba6157c9b681dca6552b1a3e4
SHA512 c56be5026f774ed0f07f804b14c2dee9f839b1fe18c1fee1fd9628043ba0265d025b85d9c8f2fd311283f36fdfeb417a070564e2003fb6e793920b5efeb4384a
SSDEEP 12288:Ad+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Adyxknw4FYnshx8OfVe247
TLSH
T1D2C4237CBBDAE5E2F50D10734B7132666609B6A5EAB1811BCB7DB00EF1B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 914d5adc9657f8cab27a3e406f0e529033158f14ad553718b413b11e514b99d8
MD5 65c9ffd3d05469a81e7423cc8884c0b2
SHA1 2ba564e93c551af51e7b17b1daa4c2d34f33dff4
SHA512 5151afb1c6e83f5e8925257d7b40449e33336a5a0e28baa5cc23d394e92ef112eae9e757d2f5041077dbbb5c8ac1276c93db8836ee79371f352a5820b31d603f
SSDEEP 12288:MyPz5L8G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VzyGyxknw4FYnshx8OfVe247
TLSH
T17FF4121B73E630F5E13A523689721602F772B872473086AF47A4537A6E725E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9447fadf62b58f9a7317c7f590438165adfb1efdced738a20012e8a769f2cc4d
MD5 695245a45af22631ad027e69cf65e470
SHA1 e39ac157d3036d27f268f611dfe97310455e15d0
SHA512 0d20409462601104e4e2e6e2e457223e3312b4e31cd9f85348530de75538b8bf1f01b04da866811463016550c259567eb8926b8ac7cb679a64f1d60eaeb9bdc1
SSDEEP 12288:uh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uhyxknw4FYnshx8OfVe247
TLSH
T19BC4237CBBDEE5E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 d60f745989e0827485fd384edf1d2e2721809e96287a17f43aace233d56e7eb0
MD5 73067e3d98caae7f927e62a3c1d1f757
SHA1 b8f7c4dc70713f40f36341ccd52591c1c2a8510d
SHA512 db6c956d09bd98d7a85a98006b16cdbc72a2d7f1ff44ab20507b1950032a029469bf640772d1331066982e2117f87789d441e11348b87e971650f7dbdd02217c
SSDEEP 12288:Hh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Hhyxknw4FYnshx8OfVe247
TLSH
T1A9C4237CBBDEE5E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 939a3217791403cbbac9d9f0ddff5d6b469ad65571ca6249ea8578b97a11a212
MD5 87b447c16e400874c489df66e9b1eb0e
SHA1 411594b7b62a71a5d464ab66f06f53f444eb9005
SHA512 4222f4795602c0fc976622a85734cd6752131ce9188d6998f2f2c1c661c211460d85499795a8fbe9f6d0d69f31f888c1fe8cf577e9d17809a80271fac3aacf6f
SSDEEP 12288:fyPz5L8G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:SzyGyxknw4FYnshx8OfVe247
TLSH
T11FF4121B73E530F5E13A523689621602F772B872473086AF47A4537A6E725D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 28c7cc03fc9e3d6518f0f252d32b0181f09d0ec744626ce30cf10c8f6461eba6
MD5 50c23fdb5d9b2d493300f72c9908e7ad
SHA1 118fb0bfda8763e4e81000c83162aad2592bbc86
SHA512 ba3cf1498eedb0c020f5b6be0bb258f8cec206a04896ed12a700cd4dff28be5a76a08843928cceba90b893e82374c7984e2a70b4f994b9b70c773290a1c0b471
SSDEEP 24576:2TDaLl3z0zDQyxknw4FYnshx8OfVe247:2TuLljKx4x8EVep
TLSH
T1080501A8B39058F4EC67413FC9659516D2B27C6A4770C21F43B8362B9F336A05C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 f6258f8cd999717c4938262f56f636fb827384237e7d5e327b5956491df5edc8
MD5 d7bf6c55e38b931b3a944752e9796b92
SHA1 4563ed13f14d7d2e5e7077e7041248d61716d633
SHA512 0881d1750e3387bc2fedf68019c46fb71bdc5dba2ead3bc5ef7d6076417b4bdb0d4f5182e92fd704f292afd15e5d5d4d2e46ae8a0d938861af83a4c12cd09212
SSDEEP 24576:k3vd9CHKy7GZ0yxknw4FYnshx8OfVe247:uvd9CHKyaxx4x8EVep
TLSH
T16025DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 3e2970d3e28810242c7ab602472cd8b8d9c0179466d1ab725680a9c7b4f7d64c
MD5 64dc7b599b041d8a280b4a2c11a5a6e9
SHA1 cdb383560710e076c039297e68b652e41c41b6df
SHA512 47b846f17eb35c3fb03a289e10600ef45de0069b7eca28de73899a8698f9c1c0a16b3500c9b4362be6e60e3d16179592241a4c5c9de85bdf9aa5c487d05206b9
SSDEEP 12288:/A+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/Ayxknw4FYnshx8OfVe247
TLSH
T1BEC4237CBBDEE5E2F50D10734A7173666609B5A5EAB1811BCB6DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 8fd01b85953a4ac977a7708427f533323e23ac9b2ea658897396f07def0134a0
MD5 e67cdac01dcc72bcd817c9a24a5f8992
SHA1 75bedcbaddeaea48c7d89ee2792b1878284976c2
SHA512 f9324fe8df139bc203d2ea9bfcabff66443dbadc504c64ec34125ea7bc4ab40a946b9d1f3759589bdc2064c6eb23cab29a5fb314e168cda549dbaeb56b3b63e0
SSDEEP 12288:Rm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Rmyxknw4FYnshx8OfVe247
TLSH
T1F5C4237CBBDEE5E2F50D11730A7163627609B5A5EAB1811BCBBDB00EF1B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 2049c9a5afcb2c18218c0ff5e50913f262dae739c2a0ffe543b1e325ac7fb295
MD5 b9bb261538c96835e1e3890700923f41
SHA1 f38cfd6c2f06b67c7001fce0c4e90d7766f1a286
SHA512 7b771a9c1b3894e86cbc7a2f1db49d842e156a92e766749797b7bda33ac857964286d0516ac06852a7131c0f6ce62d125971c82eda078db7af95dc8a7313ce48
SSDEEP 12288:Gn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Gnyxknw4FYnshx8OfVe247
TLSH
T12AC4237CBBDFE5E2E50D10734A7123666A09B5A5FAB1811BCB7DB00EF4B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 6da28630d2b71d8447d8e2d629894834cbe7c16046d63a4bfd8c87159b2fd138
MD5 5270e9541713a9cdd4db123d559fa655
SHA1 b9f57bccf00b38a744f1df43116d933a4c32e443
SHA512 294cc9817d221090654473f92c3e5bfd48e541a8e547f0da2494c312bb5a482fdf26a1194c912349b7e3e7028137484ba1d5b4e4506cb3f4afef13551d31ab84
SSDEEP 12288:4h+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4hyxknw4FYnshx8OfVe247
TLSH
T1E6C4237CBBDBE5E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 ce0ba69cdb293bc4a6c38673ea86f5051dcc13cf17b2aca2abf1af7138a22897
MD5 73f8936ab92478e0b34a8e39129c7497
SHA1 8cc47528e57017e032170815e97f9b73b55ba592
SHA512 355ee1b3474850c31518021851b944209044e500faeae65c40dc893cd6c362662337bc8a0e30c22ca2d3a1639f7a59fc36ea7b18b5f1425a0c97bc5dc3def593
SSDEEP 12288:3A+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3Ayxknw4FYnshx8OfVe247
TLSH
T1F1C4237CBBDFE5E2E50D10734A7123667609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 08cb09f7726184aa8a8e6922c563b7ecf8208d520845e4d760055bb6e1eea94b
MD5 d1577080f214967709d7e3234a9f58b7
SHA1 9906d90aa8126acee35ec5dee3d3c6d13bbb4bb6
SHA512 9be83930116e596e34f6e66d438cd2e5c840cae440c545e989c9581a9cd1ff238a3c7a8eaba139e3365ca01c5eb788e7a001d2b76903204511924f560d971e02
SSDEEP 12288:UJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UJyxknw4FYnshx8OfVe247
TLSH
T10DC4237CBBDBD5E2E50D10734A7163626609B5E5FAB2811BCB7DB10EF1B0C54A02E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 05811edd4954324c7149ba2559e6037dbe2b7244ec8ab941e5dfcd891acace2a
MD5 7c5f3560118623839ef2b0015754d4d1
SHA1 ea520156bb828a9b1d15834aabba1fff181e2f61
SHA512 26e910be074162cb2ee5ee4b624327eb0859718b3da393844d21c3ec4107de96acfee231dbbf5474d297de82e0dedc035efb0ecdd08970999b70eb645543ea10
SSDEEP 12288:MT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:MTyxknw4FYnshx8OfVe247
TLSH
T1A2C4237CBBDEE5E2E50D10734A7123667609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 0ce2c3a943ea097011a527fc93e48d8fb8c1ac50987da2b9a5091f4df30534e0
MD5 6dea1f56820ae9d4d4e20ae1482032c6
SHA1 a0bd10e15c44f17c9f5d9268f9add69a45e11175
SHA512 4f4d066e6380bfca6c44960446b724f76da2ac17840502d55311ae062fbf43de9a93d302dd3597d889b7f88ac0c6821b0a7b87f92c4d10b93485b67c108ff38f
SSDEEP 24576:2fwvUk9RX6wkyAItyxknw4FYnshx8OfVe247:+MnYIYx4x8EVep
TLSH
T13935CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dac299d37bcf12e38ceb212fcadc2f5cade1ace2ce70d4b9537f50529d90be6f
MD5 844090afaf2afee369b9190be8896568
SHA1 81322fbc6fc2e4c700b491c11091e9705970bf31
SHA512 c2621dcecdd7c8ccec71dcfb73f12702180455b68e5db153b185c082854475395175295f813aef6fac61e3d6c94e313b5c223ee8c2578281eebd00786e9c411b
SSDEEP 49152:oYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03x4x8EVep:/ySzPPix8EVy
TLSH
T1F6066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4505563c8ddeec947f6e1df6fd844090166cc5f2f2514b5bcd680604b358cab3
MD5 ed7bb486e00f0b984c638911583fb068
SHA1 2fbd5a6462a65a8054fbf8eb3d22bb090d97440a
SHA512 64218b299c7ba8ff280fe90d4bc9ca7309e21872694a303a6015451b9a3cac68019b6b480fbbc3207286ca06b3049b51a28e75e83edd3221475acc5af21e880d
SSDEEP 24576:t47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYKyxknw4FYnshx8OfVe247:t47JUQjTirIhCnDHUPfF/Hx4x8EVep
TLSH
T12065AE1DA3EC01E5E1BA927885154A1AEA71742E5F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 8c661044ffba2a762a33ffb18cdf06409431f3f8e43f09158c9c38cee4e79583
MD5 50808e826d0b89d6d0b381af4258b9f4
SHA1 be2130a2b841a85e94c1498cc6043ea9ed6484ed
SHA512 6e4f9a87286ad4e27ee13e7860bfeb1ded83975a63b839fa6b77a3a03aa8a2e1a71bfc9920baea52307a5b9fba3155f3621d705be037e23883eda73e8ccc19b9
SSDEEP 12288:KbsfR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hRyxknw4FYnshx8OfVe247
TLSH
T13FE40128E29852E4D06E2176CB625641B3237C6597F1D3CB93E0F53E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 79d69d26e205e289382c52688a38e0a0ad55e1083ae7fccb2b07c668593bd087
MD5 682a6ef64df1abe110050fa4c11f1599
SHA1 eac70c2bb1b3968d0babd5aa0fa37c405cf6a3bf
SHA512 2307b8e11fe1a32b183744fe014e9649a9388f33593b01474bf270028bcd8e2307a62a9d11ab19a2153155196dfcc08970ec5e80479784c246f0cd886682b827
SSDEEP 12288:5tOPgScKU3fP6jmjCVomsj3/jIEP6nztx+f6pQmyw:5tMgSnUPWGPkEyn58f6pp
TLSH
T15E35F6007626DB4FC6A950321E36C6CCAB607D42FE05AF0772C9473FD576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.7MB
SHA256 a124cf0899f660248f42fa9dd94b7f8afbdb019a9cd3d7bfbf6265c5b8278800
MD5 22ff799321ee91c24c2ebd7311ae4f5b
SHA1 6cf6a0244960ec7ed962793a72671afb58783bf9
SHA512 9b207a1d6c730e0eac24a4f8ca6cf7ec29ea48d4b394c8fa4186f00881a2b424f0a51228662eb7f8dcfddc7c7edb5bb14dee216001a7f650fda2adae2dae45e6
SSDEEP 24576:HUU80239Mq5VzgS83QU9jk2w5e7NwLZuZcv+2i:Hs0239MWVzRU9jTw5e7NwLZuZcq
TLSH
T1AE853B015577E74FC9BA5037063286CCAB78AC02FB452F06B3858D3998A6A5FB5F23D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a7d66784e3be0d7eb93202e5be3b5489b918f2e6133e9a744b527d8f9ea1e27b
MD5 921f6dca205e68948e1443e0123d3fd8
SHA1 a5cefc1ac0043c02bb402212f6f2d7aa808dba45
SHA512 3e1f5ea366cdcc2c5ddd673b6f94cfe25d54e02f07fe3b005083f82623125ef247349c51e2edb7ac744f34dd64e064ea28e88a6aed95759a018035b777018c6c
SSDEEP 12288:4075+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:V5yxknw4FYnshx8OfVe247
TLSH
T1D8D4237CA7DEE9D2F46D11730676A221360AB5B49B70C1DBDB28B14EE0B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 25d18354dd6f12a5e489482ef07f05037d1202d877b87c576f619bd9fddaab45
MD5 66c78ce129bc7b1b381a0fea53970318
SHA1 58e5ea620939b96dcfa94b0e7e8db8d8297faf25
SHA512 372ffad6200b36e8ddd006dc526b74162c13a364f13b01809e3bb64cf3204b669afd5f3580381d3ab0ed6d8f3853664106737513c44de1dcf9b1d8449ca55b79
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYfyxknw4FYnshx8OfVe247:6gb4mBIBhGFlx4x8EVep
TLSH
T19A65AE1E22EC02F5E0F9E2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 d60712224a6ae8931dd783b227fcd33cbc28673f402afb0d553bb766e55056f5
MD5 c1ab1b44f7b5f819e10ee8b0be1429ce
SHA1 e4029d6e2abdab4a57214b9d5d1d2fb6e3ffff76
SHA512 cf6b9eac2252c87ce9ebd2235383622736284460610f80df6038fbcd67f35e4ee99c5944c175a576d3127f44fb2ad303ff0a7961ced6a0046fee47050f78fe8e
SSDEEP 24576:lG88u8FpJqH1bzria7/m6yxknw4FYnshx8OfVe247:I7ZFPqVea7/Sx4x8EVep
TLSH
T15635F16577E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A561F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 b4afb35dbab38619538bde504987f636439ec1ed4c8d8ab314eaf09c0bc2fd85
MD5 db6c7a6983c1a23f5fa983219e32cfee
SHA1 9ec8f9785961afdbf8692d71f0388d839b32b4c1
SHA512 2fd75583a26a5de2b0a6c578b65bd40b88f133e860a26fd01d78da61b311179c00ef2724ba7f6872e3c4b207fdab419f7e019d587137e72fddb207d18d9f5fb0
SSDEEP 12288:XHvUrBFrEjwaQ++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:XPUr+NQ+yxknw4FYnshx8OfVe247
TLSH
T1EE05F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1c9dd15cb54359d630c56abca36eff0c4e8dff03c5c5f18eb8b4ec09ad05f115
MD5 729dd79d43a4bfbc5ab07a2b82f4e9a4
SHA1 eb4272894f6abd677feaa25b0b70bc51512318b6
SHA512 de0e1973c983321afaec91b44070ae0a18b9b187e9845c399cecdeb3ec54f44998a5c3f76021fc342e546ed88934aa31aef32ebf04b6333b1eb7bcf7489e0e62
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhx4x8EVep:FG05lO43bgix8EVy
TLSH
T14BD5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 08a8eb68f477c7a6af89adf195bf1c78d99038031fd79a2307e204fef7f8137f
MD5 cb186409364b2dadce4f3fef335b2f9a
SHA1 bcd7be6c9b442b2ef4854af97c0d372283ddda20
SHA512 cc5e1a1a2f3dcfa760b5de7d49e3a8eb9fe64520ce5039de6ee8869de7ade6538af121c193d40cc15b00ac67c161c79f3ed8475c26fb5a57a6c0db9041bb358c
SSDEEP 24576:pfa5POZ3dpuWVM50JicR2hG0lasx2+47eidncyxknw4FYnshx8OfVe247:5a5POZ3BJt2pasx2+mZx4x8EVep
TLSH
T1FC65AF5DA6FC01D5E5B9D17DC583461AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 72be8854e8bf3f3309419bd55de9d213e86bd8c475a108144efc1665566ffbc8
MD5 5b65d437953ed2b3de218fb55a43d275
SHA1 2dfe2b543afcce2ec26967fbb707856b4b9d7927
SHA512 11fcb9d834d1f36ea7cdc439b4a759815588365fbdee8f8c0bf421dcd91abb21341235283e127e3be68e9dd2b1edab428291dfc174b77d293e112383de4ca7f0
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkSyxknw4FYnshx8OfVe247:/Nc/zEOVHFyx4x8EVep
TLSH
T185857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 703720078f9fa283ed3dababbcb797f9403d826c37e21be6c7a5b2a8bc2175b3
MD5 3e5a7299b30d05bcdd71cdd5dd07d379
SHA1 2217f0a48566b545db460077b7aec005847b9701
SHA512 0e9473e80479649b9ea7d2a95e8b1996e098ae5d7007dddad4bad2ddf4d1b6783d097211f865b68db40674f883b96af21b2aec5cb77b67cc2915183ad76a1623
SSDEEP 24576:tTkNvNnaFeYhJNtmZBm4yxknw4FYnshx8OfVe247:tTMwBtOmbx4x8EVep
TLSH
T1BB55AF6EBAF846E4D1FEC6B58D238112E6727461073293CB8390C13E5E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 2a32e78a36658dabe3a504d4fd454e2ba06f26c637f40ae97ddda422d1d3017c
MD5 e2994efcf1ed7a728791a628a43cf4ee
SHA1 ee6deb926315dc2c99c46f01368faf3859a756b9
SHA512 0cab8d5395bee6bc8787df730822e89ccacd64a93b3db6e41a87653c09f00a4a843bb966894d686b82b693bd904c493c05858f5b0a08ca7be6e9bdea3055e1b3
SSDEEP 24576:DD3FHshBIYQgAlyxknw4FYnshx8OfVe247:DDVHeBIAAwx4x8EVep
TLSH
T13825E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2184-96-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2184-308-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2184-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2184-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2184-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2184-102-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2300-116-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2300-110-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2300-108-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2300-307-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2824-46-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2824-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2824-51-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2824-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2824-47-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2824-40-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2884-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2884-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2884-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2884-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3048-78-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/3048-1-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3048-0-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/3048-7-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3048-8-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3252-83-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3252-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3252-322-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3252-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3252-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3252-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3776-68-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3776-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3776-303-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3776-74-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4268-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4268-291-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4268-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4268-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5492-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5492-304-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5744-82-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5744-23-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5744-14-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5744-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5996-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5996-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5996-127-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5996-130-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5996-121-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/6124-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6124-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6124-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6124-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6124-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download