8f117179cd0a26271e03d6d76be4ce848b7010b5e487f1c0093c576ba3060e25

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 4.0MB
Sample261102-3fca2sge59
SHA256 8f117179cd0a26271e03d6d76be4ce848b7010b5e487f1c0093c576ba3060e25
MD5 c32835a6114dd0c7864b94b581f757cc
SHA1 0e65a22f972c935a6c7e3c1e402a5088fc2e84af
SHA512 330ffb328be04fe5e3a9b3a232e1ceecaceed7478f1ec9c22f093f2353265cd8d24e1dcc088cfc7ee116548bd70db6352fd660af6ebd93503d4ee097164f3105
SSDEEP 98304:rZnuom/BBBBBBBBBBBBBBBBBBBBBBBBBBBBU2lKsqGsQr:rZnuom/BBBBBBBBBBBBBBBBBBBBBBBBl
TLSH
T11E169C97B2B500D8C1A6C1399742E577E7727C1507A48BCF12E16E6B3F279E20DBA720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3844	elevation_service.exe
1708	elevation_service.exe
4888	maintenanceservice.exe
3488	OSE.EXE
6088	PerceptionSimulationService.exe
3376	perfhost.exe
2040	ReFsDedupSvc.exe
4704	SensorDataService.exe
468	ssh-agent.exe
4264	AgentService.exe
3832	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5a4442487465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006443e8b0216bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056a706f5216bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
3844	elevation_service.exe
3844	elevation_service.exe
3844	elevation_service.exe
3844	elevation_service.exe
3844	elevation_service.exe
3844	elevation_service.exe
3844	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	2040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2040	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2040	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2040	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2040	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2040	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4264	AgentService.exe
Token: 33	3832	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3832	SearchIndexer.exe
Token: SeDebugPrivilege	1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3844	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
1888	2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 4904	3832	SearchIndexer.exe	99
PID 3832 wrote to memory of 4236	3832	SearchIndexer.exe	100
PID 3832 wrote to memory of 4596	3832	SearchIndexer.exe	101
PID 3832 wrote to memory of 3352	3832	SearchIndexer.exe	102
PID 3832 wrote to memory of 3420	3832	SearchIndexer.exe	104
PID 3832 wrote to memory of 3000	3832	SearchIndexer.exe	105
PID 3832 wrote to memory of 5880	3832	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c32835a6114dd0c7864b94b581f757cc_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1708

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4888

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4704

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:468

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4236
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1fc6e1effaa1a4d190b0298d48b6c7d18f134e7e0f86a2cb9a7ad13afbb154b1
MD5 a365876cb713e507078d3bbe2bfa672d
SHA1 91f8a1c6d24bde4ecc6c61cc073f3fd045d8f813
SHA512 4483d0b1e184a19cd4b0771f6f4d71f2a1d197ec19a4a25e58a39ae2dd3dfb9731b26285be9db41bb943ebf6a59948625032ec23d4566333290beee29487dc3a
SSDEEP 49152:5b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnAAQgAT76sQuE:P3q6sjBKqGsQr
TLSH
T1E4D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7b7bcaeff2d92f616b2e02f0bc793e602228fe7a77cd132b67936eddfc81a96b
MD5 6d43b9c45acba26b7e30d7426b32c0f0
SHA1 11aa6161aa7f74c26f03a76951ee6ddb9087112e
SHA512 f28903b88a3b724d16eec5233bbd9821bc6c7ee00fdda62d88458ce2aaadb2013787d2da373ea3d2457958c7a06a00afd41d7b4a8abdd84d1dd85793ceada737
SSDEEP 24576:YXYfDtczANAfYLH8AcevDN0FImbwQuq3Wia7gD:PtceAQgAT76sQuE
TLSH
T1D675F12963D408F9EC6B813DCCB28515E673B8954360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 96d0a47bea6d9217caaa06ba309dace71f7afa1538074452acf0972c254fd399
MD5 3622b21951872cbb00914541efef91bd
SHA1 b7bdf329bf0225cb7cfadbe294379d6041ef2627
SHA512 4472f28c2313dda82139fc8df2c1952c9a438331e9ad3e31d6de16a60da969000ae31a69a22552c23a10042b22407adec9bf0611845c7fc136ad01552b53b6fd
SSDEEP 24576:W0Le5ji0hmxxrMIAfYLH8AcevDN0FImbwQuq3Wia7gD:WPji0AjPAQgAT76sQuE
TLSH
T14D85AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ed34a94fd1d80b9d23206f6a4b107a8fcd87a0c51d9d885df5e8f9459838eed8
MD5 c30dd609071d2e620095c50ca778f24f
SHA1 b77374975709157b8f947ffc72db3394a7f2d3b8
SHA512 a0d270e8d6c9a64e5ec148cea8878fa9854fb94df67e5a605d1fade5c1974a800b76c213d849a6ff01b54c9955ee10f34dbd28f001fd39126e97d50ff64f22c9
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWn6q8wyuuAfYLH8AcevDN0FImbwQuq3Wia7gD:Z/ezSC6vUzPveHjyrAQgAT76sQuE
TLSH
T198755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6aa0c38f11e1c924f5072b036aa055687bb129297b19207aa70326ed53fc1644
MD5 a2762f662ed6a5851e3dc5acb2d88ccd
SHA1 9fc7cf5044016c4d7baeb525b7e7641119b53d7d
SHA512 b31662e7fa0f38f1ebedb05e3c78d0ffb3fdce2f944a494b47c612924e75325e79e69987ef9b86c3e7fa9b17a0842847470ea91492acc39811b7e7b322f29f92
SSDEEP 24576:2VbqPb88hv/l+YxAfYLH8AcevDN0FImbwQuq3Wia7gD:2VO88hXl+mAQgAT76sQuE
TLSH
T1A9559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6122c73db36f6453ab7104b44b79f7f46eced0c9a40cd76835f21c4e470b6f1a
MD5 40888eeb69ef3a250dddeef3c69073ad
SHA1 7d605b972a8bd8f3f5916d222e663495699ac891
SHA512 31d81c10fadd243a86e4564d471f25f7f35127e6f9dcf92b0d3db98791d2235dc083734582afc3bac43195fe5ee44a1058ee8fc42f1a4e0f08576fff42b02232
SSDEEP 12288:NL8AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:NL8AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1BE552357864C70EAFEBBD1369CBBA5B963D1BCBC8284979A00463BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6dfa91f26e39b4e6edd27246c94c3c2e4504d1b75e0dcdfd06beda87708beecc
MD5 150f7fee17036d552a0f45ccbda95d61
SHA1 a069cc8342f6fbb0f9a4aec4bf57c430326e858e
SHA512 4f2a603d5ad27fec2ddc06c2716135b4ce23dd174c381285a71996c574e43e8587d65659a652f2260448c8c864a4977164c08c9140cbd028ad59ee85f451d312
SSDEEP 24576:qJIU5AfYLH8AcevDN0FImbwQuq3Wia7gD:qJIU5AQgAT76sQuE
TLSH
T17875CF3BEE28FCD2C67E8D795A918600E7B278704B52A3CBD165830EDE235D05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6b0c9c78186613d3ce99ad092b3d30a4033947dab4e31965726c1223718bd6ad
MD5 90ccc5ba9e75a1280045b7e60db2d811
SHA1 e88854892d656206a03b8ff152a037f5652581c8
SHA512 e45f6ebf9e9fa2d3b848421cdca840e4d567d5d07de2c78cd210fa462a4482745d128173f2e1d47ded11775af96a1d2db1df92bb309dd71436d68e605c1f3e81
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THy:HQvGAdlCEL8c/DRNw5C3qGsQr
TLSH
T195266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 4f4a6311fcd9396a1fee50d6a92a628b5cdf274d9272d091a63c50c86d9efd8a
MD5 e7a280786c5ced843fb43172db60503a
SHA1 fb11bffca88b622ebeca49c5c4000583ea122391
SHA512 5e2b2d133d1a7563c3859d9c40c0160b70a7ee174a4c91c8641466d820833fc141c01daaac2bacf8d35da51f662e0d9e480ab9dd162f0c223d6fade56f869c52
SSDEEP 24576:J0ewsAjfAfYLH8AcevDN0FImbwQuq3Wia7gD:SljfAQgAT76sQuE
TLSH
T1A375E031FE74E036C6BF0DB61B36C716146CB9204B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 11864b47f2b715ec553c1fe83abc3925458e834cdca2cdceebd28b35f48808d0
MD5 acbdfd12433b7702cb3c3fa9c718f918
SHA1 020b4d02bf0f462f0c3cdb2d20cfae47c8dae554
SHA512 5792bc364de2391f9e4ff6c4852b01fdee541420b537f5c36097b74c11a27a0cac8c924e062a811efc593eb39fa089eed2e390c21d981b273b3f800ae9a6103c
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHWj:7UEtQevvqc2W1cpV2tI32
TLSH
T1DD474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dbf4e289e3ccacaea1cbefce90b70930399c6af269aacf6015ef8856982a2200
MD5 34db113a8b3c9f880cd3af5b0403feff
SHA1 bafa40e3c9fbe67e0e9e60197ad2571cf16f9569
SHA512 73307949ac9dec2b064c07363ec5f5c14b1e3c8f2821425c329db4b8637c87cf89f8f82806688338fea0554ff6d73a7d07c5e75cff5158754e819de6ce0714e2
SSDEEP 49152:VCbRquA/m2yL5zTfFiV+XenmE3/z/AQgAT76sQuE:CoquVjnmDqGsQr
TLSH
T134D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 93c08ab71e2055cb7ecb7a381ee8cd6bf6c9892d6c86cffefc0925489de3d8ac
MD5 31886d3c2abc006a92c5b85de5e8bb0c
SHA1 570ffd22c036358e3451d77210a5f56d6f02a9ae
SHA512 d864fb60cb9ccd1b82653d888f7c31bbec8f17bd1888ac3377fd536bcf8aca274e02ddef6fbdbdb376954d2a09252d23d7052e19bba22dca6fb62b1cf0657597
SSDEEP 24576:fAhGL3IFoiwtA5l7S53KAfYLH8AcevDN0FImbwQuq3Wia7gD:fAMUFoiq56AQgAT76sQuE
TLSH
T149359D81E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 63300ab2df4a77d364d614fa788c5f642a13073156551f75c3cd3fd31b383d94
MD5 a75ef5cc98be16b53d26e45bd411c7c3
SHA1 6727ec15470b0975ebd257838388170901a7d567
SHA512 4c1c4c956302aeb990e2c646786509845e42cec607fd3b86bd71c939be75b39e5a4e01c990f0d0c1b8d0613a42559af0bcdfe127dffe95df4db261b935e970c8
SSDEEP 24576:zwu4OWLAfYLH8AcevDN0FImbwQuq3Wia7gD:zwvOWAQgAT76sQuE
TLSH
T15F65F14A76A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 de2fd1f8b47a5ee889bf509a539e5bd1615425725fefc06e6de430a97f650752
MD5 3e44fb425d5828e13804831e206aa624
SHA1 173ec64c46aadee805978f56871e21662e3ca975
SHA512 4733805a764c013dc0fe59e7fd996a25352813a4b2f1ba39eee17c900968681ef9924caf1e5c318b34e6f1af5422c0129be1d2d94163d70842bbee3248a8056f
SSDEEP 24576:/ZuQAfYLH8AcevDN0FImbwQuq3Wia7gD:HAQgAT76sQuE
TLSH
T1FF55129B239830FAE5A7C139CCF65659E3B27866532283CF0115079A2F37AC59D78B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e55c1177f2fb6b82d8b0b0290844b26beaa58b519e1b037f29e85cb2b0a35549
MD5 cac6a6d268fe84a084ffe73207d0be20
SHA1 81dc016d387d0075f6a5ee192276d52d7aa506c5
SHA512 644297d9d7cb661cf50fa2113f0c59e68a31aaba7b6ada5e708949113eda5e16ef9aabc25e657c0893fb70ed83fb4d171bf61a9fa36edb28d0e42e7a3774698e
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:SQRQyi36YOcPbLvw2gAf+PN3eqGsQr
TLSH
T179667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 17ca0716717ba3171ce2df033592107a81164c172b2b90267a7bf3bbc0872fb5
MD5 f101637d348d07884d3dba76ea95fbbb
SHA1 fa52312f29eb0b44d457a94a6e9b5df78736a8fc
SHA512 52cfe001db823313b4356048434b87522a389ddb805b661164aaf7c2ca7cd70f12f2e972f4811ea095db4c078304330da4227b15c10c50007dfbcd8204b336a4
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:VQRQyi36YOcPbLvw2gAf+PN3eqGsQr
TLSH
T11C667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9391ebdd89307029ac88ad4dffde66c32788b7c7689298ec91cbc2b215db1b1b
MD5 cf860bc18f51d194331326dab70db107
SHA1 a8c2893fdae908e6526851cb8e70f34e78d4eba1
SHA512 a5aeb9979ffaf10d3918c90ed6523f7bea4c9d674ca408131309e27aeb7b047ed12a161e9c949ed3245575ff7b5578f78eb3b127606e69ef345297ebf89d20c6
SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0AAfYLH8AcevDN0Z:n68Qg55nhceWu7PNU3/PAQgAT76sQuE
TLSH
T1FFB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7c2bed9480d85947fd90816cbec78cf78e02927f6a23d6a493489effecfdaf69
MD5 f31a66e0cd98ad1702d0d698c6a9c58c
SHA1 af802fb03e7d6adc337ff6d1a0849fd79548f1c3
SHA512 d1684b6ba03579d600e2acbf5d4bcb1845a71bdbcfda124c9b2a7bac0bdced3856079e7d9ab6f4204f3eeea34261e52eafbd45bb252f16f95e5e05eb78b104e0
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk998:Sy5112gYy5azzVvt69nLKnhZBqGsQr
TLSH
T123167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4d4729938fb4a9fdff1f0cff6edbab4dd903ebffcf02c765eb5f7a1818ed5583
MD5 e6b7d33122be9fe0a8f367915c163dcb
SHA1 cdc968f652640f1b05fffe5654c8d10048f77909
SHA512 611b9101718d24d42cd9efd172ec2d412c893414e3afd3e41699d7429018a0ff578e985598ad09a64a1a1fc60a4620c1c9019eb2d29e621fcb30f9ff0690c450
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl9AQgAT76sQuE:6u6Jmdxd2dGqGsQr
TLSH
T15DD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1853d7c783d580efc21e9ce0253bfe1f74af18ee045773325ca9df85ca74ba09
MD5 7aa0512c148f66e77462a8ae87da3540
SHA1 e0f2ae4d1f450683e61b6a9c7b8260cc082cdd21
SHA512 990cb6d4ba307fc62d6849cc645e1e2571b00fe40529c1078d6047fb469ef36a78e597b2d319d09d49f1fa86c476a5f30233c2e187d2f2013d8473b99a82d74c
SSDEEP 49152:f1hpsNoJpF1A63U44CwH7R4xZAQgAT76sQuE:fmifPWRDqGsQr
TLSH
T11FB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 627bde0df1f7b7c0f4f6fcca0b86b62826d275d8100ea6a91e320f11c3a75636
MD5 319292abad909b58ec1916144ad59a88
SHA1 e2af1854bf076f4b2b9b73e336710f1c25e3147c
SHA512 040c49b6abbc9972a9bd7c68dc3dade81ee4d2ae6da0ffbbb162c704bb51b903c3d39c0f1eb54efec368f106c97469d0a5876a4eafc35b6ae12fc1222b641ae9
SSDEEP 49152:5SuZQIY0Be2KcRVtOnks6NMHqQAQgAT76sQuE:X5dKii61FqGsQr
TLSH
T1A3C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 167a7800e65eb7643ff95d57927453fcb76394eb706500c9a39f6fc86014f203
MD5 7df9a1801478da0738c3bc2669d0b4e3
SHA1 87502d2d3937ea21f59b1bdf52f4abb3ebb9e5d4
SHA512 2fe1cfb28f46fd3c18478adf90b90f842df52616e02c3f51f68286b9be3e4ca2e4ca5c9b4e4d865eae2b7ad4b3e8d9cb0fe02edd01f4ea769bb8edbc5087ef91
SSDEEP 49152:nhtSn8EApI0fig3giDn0AP5wNAQgAT76sQuE:2X2imphvqGsQr
TLSH
T1FD95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6b9d568625e46e37c30431ad624889abdf0034483fa76b34a8e51d7f23539526
MD5 cc574ac9835013f76c77e138e4b2bea2
SHA1 63dade1a25b3ee436090a6159699f29f743e20f9
SHA512 03f5fb404f29aa1982772788512698a64a85f7a976bf2635c0c362fb26d42afb5b9b5962fdb3d5e64f36551a53f32c5ebe370267c4dab3e3d7ca85d135393c4e
SSDEEP 12288:/EAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:/EAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D055235B594C70EFFCBAD1368CB791B9A3C07CBED346939A110A268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b60862b1907e36ed76b90afbbf1c5067aeda7924bdedace09a7a94c5ea0a4d27
MD5 01261a7559cd3fddd3359be5a46811a3
SHA1 36b7ca3ef539057367cc4e531182b540bf05d3a6
SHA512 1f41007e68e580acd2385512b77ad2a2bb600cde91bce78467d560235c2f9c038020a6253c1b06a13893ae363a5b985991610f0dd5fcc6440aff05e965446590
SSDEEP 12288:sDAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:sDAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18F55235B594C20EFFCBAD1368CB791B8A3D07CBED346939A150B268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 775a1b6f05164fff07d9b7e3727c96b8f76837138d0d80e1229a6726004893d1
MD5 9caa63eb7324cdb8cd2579bee7b80385
SHA1 39db0450d7c53a523fa8abbcb67346e71505adf5
SHA512 5c599697c5312b6f8db6d187fa5a813b023af7247619c9ca611c53072bdd989cf660c1f435e247079cacfe659b617a161a07d6aa0408462ec147cda36601304a
SSDEEP 12288:ChAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ChAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16155235B594C30EFFCBAD1368C7791B8A3D07CBE934693AA150B2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4f08cba883b9996090a1e59e0dbac194f8873158d605e0a1ca9b5f75c587c39c
MD5 1d8acea53a486663b28b5f21c8e69271
SHA1 6bfcbe8cd8a0c58cccfcf08fc3cca73087c2c10c
SHA512 4d9fd48331b9654ed4b4a1e81566a28db41f9f07844d97d19f800685bde74959b659e4435d1f0e4c1b54e961035e02ec701dee3c93b4880bcce55077957089ff
SSDEEP 12288:5VqAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:GAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T109552357175C20DAECBBD135CCB79179E3E1BCB9931293DF06021A8A2E3A64891F4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bdcbf84d23ac5a6585767cda7b5ccaa6a42fe1260838d6ddac7725ad23e95133
MD5 ac9813ece8a83bd4c4d716027d85a281
SHA1 c63d9b14b25d5e53f6ab4c7279f3a26738f91c92
SHA512 c5e35c18fefc80aa68a2ac9156810de9d9ad548431f1ea11cdafe38ba371dfd535eebb83777a61f02c14ccc8992b5297796dd2e49f4908632b69fe59f86078ee
SSDEEP 12288:hCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:hCAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16555235B594C30EFFCBAD1368CB791B8A3D07CBE934693AA150B26897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a44aa879d5aa9b0f45d13225932a141d23c4bd44f6daeae94f04e0b3b8e1681c
MD5 fbac490b68b8c05b657e5bfb44eb1379
SHA1 98c36b2d196bf54472c49551990a9e954ca2874d
SHA512 d0a7cff188d2eb45ffb0fcb64b7fbceae42af7b00a6bd2a7d46994ae8e14643a9774b836c1892a672625c8892f8223b980842b1fd00c99aed537c2c9028a79e5
SSDEEP 12288:bHAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:bHAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19855235B594C20EFFCBAD1368CB791B8A3D07CBED346939A150B268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cb47b0ef3ffc6df9990ce4bfc547672e25af792cb7e280f6942fd4ebc53471f6
MD5 50544b3c3a40a6a47d6a33956f71c250
SHA1 5ef3611636ef2781d3f47de0aa050633772b2887
SHA512 469aa33300bb809afad99f196d1c5dec4245f604ecc139e488086590bdaf0b9350ee16820b98f8175796de976951e18ff11dc36047463f09c2eb08861195397b
SSDEEP 12288:57AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:57AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13755235B594C20EFFCBAC1368D7791B8A3D07CBED345939A150B2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 407c0c5d0be1fc3fa102e28a0de5c43201660306584db6bef32a6c629491a6b6
MD5 21fc5bd641fa9e2e6916a9ddf2013ac6
SHA1 e9e60dd06716e9e791a8f4cd4f86ba24bf7df7a4
SHA512 b8ca2834711889ad9afffa76388e3d4cffb3c5b50cec634fea6128aa51e71b6e064d9b828af1b3fca85a9ac4c071c321d09da0edb1ffb00b8129c01634b45a7f
SSDEEP 24576:FZMRzFVSOjAfYLH8AcevDN0FImbwQuq3Wia7gD:FZMRzfXAQgAT76sQuE
TLSH
T19E750195B39018F8EC67813ECC668916D2F27C6A0760C65F03A4366B6F373A15C2DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b64a355db57aca195fad52f1178faf8ecfc3bffb4fb445d237016071ae12060b
MD5 54617a5b742a3070d6b69caa4d986469
SHA1 d54efc9cc4bc2f6b7aa69a107fbd63aa5a477f0d
SHA512 aa828e24f0bad60f639aa9c6c4b6d6b147c187f933ccc7c6198c696ae34c426bec8ab954a6aa922ada5b11637cc66f638e04762846573038409571cd19870197
SSDEEP 12288:RgAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:RgAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A055235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150F2A897A3E40891D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 75f7de0fa676eb21836d854371ef079fb103f7000594a0fa8bd451890f168800
MD5 a8a8f672fb3be42a163accd960174428
SHA1 dd4f9487741df1c8aa31b53dfa2c3c6a4157f874
SHA512 237b5b06bbe1bee4c0c92cb60eb1e8bff1489a991bf05e373243b321f4e7620d62927458f9fc8f8e96d14e6fc22bb333496e29b829bc25b8a3d595228db78eb5
SSDEEP 12288:WMAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:WMAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FE55235B554C20EFFCBAC0368DB791B8A3D07CBE9346939A150B2A8A7A3E40891D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a3794f9b2f4754e26616112a7fe673e1fa03c4750c5ff5f38185c9eea24a28e3
MD5 822b0145a7602dc4b1f11b2d0b4fe43e
SHA1 f74125c2dc68dbc9e7878405f5a3dd7e17086b4d
SHA512 6738be80a1351df00fcfc754725283aeacd56a7e6d4433f622cda38800fc7425f2df88ca42ef3d3b1869f4c682b44dbecea2ef60c460e9954f578b5c5993164f
SSDEEP 24576:dzyvAfYLH8AcevDN0FImbwQuq3Wia7gD:d2AQgAT76sQuE
TLSH
T1D865020763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0df1d5c126ca9b7b65e2b3fa0004c5b03b44abd1d018f93ecc4581051fbf1b1d
MD5 25d3b674729ebba9f7bf23fc5b697a1c
SHA1 24d61c29d691e8f9beaa8a0f6ade730f3104fca0
SHA512 3d66c418c4ae30eca3b2d5b2f306968725deeb3f0e56dfc78870d2dd4af8f0708b8f41632507c0d51b514a5bcdbc5b03660ae8e0cf05a1c5ea7a37c19b73e666
SSDEEP 12288:YgAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:YgAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FC55235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150B2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 59f9054b4f886120c540e8eb818f6614217091d1ef2d4c1ab667cc489c656c3b
MD5 97d479eb5a6baf74c1392f0025e5b092
SHA1 882639280ef303b60aed0ba2a64309cab1d0872d
SHA512 439d4580552d8b03aed16df34f2606cd8e40f0ddb4074d61885761e8054ef373632990c01dce159e75a782b66de6d4855f9c6ba7e855328c91994f4b98dbd104
SSDEEP 12288:UgAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UgAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17455235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150B2A897A3E40891D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 581083a4a57f21d5fba3094fabc323e164cef91c7468128beee260e78ff7e434
MD5 23e3c328e0613d1503f49efd77e27c6e
SHA1 8b07540cbabe0307bc4f0571960052940772074c
SHA512 96260f35473d629a1a447a19e37c670987d93360bdfc9ca08de6825bb246bb53ceb647e8aa2fa9e46e767c5dc08e5f43f6890860329680031a7873d5c4374460
SSDEEP 24576:6zyvAfYLH8AcevDN0FImbwQuq3Wia7gD:62AQgAT76sQuE
TLSH
T1E865010763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 f7d73eccfe85abf0a4b9d43c48e7e15f02de1c370e4cc57fe6b974ac2922e1c2
MD5 3b04fd212190950eebe3d3a945ae6540
SHA1 852daf36a4ccc0b4e4370ce8d916d920e1dc9159
SHA512 95db35e21fcc641c8932920851669b14387577b1aa489178a07dd263dd743359edfa257840e129730937d219373788f4679d9ccb45a3ff68d0ced26c7d153c6d
SSDEEP 24576:xTDaLl3z0zDRAfYLH8AcevDN0FImbwQuq3Wia7gD:xTuLljuAQgAT76sQuE
TLSH
T18D7501A5B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 d135cea3513ee0c86103d45feb1f051ba1e3627cb1917620586aa2acda79a9fb
MD5 1bcecf9620efa2b3e740913d81b5d99d
SHA1 7a30a269a7daaca83053537f822d9f0fe0e3049e
SHA512 3b27c45069d1d9efab8b08f98b46a4157bae65fc5dc8ec2f358b3cc624cee6accc718f81b36921bdd905b8817bb8bb125dfab3f6ce210819830145856d18aeca
SSDEEP 24576:13vd9CHKy7GZVAfYLH8AcevDN0FImbwQuq3Wia7gD:Vvd9CHKyaXAQgAT76sQuE
TLSH
T10785CF91F3E810E8F0B7DA35CD765511DAB67C6A1B21DA8F03A4265A1F336D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5559d632c32cb5eb40f321b1afbe97f03259db1e0ff84c3475dae565e196c75b
MD5 51ef8fa09b0ce3f84b7e476f0f3c296d
SHA1 64cbcc7f14548970f1b48efa7f07d39ae4ce7ddc
SHA512 083d07f464e67121a8d4fb4104a82572bb424bca8e14134c0f42bc9786991164a55cb64069cefb0a9b9305a36fc11926c59ed5106eb1d35d95e64dfc7f2cb781
SSDEEP 12288:yBAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:yBAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18855235B594C30EFFCBAC1368C7791B8A3D07CBE934693AA150B26897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 df458b1b549fc457219aa0ae17a318d95e4f71464afc1eaa72ffa35f8e53294a
MD5 8269cc026f1c9fad55433fdd5c2b4738
SHA1 4b97539e6e1c97a04d3d150998dd4a8e4a282030
SHA512 9e9af003fa6e7fa6324790b91f84d93172937c3138fb758e5986d0d25ce4727fce3d6146a2651b8b7ef2c11d39a3dcf10b229e1e410a5cc7af5632548ebbf39e
SSDEEP 12288:4PAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:4PAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11D55235B594C20EFFCBAC1368CB795B8A3C07CBDD346939A154B2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 89ae3a60907d3a8913efc0c7d22ad50748766fe5bbf39a2bc9204223720492c9
MD5 658f260f947975c7be8ebaab3ef678b0
SHA1 ffef1dd2b8103c6c4a85adccc45e2f1277aed722
SHA512 91f90fe008a022ba34127b016c20bbea59372ee1bf92b6e1731e12cd8a6b0314a421c4a44820266fb3275f7d928996e41f458d270adc3ac63d20cc661e433138
SSDEEP 12288:tGAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:tGAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DE55235B594C30EFFCBAC1368DB791B8A3D07CBE9346939A150B2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e703b11ce1fc095ea1d7883bf66e970478f0ade591a289b102ff07a432a3f166
MD5 5b6114df8848d9074245c4be9d858a91
SHA1 62cd2b5430640b1f71f985fcc28c860e272594cb
SHA512 f4a2d09b75832304d6c2cc02d7d5e6d373e421a12735657658331de61d5a0846ccf27e0b108fdd7fc3cedfb559abae693d398cded431736580ba0b9ece103149
SSDEEP 12288:3gAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:3gAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11A55235B594C30EFFCBAC1368CB791B8A3D47CBE9346939A150B2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 edad6f48bd29749fdb25d3bde1e9b6ab56da311e15f98b891b0c5a06b5922f69
MD5 da7b813422c3009a3bec1ecab5e3a318
SHA1 49818cafaab16b058d99cc0bdc03531c5f41371e
SHA512 9f40e71c623a4772b7f51cd2036a684173c3360691750340386e0236b352f4ddb9328bbb11c8d37103de5c2778e12df1bbc518c45088a16a9d6c985cd27769ef
SSDEEP 12288:GBAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:GBAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14155235B594C70EFFCBAC1368CB791B8A3D07CBE9346939A150B2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 9ba472530a7c45b98bf2f500419ddf73f5b02b9983366d51a84545bf07f59941
MD5 7fa076212d429ccac74957f87a6f9362
SHA1 39367741480fb374a1331e66a85b9ccbcfc9a181
SHA512 20aa4dd19fc35c5e248d488b6016c20c18efa4d32b973db1f19f76f24ec5d5ca64e8c1be04a022f29597dc60091dce06953fdca79069ae9fa840f507a7164709
SSDEEP 12288:P4AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:P4AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14F55235B594C20EFFCBAC1368CB791B8A3C47CBD9346939A150B2B8A7A3E409D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7aff9475ff88cbe0003fe175f87797d9df6736ab6d0849f7ad927f1f2ed9a3b5
MD5 87663bf471e59aaed22c1977a80f8940
SHA1 7660c9dfc5df15b904bb6727d11d918855524f59
SHA512 40b91a29794173efd51746fcb375bc17cd15ccdf93beeb40df1a1f70b9b38cf24b8885ec45473669c2b5f485d24cb868b35d1a6d91a61b63d24741c22600ad38
SSDEEP 12288:tCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:tCAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B655235B594C30EFFCBAD1368CB791B8A3D07CBE9346939A150B268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 14a841f036ca3fa58e360031b92541040500b58e7073608d1295a16f414d1132
MD5 d26625cfd3ca777ac3e501a0673ea93e
SHA1 7d339c9b8d8380ffe959792fd02543566e876e3e
SHA512 c7b7abeec947446fb3c8909983a7f3b4c6caa17d97032cacafef715951ecc2b38748edc46be1b66566450e68f7b284724a0d686d912b8db929e074956181a0e9
SSDEEP 24576:mfwvUk9RX6wkyAIcAfYLH8AcevDN0FImbwQuq3Wia7gD:OMnYIcAQgAT76sQuE
TLSH
T1E985CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d6c7b7502a2e8b80bc7b61a20a08201b1085a4f8a372d9544da435f286d51b35
MD5 eb731bde7a42388180ca210553cdf937
SHA1 602ce66f503502ec7f50fe741cd89cde07ba8865
SHA512 bf4acd4953dcdeea99e8d8e38ef32e04d16b89ddc42c4f89e904064ad125e0fd62b9845b73da2d009a6e19b1bcf45c7fae906b95f6a7f411361c1f876b55785d
SSDEEP 49152:RYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tAQgAT76sQuE:8ySzP+qGsQr
TLSH
T125066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 978068742488f3bc0e587a3aa92267128d2b1338f85bc85e000353301bc1ffd2
MD5 99e77d61f637000bbe4c7d65c0d38db2
SHA1 7ccd81b527ecfd8cfd23a0b9448fce6b659ba071
SHA512 0aacc2d307ea53c3f2ff14c280dda2fad84ecc185d2816cb24ab542f368158dffb42e70a84b807345c0793c4bfafd2ad08550c3a18cd15cc27d9c6fe57b9106f
SSDEEP 24576:w47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYzAfYLH8AcevDN0FImbwQuq3Wia7gD:w47JUQjTirIhCnDHUPfF/9AQgAT76sQr
TLSH
T1D7659D1EA3EC01E5E1BA927885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 6aeee957492c20a88d20e90b58c2f57c205443cdda48133671c662883b15f625
MD5 4d304e82e5fbf03ebf3911ee0a39a741
SHA1 5e20bb3c55c4bc1bb08e3fcc82bbfd4701136453
SHA512 f70fc6e075d72d1c19031d9bf1dd428c372765c9a7553886a77177f05e2500814cb344263db2a4b6dae3041fd718dbcc04c3d0f10ac84e52a55fb38a58083956
SSDEEP 12288:9bsfQAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:YQAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13665011AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 c71eda7fa654f68ff949db7bc6f1112583970f02a13e205a6abc66f2ae160329
MD5 a692c55e55f9c4156e1b0ce883ea096f
SHA1 fb97db56cbe1c9c114d1073541b7fe56474e5dc3
SHA512 51d8fbbf5c45b8520080114b62f7567731958e7d53ab4f4c28b35f1f2d73c49f910f4b73157901b086f573383db69efef46e25e82cb51312d88967cacdcaf79d
SSDEEP 12288:4J6M/XEU3fFxoTo3p/NBuYlFzlkuUoyvGqMPOiv/poFd8jF:4J6E0UPKe7Ty+qMPOSpoFYF
TLSH
T1993528017626CB5FC6A940325E33C2CCAB707D41EE456B0373C98B3FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 81680218fa56e885b36520828134e734f8a8bcda05d1f0915ca51b1bf1395512
MD5 45cf3ee777e81c6d8da61e31c07d5d6e
SHA1 66095ebaf3dfeaa8bab6e43200943944869a02d9
SHA512 134c53bbfb732befc6380d347d2d9fd59cbb6669b33b63f748913d5ad60b6fabe23f8e98507cf7b9c9e334aac80f63ab53f1b41a30fa51248eef478a14297414
SSDEEP 24576:H3yvd3uI2TlHnXeNhACZXqsLVqj6wBFXTaE80GrRvV:kd3utsV
TLSH
T1737519815537E78FC1BA603203365B8C6BA8EC06B7096F2773C9457AD86A711B0F97C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxsound.log

Path C:\Users\Admin\AppData\Roaming\FxSound\fxsound.log
Size 141B
SHA256 ebfb97fd2d3c0f010a6fa97b2f40b1c61a3860af96c32a119d589be279a617ad
MD5 f782dc633d924cec24f14d7126f332b8
SHA1 40fdbf54e2d14d4c820db7ae34c51720727fbde5
SHA512 d7be1219e1c059f471d8afdf9816ac6fb13555a25c8fe30cc47bbaf15efd15974e84289f12999c5154341ca2d1663c5dffd9683a68a1f3b7ae033a8c7e76b876
TLSH
T19BC0122F318D2C2401215460D46B13E310E01224C11570A47486740658CD0DF1A07044
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 fcf9a85657ec3c33335963a5658cfdb2918fe5e53df2d44ec71db9762512a8f9
MD5 0858cb75503c2a952794f38a00b75c74
SHA1 61a55d3ca798c2969d33ac86b034017e714aa3ab
SHA512 78aee7018957a81650e8d3633c15abc8f86c95d0dc417e8e5f86b570e1645aaf7fd58b319b7818de16820a3cfdafc12b79d36a4f77b4abb95026124e0ee293ea
SSDEEP 12288:O07oAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:3oAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A2552357874C64DAFCBAD13548BB91387395BCBC874092DB640A27CA793D8C4D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 058cf789f548d53f0659de2b478564707667e2ccf05face056715c0a848e91c3
MD5 11f2b6d2065e5c46acde4d75b59e778b
SHA1 682f4141643dfc7d3268bbeb638196b0647f67cf
SHA512 a8249851f18595b5d7c7dda8d6bd50aeb5c95c83b50e3e08b44d3d9b97cd98af3525badad23a886ed08c8fab38073b610d344ad44729041f8002cc79ce88ae65
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYuAfYLH8AcevDN0FImbwQuq3Wia7gD:Mgb4mBIBhGFzAQgAT76sQuE
TLSH
T10D65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4a574f8d9dff234581e600a636d8f98faf07b3df4bda53cfb4fff75c7eb47e59
MD5 d0ce5f9543582d15080f6ecc8ba5859f
SHA1 49aab91451870816768638cf8e2183bdcc2dca5a
SHA512 20364f07e4dc95cef6ad322780b49ebbe49e770dd3221304ceb3153fb421dce00a293d974a1e80bd1402b4ccccd4cdc424da342923399cd2395d3ad9141586cc
SSDEEP 24576:rG88u8FpJqH1bzria7/mjAfYLH8AcevDN0FImbwQuq3Wia7gD:q7ZFPqVea7/mAQgAT76sQuE
TLSH
T18885016677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b42d8b6b85659b343a6c648992d0e20909426c00d5ddb658e82f9c39b6726fca
MD5 d90a7237ef0ac5b60dd70a3cd5e882e5
SHA1 8aaa6e598b07498fe3e5d72117b4070f300cb301
SHA512 eeb3bdd448d7983d8bb5ad8795ea8441e049058e22b108173260e6af959224b7860bfbf782526ecf8f7fba4a7bedb6c362e449fbe06ed4008a33cc27877be162
SSDEEP 24576:8PUr+NQXAfYLH8AcevDN0FImbwQuq3Wia7gD:8JQXAQgAT76sQuE
TLSH
T1A565E12F22AC18E5E67AE13D89968619F771B866031192CF0291817E5F37DD8AD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 77d74e2b509491474a950b060d8e6ad8b0e8e81e6481651898281ff0ecebdfa6
MD5 0a10effbc31adbb157a7810464636072
SHA1 56af3d0e4d3bfdc1ad791cb0816b91032e7fa360
SHA512 372602b5120a9aaafe49281edbbcb1ef75359b0dd9adf583d43f0aeaa34a2c0f789f9055a85a54985ea28ecc4f5bf5b06dc32e087634eb2160313b7f71163405
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHAQgAT76sQuE:zG05lO43b5qGsQr
TLSH
T1EFD5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f690c977f9be06bbce8273b880f2cd239b84bb7d425c567138f93a8a08256086
MD5 e739f9e9b1657da312db27151b2eb008
SHA1 61c143beff519ec4987b7214a904684591e3e5c2
SHA512 bb00ddb2a380eed072f224e2de9993e6bd49a6000bb5a6a165888e339465e6466b4fd8de799088a5b5de61b4b560b5ea0bb14b52cfaa89e70d8282cc797dfb45
SSDEEP 24576:ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidntAfYLH8AcevDN0FImbwQuq3Wia7E:na5POZ3BJt2pasx2+mPAQgAT76sQuE
TLSH
T1B565AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 59d1c0d176cad31aa2a962a871abae7b907e6f22f66ea26f0fe46d345b319932
MD5 b410fde1cdfc09a58cc8e504383945a8
SHA1 b02891dee7d69f358f9d87fd5a86539cb06a2a53
SHA512 ef285dcdd9a66795e3766956b216b8f67bd23607e4969753ce85374f297314251863a19276024d74cc0973eebc0725d22a6d488e09adbbe57f24f9ef4987c3b0
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkrAfYLH8AcevDN0FImbwQuq3Wia7gD:SNc/zEOVHFGAQgAT76sQuE
TLSH
T1F6857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0d81bfbdf6f3bb3e95aa54c2cdf9e1d10076fd573d0ca7d0db6a1ff326fb3fd9
MD5 9c2d7415dd04c310c664f246b16ea290
SHA1 af7a06520cad13fb2e6b04c50ba1b2efeb6bebc2
SHA512 9453fc62d41b8ea20fbba58ab2fbddeb7e58344885ab497d14195b361402a7343ceeab6a50e0cf54d45e10d453ef11fbee00572f6a81c86a75859ad3712e510c
SSDEEP 24576:vTkNvNnaFeYhJNtmZBmJAfYLH8AcevDN0FImbwQuq3Wia7gD:vTMwBtOmJAQgAT76sQuE
TLSH
T13155AF6EBAB805E4E1FEC6B5CD238512E6727861073293CB5290C13F1E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e7bcb46d58219569a3d4ca41eaa22c73c149e2ebfd2f1ca62cb6fbb134ecc1af
MD5 2ce6b647a876e4ef7b3a5612cf45354d
SHA1 9a6dff67a604ae97281d74df50a6b4364b52b51d
SHA512 8b5668456eee926b923fb12a58f0695f235b3ad9708d7aead18b82f878d83cae57c7e479364e2081986d8ff4e5d0a8484b498997e18e46463200f78908d9a932
SSDEEP 24576:KD3FHshBIYQgAkAfYLH8AcevDN0FImbwQuq3Wia7gD:KDVHeBIAAkAQgAT76sQuE
TLSH
T1A575E17EE65C04E4E57BD17CDA638606E7B138AD032256DB029481BA1F3BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-111-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/468-312-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/468-119-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/468-113-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1708-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1708-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1708-139-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1708-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1708-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1888-6-0x0000000140000000-0x0000000140457000-memory.dmp

Download

memory/1888-0-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1888-7-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1888-69-0x0000000140000000-0x0000000140457000-memory.dmp

Download

memory/1888-8-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2040-92-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2040-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2040-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2040-328-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2040-86-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2040-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3376-309-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3376-82-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3488-58-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3488-65-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/3488-292-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3488-59-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/3832-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3832-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3832-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3832-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3844-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3844-19-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3844-25-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3844-27-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3844-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4264-130-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4264-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4264-124-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4264-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4264-133-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4704-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4704-99-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4704-105-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4704-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4704-313-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4704-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4888-50-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/4888-54-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/4888-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4888-56-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4888-44-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/6088-72-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6088-78-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6088-308-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6088-70-0x0000000140000000-0x0000000140222000-memory.dmp

Download