10fe5fbf0e3a74239bdb72d8ce297a9e5735cc829af6caaf4cb9aef1d066d528

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
Size 6.9MB
Sample260517-v79rmabw2w
SHA256 10fe5fbf0e3a74239bdb72d8ce297a9e5735cc829af6caaf4cb9aef1d066d528
MD5 83af33546a49d67f97d3a4ab0d27166e
SHA1 5c427c3ad62199e41bed760b1c50ee296a46892d
SHA512 186b6cbb10658a79e18ff453ddf03281b68fecdfc3b5602a1c5a791ad1085ddf2fe0a276fb08f58329bec487edfa9933fbb5944cff312dc6a09b4cf4cb46559b
SSDEEP 98304:4mXoG5v1cmOrSS49jOJwwO3qX3Kq63jm:4mXoG5v1cmOHqKwwSZV
TLSH
T134767C8AA3A901D4C966C17CCF57810BE3B67C5843F167EB3421661A5F37AE03DBA325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1072	alg.exe
5044	DiagnosticsHub.StandardCollector.Service.exe
2072	fxssvc.exe
3036	elevation_service.exe
2780	elevation_service.exe
4728	maintenanceservice.exe
2400	msdtc.exe
3304	OSE.EXE
3872	PerceptionSimulationService.exe
228	perfhost.exe
656	locator.exe
480	SensorDataService.exe
4888	snmptrap.exe
4920	spectrum.exe
1744	ssh-agent.exe
4328	TieringEngineService.exe
2720	AgentService.exe
2248	vds.exe
2860	vssvc.exe
4260	wbengine.exe
4188	WmiApSrv.exe
3228	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f64310d1c6cb3b6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085a3cc0d9ee8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4830b0d9ee8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000768287159ee8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065e44b0d9ee8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009acc950d9ee8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006adea80d9ee8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d329140e9ee8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c251b3149ee8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5044	DiagnosticsHub.StandardCollector.Service.exe
5044	DiagnosticsHub.StandardCollector.Service.exe
5044	DiagnosticsHub.StandardCollector.Service.exe
5044	DiagnosticsHub.StandardCollector.Service.exe
5044	DiagnosticsHub.StandardCollector.Service.exe
5044	DiagnosticsHub.StandardCollector.Service.exe
5044	DiagnosticsHub.StandardCollector.Service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4116	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
Token: SeAuditPrivilege	2072	fxssvc.exe
Token: SeRestorePrivilege	4328	TieringEngineService.exe
Token: SeManageVolumePrivilege	4328	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2720	AgentService.exe
Token: SeBackupPrivilege	2860	vssvc.exe
Token: SeRestorePrivilege	2860	vssvc.exe
Token: SeAuditPrivilege	2860	vssvc.exe
Token: SeBackupPrivilege	4260	wbengine.exe
Token: SeRestorePrivilege	4260	wbengine.exe
Token: SeSecurityPrivilege	4260	wbengine.exe
Token: 33	3228	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3228	SearchIndexer.exe
Token: SeDebugPrivilege	5044	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3036	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4116	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
4116	2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 4876	3228	SearchIndexer.exe	106
PID 3228 wrote to memory of 5028	3228	SearchIndexer.exe	107
PID 3228 wrote to memory of 692	3228	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_83af33546a49d67f97d3a4ab0d27166e_glassworm_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4116

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1072

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3736

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2780

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4728

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2400

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3872

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:228

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:480

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1668

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1744

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2248

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2860

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4188

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4876
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2828 2688 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5028
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2836 2644 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4b05a11c3907184456a94ac030ac45cf0611c4543f4eda092dc02b21571f09a7
MD5 195f751f9cc0d0efc8c3ac3a73874ba0
SHA1 07141ca3ce84cb36892b8014655f6919e1f91585
SHA512 d3a23dd1cb2837b87f00133ea78d678790da54a0cf6001823664335c8a811cfae2d1d4435bc83f4c4a0aedee873942a28195adee63b4a77590c1fe7adb3b5c9b
SSDEEP 49152:9b+632BuPkFKRrdE6ohdstBhuXjfS4LWxncKqzFUW9kfrm:D3q6mjBjKq63jm
TLSH
T109D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 24d482456857de4ad2cf5fb4933861f1abbf005eafa6a0e58093aae434970950
MD5 66ef743d9131dca81248417ac3df7346
SHA1 ef072a6a7f7ebe252faa80b576f23ecb1e631365
SHA512 b43d5792401a28fb6c2545a776896ca629f11712b878f1761edd7b9d60e25776b5d8d9a380af12a3ba9b35560ae44d806a24a6ceec5923d5d66fc7cfbe1646f1
SSDEEP 24576:hXYfDtczA+zwbD2QMqW0FUWcrUbkfrA9xt:ktc2KqzFUW9kfrm
TLSH
T1D7650128B7D408F8ED6B827DC8A2C512E673785547A0E7CB03E09A251F237D85E7DB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e525f160119cef9ee2257fbb625488fabaa5532f0deddd64ec819c5ae38af3b6
MD5 fd1bd79a575cb7f12749fb3606ef881d
SHA1 047c80c58b261c06c56e22e4b5bde906143a0775
SHA512 b4457533abc326aff8923438908d03968b36b655b66ff352f8f101a2041034b744fb57a4410c11c05745e0478b780d3be5087a89d0732d407ec4eb0fc86daa48
SSDEEP 24576:60Le5ji0hmxhrMDzwbD2QMqW0FUWcrUbkfrA9xt:6Pji0AztKqzFUW9kfrm
TLSH
T12785AE26F6788371D073C0B9C5D2A69EE971308257308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f7918f2a555fbedd1130cbd990e59c1133e15e05e1056483124f2a4e6ee92141
MD5 d92cb02f6e04d101a02c92ea69f06345
SHA1 94eac87c37fe7c4315d68480d581a7d47224eb73
SHA512 a5023e402c69fcc032d9030da979cd6b2a906e772e9383099bf1df09b9a3f1409fcad76d88342d5610ea1ef2728a20cedf0c7ae35a9cbfe9e1d095d9b4503c5f
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWj6q8wyuBzwbD2QMqW0FUWcrUbkfrA9xt:w/ezSC6vUzPv+Hjy5KqzFUW9kfrm
TLSH
T132755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68535739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3bd8bb13170678ef88a6a1a85e117a650bed5e481133e582cf33b3583c5560fc
MD5 e918b0af9681d5ac88b2f9df9c054baf
SHA1 57cef98e1c23303df3d8356371bafb909624cc9e
SHA512 aaa2540ed6a699ae5624841af0bc2b2b27f4fac1c9cc643f71cdc3b1de03eee3210bc8ce43fb76a288f47d687d93b2f001a51f33ac8a8154f6f82d41fc575b82
SSDEEP 24576:AVbqPb88hv/l+BqzwbD2QMqW0FUWcrUbkfrA9xt:AVO88hXl+NKqzFUW9kfrm
TLSH
T18B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 141e2fa69915cc0929964f764ddb1433a76a7f1b76d42bc4eacc1aa12e3d7cc2
MD5 033989c814d985faa217d62824c80228
SHA1 2a17bcbf2638905d8266a50d39e3dad2f7fbe298
SHA512 4719a84799e2e437e46c16762ca9417f8a2cbe412933d51b634c2d78d02fdd086b7b79c30ef82a4d884f181f244dec618f4b540eef3a605948306a380da0d8cf
SSDEEP 12288:hGf95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:hGfzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T10845236EBFCD61F0DF0B1AF2557DA9AA31B03F56758484830DA0BE459C3CC60D1E0696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b01830e2814798a7aec6f9aebb18a9991bb27ccde058cf06fb76c3388c097ad0
MD5 42a17c894196b87941250979da187cee
SHA1 e9f148d2074328db572a51127a5606c12ff71080
SHA512 38273c364ea3df94f2a20a027d513665e4c1b0f23b7fcec0de5e4d1dc4a1ddff21a300a416933a722ce5cdc1896d4fd4176acd1e47223a0cd28776812fa47cf2
SSDEEP 12288:neBNUbTVO86US95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9n:nJIUSzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T1F665CF3BEE28FCE2C67E4DB95A91C640A7B278314B51A3CBD174820EDE235E05E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f31f282d260ae8f3e04215e2b1efcaae8a7baf2842943cc4876e07d6f760ff00
MD5 5d783014b5e1b9fa42fe2109374bbdec
SHA1 0ec0b08d3ac70aa466579ab61b5809bade5a7db0
SHA512 af8e1fc42a52e6791c869ac11ebcb9aaa83bc701876cf3100ba1d19c5145cb01169f54c3f302fe993761317fa6e06a23f425b6901b29f348131bb0225bbda223
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH/:5QvGAdlCEL8c/WRNw5CWKq63jm
TLSH
T1CF267D656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 56c244b1112af99a6456e416fa01556ac8d0857110088bc61fea37f7fd48c352
MD5 a082137f555bddf615cfea915ad3296f
SHA1 28c37fda7ed600a37191009769243609fa8205ea
SHA512 b53b5c1aaabf7a7b69d85b601929df7a4e0c6205569f3a05c55c1e6a7f66c1b2bece80ca35b0d3158573a4812c8651edc3b6fa5841fd5165d17382e352330137
SSDEEP 24576:GfewsAjozwbD2QMqW0FUWcrUbkfrA9xt:0lj9KqzFUW9kfrm
TLSH
T14D75E031FE74E036C77B0DB21B36D716247C7A204B511AC3E3A89E8E59342D263B6A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 260d2c307bd5871822b5c8ab2d455bdf1b7d55a7527989736d1a9b64d0654113
MD5 6a1ff7023031ec2cbe446022cf78c8e6
SHA1 f83ca0cff0da1ec61266712a58dc3025bb8a034e
SHA512 2677177927dbc14357562c27acddbd631dece1d6fd8a6fc7a31b52c396f66103ba12b9db96b4373690afefe58cf7ace1d07646f9db57e881481bcf0cacdda56a
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH4V:vUEtQevvqc2W1cpV20I32
TLSH
T1D2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1b97b72228d0150e9ad786a1891f05663f974e4d7f8d0167c9d3aa68f3284a20
MD5 4ab9c5a686afb6f0d044cc0bc855cf48
SHA1 66f7f8e4319af04df184d8677099610141e79a16
SHA512 cd08d15cee4e9b7d292ae325d0e617263acfb0beb21e4241c403f799ac5796681495822f103bde1e84e55c8b1ec99dd5adb84eba3a61e0baf8efa5504176db02
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zdKqzFUW9kfrm:QoqtVjnmiKq63jm
TLSH
T183D58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 88b609dc027c3e7a992a63756bed24d2e7d669197f5561d586eb8ea7d42fcea2
MD5 02d5cf5d9a5759f55e3bcc96c429947e
SHA1 6a692be0bdfca5fba7f74060f9a1da1f99351aae
SHA512 c19f5f4ee96f2e0a2a8467fe672277ba8ff77be75a11c4f8bf077bce61a62a93740350a426f8b4426e6ff85daea9a9ca7dd079295e3432be1f0a406935f19dcb
SSDEEP 24576:IAhGL6IFoiwtA5l7S53lzwbD2QMqW0FUWcrUbkfrA9xt:IAM5Foiq5yKqzFUW9kfrm
TLSH
T18435AE81EBF955D4F5B3AAB899B69171EA76BCA65E30C20F2150D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e002a1553c3e88f8aeb58c150b43144ddde1253ba4e7769d1c961891ed7664a7
MD5 83fcd5558b3574b18f897c1772e10763
SHA1 21cb67b5b8ff3d2f6592c82e019c3cd8dbd0c8cb
SHA512 608f8944059afb9ca26ba048dfeb82e67393da2a22d29e1271b68a4d2d4ee410ce9cafb9a34a48bbefbdbcadbde7f05b9acf8c8e3c5979c7d91668e93f2ceef7
SSDEEP 12288:+mw5HEjsChNEBFgl0WDm+Ch95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0Vjao:XwuROWMzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T13A65F14A77E81CF9EA6742398557C536F7F2B8123A21C71F0760CA5B5F37221AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 64257e5f14ad8bd8d2910a551d04256001bbf7e442c0fc74119c63e08ceacc9a
MD5 13cd38442c2d718ef0ee0d1d6c9960c3
SHA1 9cf43766447991a5235261bf041ebab804ecd879
SHA512 62b819343cf44c494dfb38d7b9315e18641a4447d0e128fa1f630a55d7af15e37884624b2de1df0f420435b999b33a0938ee70a8470d54044fbd602e6a17b04d
SSDEEP 12288:NyZ1IyY95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:UZurzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T16855129E37D830F4D69712B9C9F5964AA3B13867333183CF0A604A991F36ED19E74722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6409a299cc7b0c27a8483a98aa2e911fe758dcf7ef53a6ce5360cb7c86d51bb4
MD5 5cfea99bb229fcea681e7b7d4da7c9da
SHA1 fd243f1964c682d4a8d819eab16f4285fc0565c6
SHA512 69e984d42b236e78d80fed9c6a7270f3ed267666eaa5c8d68793bd9e0fd2c1109fd3a2d8dd087d7e00aae3f23f8a18553108f4d9892fe1be1a0811804c52a4ed
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uz:dQRQyi36YOcPDLvw2gAf+PN3XKq63jm
TLSH
T1D6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ff309d4f81bdaa18c1030fe16fbe1db77978905834bad045bbcdcbe92c707bf1
MD5 e23d0aa59c4c54add7910269f8e282ad
SHA1 7a3b535a991abc311c2b90cf58273aa5b40b27e5
SHA512 cff980349cd15c93b951d1eeee433b8951779be4bba2f3c80d707bf2a1b674ade374e6ea1c7504bfe326bf30993fd5317e77d1806d34874a09594cb1f2f5a270
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uz:qQRQyi36YOcPDLvw2gAf+PN3XKq63jm
TLSH
T1CC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 972e14db324af6456952a2d4a85c81f9c57f5a31e25799b3c04daddfa7daff41
MD5 311e461ec3fda188e55b0ab911ebb54d
SHA1 32245d92fd4214082b3533764e34f733e76b4607
SHA512 b1104303229271b3dff6b4fea46a0a2d8c41e1110699d77e2166a66d11764ab95f6cc0e7d61d437c2d14254ab56fb22238f816a12fba90d59c3d33e0c5426886
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL07zwbD2QMqW0FUWn:E68Qg55nhkeWu7PNU3/tKqzFUW9kfrm
TLSH
T15DB54933B2F600A9C44DE1769F4A873196E17C758FE0E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d8a31c88ac056bb3a1249af46541f398548f09dfb6d1fa365cd8f0b1e330e81e
MD5 67a864774707bd57a19509462b71fbec
SHA1 64bfdb52438f48c3cdf287b8a8200556da3f868f
SHA512 25fdbf3fd490c022b6029967d8a28c7ade3e1e5bbb8bad3cac49b6fe8b52c1930150d822d2e5e63eee28c5e15b23fdfb5434bdaa93e93ae4e58904b55ae09a4a
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99B:Dy5112gYy5azzVvU69nLKnhZoKq63jm
TLSH
T12B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3dd08fc2da850d106d6c6aea75940e0dd77572ae06f8e2f5c259a93e2836ba07
MD5 94869b88483dd15ace8967fef89997a6
SHA1 cb42f544d8857b8a7c8c783f67d273ea3d1094ca
SHA512 424deabb6b17b499fb5ac71f7a6e64f18bb68dac916885debbd09a468e36e656dfee793b20c51a39535082e9015d817edb37e162aa892342570cd183f6aa87d3
SSDEEP 49152:YB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glvKqzFUW9kfrm:yu6JmIxd2dvKq63jm
TLSH
T17CD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dde91190efd5d672cdfd96f82ad65f66158b1bf283ee817d1f8ac97ec070e6d9
MD5 1fb1f67ed57d82222a9b9d495dd0339a
SHA1 f2fde1136762df14eae1ba2e4117d1b99d4a91fa
SHA512 7833708c5bd14f334076b800168af735bf66f0aa2b33bbd7313a299b1ed82388d77bd29975b2cd5347ba939c01552ea7a3602adc0aa92f3195c7e539a78863bc
SSDEEP 49152:31hpsNoJpF1A67U44CwH7R4xLKqzFUW9kfrm:3mifPqRiKq63jm
TLSH
T146B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e2f7e3c39a3c88bb455064fb2d5ed1b70d4ab208154a0c565a13ec84978eaca9
MD5 58c8a05a447fb1cc82157b9a7f5bbb76
SHA1 d741180d9ad9a283711ccdd8309c23125c73cfe2
SHA512 b195c636841aa37a8d68fa8fdb876f571dc78a52893e1f1f0b58ba6b0b28b9285741c3c06da3da0fddc886b2d8b6f65054059fb6c5ffc8578adae647d2e30f16
SSDEEP 49152:USuZQIY0Be2KkRVtOnks6NMHqsKqzFUW9kfrm:G5dKqi61sKq63jm
TLSH
T17CC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 82e9e9efe891be2811b0addef182fe564c96d32360fa112bbc86d287c844ec0a
MD5 c08f82304d7aef5e81ca3878ca4493bc
SHA1 33f3a452c9066a2238194bcde290c278ad580b21
SHA512 920b102df5a150f103bb32fa2500d4458ad4e6f42fbf3ca3871a4c1489b3f1fba0f4a1784649da16c4b76d46ae5d6ca642c21001d1dba5b8610af9b44aa1b2ca
SSDEEP 49152:YhtSn8EApI0figjgiDn0AP5w/KqzFUW9kfrm:JX2iWpheKq63jm
TLSH
T12095BE13F2D901E8D05ED178C7568632EA62BC160B34AAEF0A90B7561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 74bd340f527edc195bb83012e5cd413a2699d4e713139b6a7eb5bf0e6d932a2a
MD5 c92383e460d76cdd66df9ba9999a6de0
SHA1 cbbaf228beb53d161263236ba757691a683267f4
SHA512 a9348d28db2efeac53df2903057a0646276612c3b6ee2d5f0680909dfbedb1af3727f250f983c2949a7e4508cd1eca41a4abe3c74429214c357e4bb87b593399
SSDEEP 12288:AH95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:AHzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T18345236EBFCE66F0DF0616F2856996DA31B43B9BB64480C31E90BD059D3CD7091E0AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f9b6f12fb8c5a1a35abf2981bec9b937bd042058e82f687c2cbf7d58e3237d84
MD5 631490173e279f5e548bca89b31b5ece
SHA1 85581c449310ceee5205ac0e439db6fcb3cf9802
SHA512 7a9ee84b9c0ee06cd6633e47854748bb6fd36076f4e5c2ef7b90e50f64e621124d87b2b969d41cb69e9221122aea84e0457b9d3b1815609632de21181eceb446
SSDEEP 12288:CE95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:CEzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T15A45336EBFCE66F0DF0A16F2856996EA31B43B5BB64080C31E90BD059D2CD74D1D0AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 86a6e6d52b4d42b4fcc99570f639d65fe753829532709b9d53c5904be4339306
MD5 e4f3c3641251bf4240bbda4af47cb6a5
SHA1 a7768156220506dfeeee1af56031488d7fa85cb9
SHA512 2d640f2a7672676494abb30dcf87904d546c6eb5b2724d3a9d213aa9b224dd3aed2d2ca8ef6d7adc6b769b7556802c235717a400c68faa9820810d8faacb9587
SSDEEP 12288:0695DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:06zwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T1DE45236EFFCE66E0DF0A16F2856996EA31B43B5BB64480C31E90BD049D2CD74D1E09D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 0dc666609b9ee35d75e3423dabcb289ab0f89d2838c8ff5049fc30427e87999a
MD5 04c92177bf91b8f127a8633c79205e80
SHA1 15a985b2e225fafd4d0888eec333710e2daf55d5
SHA512 d24d34313bb0c8d7a974db8bd6098ebbd829e5cb0c57218d3b09b9c046d46574eac5586b1f51cddc2bb8c8c62909079bc98d47440670ca3aaf859d890b72ec4d
SSDEEP 12288:RVF95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:hzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T1D945235E7BCE51E0DE0756F5C97692AA32F03F9AB71082CB0F505D494E34AA0E9F0B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e3639701e7d16700153c7d5ad75b847ae73ae354e2fee612da20db795d25670b
MD5 9396566aa7afc060fa493e42ebd52d28
SHA1 c306aa3c15e48f33787a6a5c56d3407c571d8cf8
SHA512 72c697b689112eaaa594914194081a8580b7bef75c1e4d5691f01f7d797c1cc00d75d09cb96ed4feba9cd79c162d1fd315e26f03d724a084061c7f73f3674dc2
SSDEEP 12288:r995DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:r9zwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T19D45235EFFCE66E0DF0A16F2856996EA31B43B5BB64480C31E90BD049D2CD7491E09D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8b5d2fb22e9d14fbba4a843e5ec1430ded569e6cdaf10bcfc6a526373274db08
MD5 63b9a1f8afaddab273a139dafb5d35c2
SHA1 1f327135d36073974a3f1d38adf110ca636ed206
SHA512 7c251ae819150602153c2c4128f868479edcac38b535899e6c45a5594ec4797741440207471a94e75d64b635482ca7224d002aac5f3f239ad7cf23944d99ab9f
SSDEEP 12288:lw95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:lwzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T1DC45236EBFCE66F0DF0A16F2856996EA31B43B5BB64080C31E90BD059D2CD70D1D09D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6eaff4830276d2d7c7599d16d13c9bcb4f0edac422d37d3c2d38cff50ae33163
MD5 428e822ca1e546e95ad00c79a13f08cc
SHA1 0fee03312bfdbb8ed7aee075109cf7f79e7c9107
SHA512 9dbbd3f6489f4169d93aab27574c9c4d4981c448caf8eb4e47d1f1aea42108b2c035f876c622421e0f072bd7c1f215b3ff686730b4c49d9ce5f0d16bfc629241
SSDEEP 12288:mc95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:mczwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T11C45236EFFCE66F0DF0B16F2856996EA31B43B5BB64480C31E90AD05AD2CD3091D09D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 54e36f65811db8ffbb970fa5d72e47d88552b2a6bf351c5cccfe33fb49936605
MD5 35b6364db23dbf7665e3561d53756e04
SHA1 a361bfb7311b29ed4b9a9d5e6c0758de01ae5cbf
SHA512 166c32ea62d86032a5280359edd11642cf7b4140b52f22f15b1353bb87c87bcf804b6a2caabdde45ca805619473b0cff913c7b0e745cd533ba32dc231b0186f3
SSDEEP 24576:aZM3zFVSOkzwbD2QMqW0FUWcrUbkfrA9xt:aZM3zflKqzFUW9kfrm
TLSH
T1D06501A9B39418F4ED67427EC9258906E2B27C5A1760C64F07F43A265F333A01C7DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b22786b5d63bd83ff712054d3be45595d1d1b7be4dd1e607c11abfb1de7321ca
MD5 8794ae90c8d519ae2d2bffc45c3a1cf9
SHA1 c271df6d1c9e4d34cc2f559060840d32ef14ec0d
SHA512 134a2f6f575dd24bc5ee12218466bb3e8388eaca964aacde43440647aec81a10ea2851b229295998e1ab9e180fd23a220f67358be3780d13c74d7ee6070da75f
SSDEEP 12288:Ib95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:IbzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T1C745239EFFCE66F0DF0A16F2856996EA31B43B9BB64080C31E90BD049D2CD7491D09D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 11e0a01cee1bf79e77c711c352f6666045c0249a3b6fdaff3791201e6a84970f
MD5 c53b57f94bcb0d2b1ba832f97cfae8b2
SHA1 e8ef14ebbb881e5c9386e35f01e9b079c1dfe583
SHA512 34b25d1ba1681cf0f1853ce0c2f4fe4590135708b211b6a9037b686285fbd92ff12fd13dc34979634c4620d656e15c60557859d931f4441d22191b5dab6ba3f6
SSDEEP 12288:aP95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:aPzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T19C45336EBFCE66F0DF0A16F2856996EA31B43B5BB64080C31E90AD04AD2CD3491D09D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 aa6537fce66e70c0040e021cb61e259dc2417cefd6563e8ff3a0672c4d84e481
MD5 47978b21b551f490ad495b78f9c8c8e4
SHA1 40018be9b1e58e266c9db0c025375f444abd0d82
SHA512 87935a6642adf6679a68194f36f3bf13878cc30ee93eaa250e3e44872ce735d211d2445ba4f18578751aac2bade1f7df332a4d61b4e26020a24e9a910f882bfb
SSDEEP 12288:IyPz5L8Y95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:JzyYzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T15E55125B77D530F8D5275279C8A21A02F3B1783627208ADF17A04B762F276E09E79B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d0a8b543c2b7424640e97eacb0d26dac0a46776fc7dae887cf0ab0e17298a770
MD5 5a86c488aa2c75cb5a544f0ddaa8ecfb
SHA1 5ba31691c927f6ea742bae54c2823e0c8c840b60
SHA512 0327c2f93dd80cf847d783f5ba0513fae86d165ed0ba58e287629d879f25fc169502814b67e44d78cf03ee4e279cfb91e673fc1c46fba97b50b3836247d181c0
SSDEEP 12288:zb95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:zbzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T17D45236EFFCE66F0DF0A16F2856996EA31B43B5BB64480C31E90BD049D2CD7491E09D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 49459dc8c71d6a62abb9601b60b355370c9105c634d2ac0d2d3c0ca8631d14ca
MD5 550ddc4a5b9d6f985382f3d81cc82ccd
SHA1 743cd03c44bf8d53cb2f3a74f4afef81ebb38eff
SHA512 a2f15ee54e8b87f05db74643cdb7276524fcee19ec1c372326f77e7467a1f667f2755d6ed1e35e76b0ca8b20a8144efcdf5e88927c6b07cea75be25cf228a622
SSDEEP 12288:Tb95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:TbzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T14545236EFFCE66F0DF0A16F2856996EA31B43B5BB64480C31E90AD049D2CD74D1E05D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 8544c8053da127a39b52985c452edb6894fd6b159254784304aeb6b2f3113079
MD5 f34936a2a8e7c4c25f64714faacf3f0a
SHA1 f46b22d6083d1db4e865bcd9ac13ea83475d866f
SHA512 c396178bac59812cb2450e106aec796ffee69d53f6706aa0242f0cfc79caf4f27a30a43e5a39d6c8d5479901789838d9f1efef913307c26d12da2adc7c88717c
SSDEEP 12288:pyPz5L8Y95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:IzyYzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T10C55125B77D530F8D5275279C8A21A02F3B1783617208ADF17A04B762F276E09E79B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c2cc2fe9b095b6c3d49892c34c547c452cc1c55a07d983ab99222de91bc4baf5
MD5 270f0abde5674c15bdd1f3ff27399e59
SHA1 99d3cf6c6b6d2ae0b47b8e7f386731326dcaaaed
SHA512 38a627b8c294dddbf655e77d6b5773244699d65aec9ecc01bf0ad59eb4a18b88e7d52d1a31edbe83c4c551be3c23633d0f8df7b3df54cb6428fddd6500d1391d
SSDEEP 24576:aCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAWzwbD2QMqW0FUWcrUbkfrA9T:aCUAPTY+8Wg2lIL8lrIUJLWwqKqzFUWl
TLSH
T19A65BE1EA3DC0896D4BB81358A518A06FB72382E2B21D6CF1160C73D6F27EE55E75F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 390cb8c716f90eae0b7c6c48ab21133c8e215203981a30c06a84025918b192c1
MD5 9cd78ec770db73dfb2aeb2bdcc5685f2
SHA1 1983000ef11273492bbefaf96b85d142120b01a0
SHA512 b94d9dee0f84f1446ff786175d1e71073c1f2e5ddb41ef55c903279b5399ca993f9b8a745e2fd4774d6e8dcb1716387650f04993d58edad5b373cbc802b74ffb
SSDEEP 12288:Spsfr95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:brzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T17955011AE28812E8C55E22B5C7568A41B3733D66A3E1D3CB17D0F93E1F396909DE4B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 84e327afcef3b1608ed5ae9c48e31ed4ae7970cbb9802ce594754e48010926cb
MD5 f33f614559c747c594b82c71456e2d84
SHA1 6144d07192b8bee819fdaddb23d22413630ca33b
SHA512 731118e0195df7b47aa0041ae97706fb0f48ac7b8153fe09365479b2e559b0a741c8fb8a13b138fbf5f24df07703f803d1dda8531bd8ed58e6caf9be74d80c0d
SSDEEP 12288:ea95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:eazwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T12345236EFBCDA5E0EE1A26F1456ED2753178376A7B40C0C35D406E44A838DE0DDF0A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f998e356a4df37f76ea8d055b8e8fede8a16497dbc1a4ff2adfddf7882a24231
MD5 c502ca1f07a97c95ec8d83521d78450f
SHA1 ceef490e01df7b55c92d6de534546d873be3e639
SHA512 1ec522721e6396735ad2942de2b1e7ed426ad8901c1a595884cfeabf81ca88d80fa310ca069e9ed66ef905ce52ceb63c1017b37152e809ff25732bfa8896293d
SSDEEP 24576:08RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCIzwbD2QMqW0FUWcrUbkfrA9xt:9RZwQCyiHiQEaaPnMUKqzFUW9kfrm
TLSH
T1E385AF1E63DC46A4E4BAD2B8CDA74407E6B27816573197CF0190C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 c4562bde3006ff60ba2438eae811dee40988b6c221a92964a8dae3a3dcd90cc2
MD5 58c0224bf9c3b4dccd0da027d720eb98
SHA1 4af35ff5a3ccdb1a70437185ac21f82fbbc49e50
SHA512 69b91f20491d349484100abc554a2ff50596aec1a4d5e8c0cc61570d10ebd13b0e64883b5004e39907c7f550ac0eb43be3a5d09a02752f7b93d0c710ff69bb33
SSDEEP 24576:ObxA1UGKzwbD2QMqW0FUWcrUbkfrA9xt:ObxA1UgKqzFUW9kfrm
TLSH
T1BB55122E67DC24F0E666A57989968106E371792A372093DF15D0C67E0F3AEF49C70F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 05e9a8a0a289867a2aab30098c3df6018760b818d01d0cd39707dcd84d83267d
MD5 2f0bebe7292d0cf67a3f99a37ec4366e
SHA1 aa49a475a9603b867dd189f5b0cbb2b6afa6c597
SHA512 35aeb42793cb14f7edaddd58c765c17164f53db6b86d0a76a4a94f82c9142a945d660eedb1cb33845219b4a852ab1b4f2ad857876eff6c2d86586ba8d51bd03c
SSDEEP 24576:4jsmP0yHaqrVqHra44KDzMsrn1zwbD2QMqW0FUWcrUbkfrA9xt:4jRP0yHfVqzlAsrnyKqzFUW9kfrm
TLSH
T10245AE2EF2B910F9D8AAD176454507B5BB71742D1F209AC70170C634AF0AEE89E34F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 6df71a19c93e470f553699d72d38edb811556bf3b1c53fe7f0783448c297fc16
MD5 ff05d25bac11d7ced6d5c3f5ff8cdc4b
SHA1 d257ba7751b29e5d6804ed2d5f436c2fee647b82
SHA512 fb15f41c25a07e6a4f57a07aa307f38ad704b8d59518121c79746997ec988eba96cdb026b6782b98993297b267920d343749e2243a2d495ef16f88222b923a48
SSDEEP 12288:pQ95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:pQzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T1B44533ADBBCE66E0DF0A1AF2856996AA31B43B5A774081C30CA0BD449D2CDF4D5F06D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 7b17659f0eb4dca1f8d51b2641f319bf6112a36b2158a610e7297aaab2fcfa5d
MD5 879cd86431d20e04535ab578bb3a4711
SHA1 0f56761a7db29a9918a5231ace8600fc7ec2c1f7
SHA512 f68105cab24107720b6c27be46dd6bfd2881b7921c5ecd773ce13ad2214e0d7ee1678f565c92ae20a7eb682fdda81a482faa17244fdffe073b8bf5b6dcf23511
SSDEEP 12288:OObIA4LWO+vAYFT+95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSU:3ALBUT+zwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T135750159F7D800F8ED6B913CC9A68A16E2B2785D1360E7DB07A84E551F237E18E3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 495f6eb06e8d477c1c85bb1be77ce2d3d7982c521f731097a781f9586ce817a4
MD5 77fac947bf4cfd9ca687dd2f65eef2f5
SHA1 dc93cd826da6b768a752a5e0aa73aab34dc79110
SHA512 dc92f32543b9221d87ad994500f71a56694a31ef196dbd91774c0efc77e66332f488d75e497c30637571f59e7fe2e729d810193ae25ae14c0b5cf2a512c28b35
SSDEEP 12288:a70VmzIYNvUyBpX95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgi:rfYNHZzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T1EE65F12FA6AD19E4D53B617DCAC38209F2727866171192CF05F0C27A1E17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9d604ea4019eef6fe1e315399e29f1f5690938f32b553095d2ba8fdd74d55f7b
MD5 95dbfcd21dd180173a13d3844232c798
SHA1 7eab11da66e6cc96b783200e980ccb13591b1201
SHA512 96358fc349f627bc769a606a95dbf0b20c0d006cfb0f499a411175f8029556428cc2e5116ead542eeca6c5d29e50688c0a0b286740c9174b0465a2f2085eeade
SSDEEP 24576:pnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKP:pnXoJJYH84VVS6AmETJas+cHBjSSKHPN
TLSH
T12665BFAEA2BC04E8D5BBD17DC5C24506F5B178661331C6CF026082BA7F27AF59E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 01f0973912ee2a76115f01d5156ef921a65b0db67ecd0e6f1ba9550957319005
MD5 fb7227154ec370a27fc61a796e8f0c07
SHA1 cdaeeac3a41bdb79197fe9fb3974544ad0e66c8f
SHA512 b63122e975991dc313f3461256cbacf13e51e575abee87b91ec1d836145867bc0c936bcb662e9568d35fe50af2913852099ffe4eaab8914ca20f84da49183107
SSDEEP 24576:Tv7Xbxd9Tuycf8M/TYlSuxwr2PC/zwbD2QMqW0FUWcrUbkfrA9xt:TDLL9TuJ0M/TYW2PVKqzFUW9kfrm
TLSH
T1AC858D5EA3EC42D4E47BD6BD85B79146FAB2B855273081CF0290856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 2bdb888968012260348cc35f3833167a5d8141b6709c42aecf3e14759bdf9e36
MD5 59124d8cd8005a41939a2494fa8e367c
SHA1 b84f188f12fff3a5b84f47c90f9a36db46399dda
SHA512 a17efc140f0326f6be0eb1058ef66efd35d38ef6a209638e48c95dcb4a48e0f2151ab4fb032334712efd8fea2d3b3cca18afe61dd5dbfd71211e6b9f36cd1be5
SSDEEP 24576:jegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10w+zwbD2QMqW0FUWcrUbkfrA9xt:jngOJOmPOHk/KqzFUW9kfrm
TLSH
T15B55CF3FB7BC15D5E03EC17D8A968916F6B0782613255ACF05A0827E5F1BEE46E39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 93276390241fcb7a6ba98a0a7711a402733c4f6a8bd7e1af2b11a1aba42bf8b9
MD5 3708b231e5efb4960816669bf6cb21cd
SHA1 b718a6a0a22648a6d3c75fe44e5377ee5e9d8d72
SHA512 221ed970f47312efa7ebc06bc7616d6ffd67793ecd0f11ebfe4547ffc5f7fe93cdfe3a15275701e07c96c53ffac1a14018c26666fcfa5c0a5f273ea975d6ff4f
SSDEEP 24576:ZLJnJiTk3R3waE4JrOwzwbD2QMqW0FUWcrUbkfrA9xt:ZLJnJK8R304liKqzFUW9kfrm
TLSH
T19175D03DD2A810E8D4B7C2B4815A1B56BF31346D3B2169CB19B4D9313F12FE0AA79F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 51eece7e3e06d210b26763a661a0491acb02cfa3be0492cd3792163b8671eba4
MD5 4d4bab8a11f46a2ceb6ab45bef8408d3
SHA1 c68a1164cb53d86f272d30aff6959455f7236cd5
SHA512 c86fea866e25cadd8b23f3a84abb7dc7b2f781cf309b1f343d91455f976f928f53780c74275e3168bd86f1f2f1981415e63279a96310c436932a9c07ca3620ec
SSDEEP 49152:z9GqCzDScAZmlvTcFg8Ph6JKqzFUW9kfrm:3OKq63jm
TLSH
T133955D05F7EB5298E8B3CAF1C96694169B327C509B34F7DF0A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 f6c2b629e33eac57f78115abe90fe86ab9fe925cebf96308cd06d27ccc25975d
MD5 114541a98b6d9fa897b2ebf2dc513518
SHA1 e1e34728b652f82434cb431c1153b9403b69182c
SHA512 66012e77c840d89a169d1bc0f36ae5845c90c1ae54b66ff5de43849b54a7816f713bf053fc34fe3d802aac298cc6c16b31bbe0e2c5d6f3d7c8e710cd74b6a424
SSDEEP 24576:plYJeXm5jUuEuzwbD2QMqW0FUWcrUbkfrA9xt:plYJeXmRUuEPKqzFUW9kfrm
TLSH
T1C755125D7BDC30F0E61E51B985A28A55E3B1B176330153EF09E0C9798E2AEE16E74F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 a0ec63e331e79eaa06f4e0eab944364aea4db484e131507462ce0055ceac5ab8
MD5 eddc6bc1b113d4f0e9417ab86aa0d405
SHA1 7f2de0a8dbd9b121865c7431c68305ebb12c465d
SHA512 2997f34c569961a018bbef641f0fa24abab7231c4023b8100048331e76c2ccf14a273b2bdc71a2ac8a5207e39768859a376fb8510d7bffdf368a1d6f0f9dc228
SSDEEP 12288:Cwu6kyV95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:CVtyVzwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T1DD55230977C861E4EE6A0678CA7381A46A747D216F1083DF09D0FA3F6E35BD0A8B0F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 653aa7f0418f56e2355c59738721216b8eb54d47e9781e4c6d91790646db4604
MD5 8bc7998bfb3fedbc32ca4462f23b4106
SHA1 cfee005d7b233e4edcd627a683cfb189444a3f9f
SHA512 62dbcf0b37402ba4baaf35de2d5bc01b836369006a0e903fa44abae8f9ca3784754134c24133f6e23f802840bccf408ab6b56a542f82cd307148a48bd74f9942
SSDEEP 12288:pP+95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgU9xJ/7:t+zwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T18F45236D7BCE71E0DE061AF5853A96A631B43B76774090E70DE0ED64CE2C9A0D5F0E84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 63407b6303df86535fc1edcf2858b5fc9beaf63a3929a3194847e0f18a94537e
MD5 131fa00fa823f060665ac82ea24147f7
SHA1 210a14084535c961e3d0262d452f0bf8613e768f
SHA512 1644b55da2efe92561b4ca60c0f6cec3bfff99511a69ca02beba71273d3dbf1760b5d7d116cf894df53fd94c38fd280116a9b741a394b04eeb6a9293a6562231
SSDEEP 24576:1C+TyQIu93VAumZr7jmLzwbD2QMqW0FUWcrUbkfrA9xt:1/TfIq+YMKqzFUW9kfrm
TLSH
T138558D1DA7E91DCAE276C675C8A34493E6337872237186CF2444C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 42455a99b66cdedbadbccd5a247aaa0d3bbe422c345db349eb57bae71823ec64
MD5 29a01f0184213162b7047a5ae8a00ec3
SHA1 54c5aa51053bc94bc29ae91cef2f67fab5e345e5
SHA512 d21528d2b18c829d235aeea6a81b53150b0476160f45ed8fa77078b37b2fd674dbcd429b1a767b67e767443e50bc2e382a0c213420c70f77a0adbaabdbab666d
SSDEEP 12288:FcyrWOstaa3kcsi95DXpSTpbDVgQ6VpEJxW0GVI47W+ShcrUl2x0VjaDzDxfrSgi:wLQikZizwbD2QMqW0FUWcrUbkfrA9xt
TLSH
T17B65010FB3AE00E5D56B827C88854252F6B37435671263DF06A0CB794F6B9E9BD34B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 672703e5b5c390506f75a7f09121562faa4de11553706a13f6054cabe70bd636
MD5 869ee6745b510e187c15bb5987cef872
SHA1 e7c74f69c1c093629795d8ae9181e753059c76a2
SHA512 1ef27997e700f1eec6c64dcb868a872ce814479b3226f050d862e0f4ab51ffb861578179a2e2ca63dc619a6673b5ae4aa6a3e0f4593764130e1c14a2440b3122
SSDEEP 49152:opJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPSKqzFUW9ki:5pC7b4+80GTkRKq63jm
TLSH
T1D5A57C3DE2F810ADD9AA8375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 75021108ce1bc7461410af55331d21e51efa65581acc669464ec95f3876f9153
MD5 b7aa21eb5b1c8035884eba98df1386bb
SHA1 da3042047181caf9d293dec42ad4e4e5599c5971
SHA512 97db01a836f3c7a66165c0b65e8dad5af9033307c05155f87fdd8628124edd79b296fb1614eaf897b22a2a309387f7b8474120c655e7c842cf581d835af92771
SSDEEP 24576:hSAwJPE1IDAo+4Kt+l4413lUQdzwbD2QMqW0FUWcrUbkfrA9xt:hqPCIo4Kol4jQKKqzFUW9kfrm
TLSH
T14E55BF2AA7F956E4E17ACBB4D663C611FB723823133163CF4290853E0E169E89E75F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 944f6e987f6cc5eaac12a8d7b2185333d393051269ea62db4cda31045118a106
MD5 ede48f8ce7a763d5faa6fd6ced2fa425
SHA1 06f542447713e42bb0e980867843911eedaa8d84
SHA512 80d8a15fb2fc353baefa8c51df7e8a7e46dbb1b2d23a754dde0ab9cd9e98483091fe79dbd435ff3b806f18da26dec6bc431a3f39738e31acc4688da67cd4b95e
SSDEEP 24576:PyLXPLcT94tNzwbD2QMqW0FUWcrUbkfrA9xt:Py7PoqtaKqzFUW9kfrm
TLSH
T11975E13EE75D04F4E57AC27CC6A38506F67238AD032166CB09A095791F6BEF46939F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 6c917b6b596861af5d88e2f6dfc3fc34590a2af2c0bafeeedee519f0dcc6810e
MD5 a8d9a4ee34dc10102a738faf4935c47d
SHA1 93ed3f5e431835633eabb46c665478176e771ab5
SHA512 415e056fa1a5de4cf02108d9357869702bf443a5852a1547afa741a50653db878db2c79ba956cf5ad75c47e41746868a444e4dedfb6bc64d22eb5973f3a3eee9
SSDEEP 24576:9Wv8qjpyzwbD2QMqW0FUWcrUbkfrA9xt:9Wv8CKqzFUW9kfrm
TLSH
T14B65225E67D834E4E92A02B0D536826A10B13E77336496EF39C0EDBA4F38AD0D579F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-104-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/228-99-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/228-116-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/480-114-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/480-414-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/656-113-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1072-119-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1072-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1744-137-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/1744-143-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/1744-146-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1744-362-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2072-40-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2072-71-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2248-369-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2248-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2400-163-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2400-67-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2720-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2720-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2780-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2780-63-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2780-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2860-412-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2860-160-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3036-152-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3036-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3036-32-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3036-38-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3228-416-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3228-434-0x000000000BE20000-0x000000000BE21000-memory.dmp

Download

memory/3228-184-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/3228-176-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3228-178-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3228-436-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/3228-433-0x000000000BE30000-0x000000000BE38000-memory.dmp

Download

memory/3228-219-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/3228-170-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3228-200-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/3304-78-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3304-112-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3304-84-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3872-88-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3872-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3872-115-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4116-9-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/4116-97-0x0000000140000000-0x0000000140730000-memory.dmp

Download

memory/4116-0-0x0000000140000000-0x0000000140730000-memory.dmp

Download

memory/4116-1-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/4116-368-0x0000000002100000-0x0000000002160000-memory.dmp

Download

memory/4116-411-0x0000000140000000-0x0000000140730000-memory.dmp

Download

memory/4188-415-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4188-168-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4260-413-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4260-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4328-367-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4328-149-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4728-68-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/4728-54-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/4728-70-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4728-60-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/4728-64-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4888-121-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4888-221-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4920-325-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4920-129-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4920-132-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5028-430-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-440-0x0000027C8E6B0000-0x0000027C905CA000-memory.dmp

Download

memory/5028-417-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-418-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-419-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-421-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-422-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-420-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-423-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-424-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-426-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-427-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-428-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-459-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-432-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-431-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-429-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-425-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-458-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-457-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-456-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-448-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-441-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-442-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-443-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-444-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-445-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-446-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-447-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-449-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-455-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-454-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-453-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-452-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-451-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5028-450-0x0000027C8E1F0000-0x0000027C8E200000-memory.dmp

Download

memory/5044-120-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5044-18-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5044-23-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5044-24-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5044-25-0x0000000000550000-0x00000000005B0000-memory.dmp

Download