privateloader | 07df1d2963ef3dacddad4c3a7a6a7b7cc4e7afff486b3722daab252b10965494

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/05/2026, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
Size 8.8MB
Sample260526-gap43aex5t
SHA256 07df1d2963ef3dacddad4c3a7a6a7b7cc4e7afff486b3722daab252b10965494
MD5 578408000b3600c4c149688721ae30d8
SHA1 83b94e3e493d8002d36453b8e265fe541f6d5312
SHA512 1a331cfe5e10e90861b481064753ba3fa8d9bf67c61148d6474592a923cd81d0c1d13f3f8289cff2c496c3299f62a77bcd110d748caea6ee94e2862d426f8e30
SSDEEP 196608:8Uli98CCRrsW5pl/uk2YisAv/XXYbTmkeYo6PY:86o8CCRRpdYYisAv/XXYbTmk51g
TLSH
T14D968E1262A9D1E8E0B6D138C96645F6E2B27C19CB7097CF1590BE693F73AE05F39310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit privateloader loader persistence ransomware spyware stealer

Malware Config

Signatures

Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Executes dropped EXE 24 IoCs

pid	Process
4440	alg.exe
3020	DiagnosticsHub.StandardCollector.Service.exe
2208	fxssvc.exe
124	elevation_service.exe
3232	elevation_service.exe
4912	msdtc.exe
5840	OSE.EXE
5556	PerceptionSimulationService.exe
5860	perfhost.exe
3944	locator.exe
2140	SensorDataService.exe
1688	snmptrap.exe
2680	spectrum.exe
2944	ssh-agent.exe
3960	TieringEngineService.exe
5588	AgentService.exe
4772	vds.exe
2268	vssvc.exe
5420	wbengine.exe
2596	WmiApSrv.exe
4564	SearchIndexer.exe
3516	SensorDataService.exe
3588	AgentService.exe
5584	wmpnetwk.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\aa8aa5f0ccebd5c8.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164703\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164703\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec6391abd1ecdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cad35daad1ecdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021c9afa9d1ecdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b827f0a9d1ecdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
124	elevation_service.exe
124	elevation_service.exe
124	elevation_service.exe
124	elevation_service.exe
124	elevation_service.exe
124	elevation_service.exe
124	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3020	DiagnosticsHub.StandardCollector.Service.exe
3020	DiagnosticsHub.StandardCollector.Service.exe
3020	DiagnosticsHub.StandardCollector.Service.exe
3020	DiagnosticsHub.StandardCollector.Service.exe
3020	DiagnosticsHub.StandardCollector.Service.exe
3020	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	2208	fxssvc.exe
Token: SeTakeOwnershipPrivilege	124	elevation_service.exe
Token: SeRestorePrivilege	3960	TieringEngineService.exe
Token: SeManageVolumePrivilege	3960	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5588	AgentService.exe
Token: SeBackupPrivilege	2268	vssvc.exe
Token: SeRestorePrivilege	2268	vssvc.exe
Token: SeAuditPrivilege	2268	vssvc.exe
Token: SeBackupPrivilege	5420	wbengine.exe
Token: SeRestorePrivilege	5420	wbengine.exe
Token: SeSecurityPrivilege	5420	wbengine.exe
Token: 33	4564	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4564	SearchIndexer.exe
Token: SeDebugPrivilege	124	elevation_service.exe
Token: SeDebugPrivilege	4440	alg.exe
Token: SeDebugPrivilege	4440	alg.exe
Token: SeDebugPrivilege	4440	alg.exe
Token: SeDebugPrivilege	3232	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3588	AgentService.exe
Token: 33	5584	wmpnetwk.exe
Token: SeIncBasePriorityPrivilege	5584	wmpnetwk.exe
Token: SeDebugPrivilege	3020	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
1104	2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2872	4564	SearchIndexer.exe	104
PID 4564 wrote to memory of 5992	4564	SearchIndexer.exe	105
PID 4564 wrote to memory of 4168	4564	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-26_578408000b3600c4c149688721ae30d8_cobalt-strike_coinminer_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1104

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4440

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2044

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4912

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5840

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5556

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5860

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3944

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2140

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2680

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2944

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4008

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4772

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5420

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2596

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2872
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2808 2824 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5992
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2812 2804 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4168

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ec16db1c354a65a9fdda5ebd97cfa685e93764bcb8a6ed39fbb39da9d3d832c0
MD5 4d16fd8f7961d355888227d4de2a4e3e
SHA1 5d76dd2a6dad9f3c6680fbe28ef760a1df38b820
SHA512 6aa7dcb0ef2e8560ec1b20101bd705e9ed5bcb6e254c08e7e2700a74d7443c3f5a33d9e8d47d9aef1d5981406e800a6f21bd4c4c04115bcaaeddf043e24954e8
SSDEEP 49152:Ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxneJxNiyT2X0XQ9:O3q6HjBJNjTm
TLSH
T129D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 024acf3509d2de7a5889eb4d96fa2d91751ac9595803813f236fb870e80f2b12
MD5 5499d49d6864d350a91b4db72acd25db
SHA1 e1590b7e8fce07099623fa45123052bbbf7a4a13
SHA512 e9a4bfd7a375c77950bedb04cdb7e2764bb2fc0705d63b60e14ae31a904ec0c2544d3370d0b063236e61424c6ea7ecd0e8ad5736a3aaa77e8cea1516e648fe3d
SSDEEP 49152:RiP00NUcMvjGqoQM23HWGJxNiyT2X0XQ9:oPjdOeWHpNjTm
TLSH
T1CD85D016F6748731D073C0B9C5D2A68AE93130865B308ACB4296D77C7E67BE6CA36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.1MB
SHA256 e0252181c6996b1adadec43d62e472569db9874e4b993782b67d2adc97c65cfb
MD5 c63451729122c79e637cfa9dba364a6d
SHA1 1d490f824abe95258e81b10bc2af0b8ff94ae892
SHA512 21d9d50d5e0d9250d72cd285e34bc760be7cb6852f41637eb6630634412e7fae4027e2f9172dff252700184ffb14b8f68cb6b814710aade65dc5c2a89dd0dd06
SSDEEP 49152:y/ezSC6vUzPvCHjyoMvjGqoQM23HWGJxNiyT2X0XQ9:2ezSC6v2XCHvOeWHpNjTm
TLSH
T1B6A59E15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.8MB
SHA256 91b756b90ec93164c55ae13fb805a912480314e4b212ad3d43cfc5d4b3943410
MD5 35f14e49e57035b1b66aad08c3fbfe38
SHA1 180325e2181d430e1b28bd94d2ed04f0a492ebc0
SHA512 76cced73cd9607a472a791196d9f735ef2c35208418e175ee29ea1ef26f480ab18e4fa7ea14ffbc2b1e7c249d21d2d073efb4ecc9205e1c1c1186a50d003c2a3
SSDEEP 49152:laW2d5Xl+gMvjGqoQM23HWGJxNiyT2X0XQ9:hY51+gOeWHpNjTm
TLSH
T17E95C066F5748331D073C1BAC4D2AA9AEE3234415B318ACB1246D76C3E67BD6CA36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 d4feb3badab796ae9422d21d663c257b5f646d5503b8b31377395e8c1f458b52
MD5 027b811f5c87aedf740fa4ec0a96ea78
SHA1 956abb1900ca16031d17f4bb30061c4e5acec741
SHA512 124120031202d5f55daffc446c2d8bef731f9ade91ad64a9f09bf92c1130c1a4be4e64bd8160a41ac1cc9714a50ba3d145c5eca949ab4fc54e163730169476a5
SSDEEP 24576:INM52vjGzyo+pu/vQrI2V9PMgJMBG4Y24NiszT2H3o3XQ97:1MvjGqoQM23HWGJxNiyT2X0XQ9
TLSH
T15045338773012A90F35A1B3024E5455BDA059C947E91AFD60CFA7EAEE5BCF28CC2187C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 2.1MB
SHA256 f21328e811d4370b793941fade9397a95806fd6afd35919ec26dc475199cd175
MD5 b3806b40ae762f42367b9010d2e778f1
SHA1 2b6301312ce87c83bf85c380d6762535b8a3f8bd
SHA512 6c2fef8f28e84cd8760e7ff2dab5bb9b2caa9170a92c34263986db3dae65e80ea236ea57a67ceb49d684f244838435116237b727bacbad1277aa61001984acfb
SSDEEP 24576:SJIUV4Y24NiszT2H3o3XQ97N52vjGzyo+pu/vQrI2V9PMgJMB:SJIUVJxNiyT2X0XQ9hMvjGqoQM23HW
TLSH
T1C1A5F17BAE28FCE2C27E5D785A918600D76278704F61A3CBD175830EDE236E44D75C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 5.2MB
SHA256 2198df5b41c9265ddc4d617e3e1734ae7098a5008aab358ed8dd7b746fd68722
MD5 64c89854ddef33e4e76e9b5a18b15805
SHA1 593db811df4709aaab33cf174ae4f07fe7b76245
SHA512 b4dd025e553613b287bb1159f76f163f2269f20d25ee8ec75d4d5dc0a749fc472dfa734b84d7787732a67e065e534ee3f8a9f1c7b71f79b2d840bd6cc6e27fa7
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THS:KQvGAdlCEL8c/yRNw5C0NjTm3OeWH
TLSH
T122468D656BF880F5E0A7E134897AC5B2F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 2.1MB
SHA256 d828e0b0e6169b63d01bcf87b7153867eb8bc0feca7057310639a92c7a87ee91
MD5 5958dba6b66a7461f13ce17f7296337f
SHA1 fe7e77bbb2708c5c77ddd19c0aa9e1882ef93ab0
SHA512 b3febda2ac38a4fadcea66053254eb79bbab1781b620f88dc97e2c0f37eb3c462c3ea6191fdc9e8ae1c68f74a260a9b5b79371d463435ea6b328ea7575fcc62f
SSDEEP 24576:jQewsAjb4Y24NiszT2H3o3XQ97l52vjGzyo+pu/vQrI2V9PMgJMB:UljbJxNiyT2X0XQ9JMvjGqoQM23HW
TLSH
T17EA50131FA34E432C37B0EB21B65C716542C79204F511AC3E3F89E9E99746D25B36E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9a95ef6c54aa8dcb3a31a85e4cc572b59254d5a6cd8e5e22194cf6885b44fcd9
MD5 d0f287ef23fe99b474cb0402ea43614f
SHA1 2e0d315f3f69501831a4ab00e460bd3440954df1
SHA512 b78bad0c1e1887f61703412a29fd5d72dfcfa14083c021f179c4a342ae487ba67850d15cf5ce04454efaf1196d0fe5aa7686dd28845dbae1f5e77cbf4fa2c44b
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHlTm:rUEtQevvqc2W1cpV2EI32lTm
TLSH
T1F3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 310ccef3f55212c063fcdb018060f26c1805a647a63012fc70c2a68991b60669
MD5 f87ed1fb43a8c08907a363f7355bfb25
SHA1 57e9a765afbe4d6f55800ddb7386ea8945ac1c64
SHA512 b10f8e6737864121b8eedbc1a621187f6d17d242e14c45a811f0e3d4a9a4085bb9d38db69f968716e5d44fb0a812de9a91200162444ccaacd4798327dfd2553b
SSDEEP 24576:LAhGLJIFoiwtA5l7S5304Y24NiszT2H3o3XQ97:LAMyFoiq5EJxNiyT2X0XQ9
TLSH
T19035AD80E7F955D4F5B3AAB899B68171EA76BCA65E30D20F1160D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 16c41df373e0daa1617b308e5b811386c33c639a43fdb13dbdde61756d24a835
MD5 9eff3039cf4248f7a9cc8953e5f58f44
SHA1 a863137dc27e0a1cf8c614fad6849ea6bc499c52
SHA512 e20b46783410cb9c080a5a99dfe51b4103f91c1de510fb67131c79d96c03ac3879056358ff71d3631f2585231852c56c20115d851960f1e54631cbdd2cd53883
SSDEEP 12288:Kmw5HEjsChN2BFgl0WDm+CxOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:DwuHOWz4Y24NiszT2H3o3XQ97
TLSH
T13165F14A73941CF5E56786388597C536F7B2BC013A25DB1F07A0CA5B6F37360AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.9MB
SHA256 98520e58637efef9c3f125004e52f0c8ea9473262ce8f8543f7e543069d06c39
MD5 3e273f4601b078660a9530d3fe757c00
SHA1 b6db9cab57772a5cf8886c76a374b64847946012
SHA512 ca970a8b3eddd7314497bb636ef85e74de6cb40f22d18cdcfa3b87acbbe793cf451eba01e31d3f12024de629b8372f9e20d141b13799f42627cca42e0032f627
SSDEEP 24576:9Zuy4Y24NiszT2H3o3XQ97V52vjGzyo+pu/vQrI2V9PMgJMB:BJxNiyT2X0XQ9xMvjGqoQM23HW
TLSH
T1AF95238A338035F0E257133888E1460AE72178953B7187CF09B95AAAAF75FD5CD35B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5513691e2819a89726c9350e03bf5b76e26637c72eb72d9d6417077b93fa84fa
MD5 f0bda94d88943123eb30721e12f86f23
SHA1 92b32c6825584ba1325dc34ab940fc4b8ef1cb27
SHA512 099af3160b713107b5969e37a96debe32ac2d881199f0255899d6cf1781d3d461113c954d0aab287dc722fd628c46ce2ee832a542aa1f11234210e7f9986e7d1
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:vQRQyi36YOcPQLvw2gAf+PN35NjTm
TLSH
T1E4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c16f4ccfae5b35a3cba373e8a3c93035f0ee88a788cc076c06bc983397beeb0e
MD5 342a4174a1e8f538f8abdf83e3c68881
SHA1 e7d04566d3cc23b61fc2d235066c8286588a8da1
SHA512 5a2a8106c553dee78577d3ae2cede0febc22e557e43f2c90aba7f5d0fddf985f205f2ffdcb8bf65f89953582cb263355860646c85633c26f7ae099e574a3dfa4
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:qQRQyi36YOcPQLvw2gAf+PN35NjTm
TLSH
T1B9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9f8283382d8df74bf923781a5cec35a2344e8589efa9734a316491d15caee319
MD5 36ce8cc982d7d718ebe2f14619820418
SHA1 29ddcce85b0010f9f26689dd062061ff4925f585
SHA512 ee05c33fe909578cb000318ea07b2af85668b1c972e8c0d3b4c2e96601ddf8fef22434807ddaaa77b35151195fb1415cdcdf45912b20a3e69bfb739e15aabe7d
SSDEEP 49152:168Qg55nhheWu7PNU3/rJxNiyT2X0XQ9:DthWRc/fNjTm
TLSH
T15CB55933B2F200A9C44DD1769F4A872196D27C75CFE0E3DB8551721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1aa580efe679f2a9a56e0adb61f80e92c1b792181b165026add25a3e513dc097
MD5 6773dc33f20f92f7a5efe1fdcaee0152
SHA1 0a9c3bf8a8f2d5b4e7bec4d3b3221456171af9f0
SHA512 f04d6134fe934821119a419e95bd80d4ec287d97a487bdc7cd8860ea05cbc3ae2f5c7c4dc3af80508913461e9e94c8098a7657446a28a7e3e6a0a28755b22a53
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:iy5112gYy5azzVvL69nLKnhZ2NjTm
TLSH
T16C167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bb770894a65a1205b69a88e6fedc5e32743d6672de2d8ba117a7a6783f5e90c9
MD5 41f31c1baff3d2fb752a48a3ff273774
SHA1 c5fc04a06faa72065e4c713ec7a5749627ae9cd6
SHA512 2d124e10bb945913c923ece95b46f652369d3176a354c95a0e6580f743d0810f344db395d3565f754477e7073c8b2821772137efeef3b7d2c0a88b6deeabc2b6
SSDEEP 49152:sB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllJxNiyT2X0XQ9:mu6JmVxd2ddNjTm
TLSH
T1B3D59D13F1D901E8D06ED578974A9233FA62BC490B34B6EF0A9073562A77EE49B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 48cd3f92a442b9198867fcd5ed5e94bfe29bd96040234a41f980d655f218ca96
MD5 669688a67ece41003e7dede34b0ec7d2
SHA1 eee7b1e3eee1582d1370da9ad8d8cfc704b8378f
SHA512 b8147f767612744f1b89fe8cc41c12026f244e4590e80b121fa9a3e7268c5c61aa59ab09095087936d28496d221344403bb881ce049c9a3087f3fe38f66cba3a
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4x1JxNiyT2X0XQ9:nmifPbRwNjTm
TLSH
T124B5BE13F29901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BBE45F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9e6231f344b4b78794faa67e73440e51cba9424ae27ad41561fc8a0b1c2177b9
MD5 bbc04bb544467f8ea935552abb846b15
SHA1 f20dd15329534b5a6c06bcd9f6b610a294b419b1
SHA512 15e36c3b3231ff4d3ebe0aed2d92c3db428b8441567959d1d5f2354e7c0af39142d02e26138233b5f74ae34435b7027cb4263eea77bf13684ab97101f5e598fe
SSDEEP 49152:iSuZQIY0Be2KRRVtOnks6NMHqyJxNiyT2X0XQ9:85dKTi61KNjTm
TLSH
T1CCC5BE03F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eeea332f64d614b99d6196cc0ee9775ca3c62808721df4717548702c5969c365
MD5 ce6eea0fca06e6d600ac8d2f884b6b8b
SHA1 f65d3a393734738ed578b004efd2715801d0b731
SHA512 f08911db987bc984209e9c9173e6d0bcf1f08dc3442a4a88216441ccb877f6f38b7c9fb38152c1db63f93493f7f73c9cf8b760a0923aae121d1c1f15b8809942
SSDEEP 49152:6htSn8EApI0figngiDn0AP5wBJxNiyT2X0XQ9:7X2iyphMNjTm
TLSH
T1E495BE13F2D901E8D06ED178C7468632E962BC150B34BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8ede1e5272ca9fd9b3a73e6c36a2c8ffb2379fa12eb6ef8dbfefe88e911bc6fc
MD5 72329cbc26594556db2a007f6130a7d4
SHA1 50231c090054fdf6d81f6076caf0901c59053e98
SHA512 c98451648d786da11dfb7ae58731bc058b6a72190573a54d043b90ad656612b7189516f783a3e031b9a8a958196fe9d4ab6ad3910b4ffa4293c3959812a1ec78
SSDEEP 12288:B3OsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:B+4Y24NiszT2H3o3XQ97
TLSH
T1FA55232D72009B52F2254BB009CC878AF40D7945FD94B7DE06DA7E69E27C6A4CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 eb05b04aed198b94eb695bc582ee455cdd6da6941618f1d4d74a25c0e6e60234
MD5 97e4a127371ef6adc01ad35839241001
SHA1 e9b9846264f46ab117c162401eadf9ca8c855d9f
SHA512 06a06d471896bf5fbb0ceb0ecb94ebc765f45885427d10c5581421c4acdee620a4e7060895899c58a88c73eaa51fc6531de4e6113bac6cfd4e1b87559571654e
SSDEEP 12288:ICOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:I34Y24NiszT2H3o3XQ97
TLSH
T17455232D72005B52F1294BB009CC878AF40D7A45FD94B7DE06DA7E69E27C6A4CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 182b101dc5baed057f0e9e5070b1af11e08c2ffd207adfbfe49118784f2b09f7
MD5 60df900fa490224a5d5a4e27ab47d67c
SHA1 ce4a581666c93fe6ed923183a9e3fc26ca51c660
SHA512 fe5310efd57e28efaba112485bceae0426f19af0220781731a11e720d407804181227c6c7d5c5cb06b5466480e5b5154bc9058e8d7c3012745dc2d8ed19f7976
SSDEEP 12288:JEOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:Jd4Y24NiszT2H3o3XQ97
TLSH
T19655232D72009B52F1290BB009CC87CAF40D7945FD94B7DE46DA7D69A27C6A8CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0c82022cfd69f9bb5a983b133c124065285dd0ee20a31c51c04d48af19e5dd84
MD5 8e83e71d84e04171b454cb716ed5c110
SHA1 14beae9fc45f2639fc55a5f3f30e0fd689e0faf0
SHA512 630ae36e4ede51dcee7e70588830794e40f27f6c9c881c63e246af29de94c0d2caab8d9695098497ad8bb4a7db7a1f7ad75814a22c8980bf9bba0a2edc83bef9
SSDEEP 12288:kV5OsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:Z4Y24NiszT2H3o3XQ97
TLSH
T1B6552329334046D1F03687B489D9868AF26ABC44FA61B7DF46C13E5D5A783A4CD31FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c902a9f8e966fc3c3294a9d7ef16d006787f5aca4984f94feac06698cea1fd3e
MD5 92a3803281e5c731ff5110d35afe1175
SHA1 905a236cdd880fdce6f95a4af3e123dad554cce5
SHA512 d158bdd64ad37e09d1c8e4f7c81333417930e8efc274edc6ceec68acb204e97386454d3e06ef7d09caee7eff535486b6e5d41c042979279b90a53a7156059016
SSDEEP 12288:xBOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:xs4Y24NiszT2H3o3XQ97
TLSH
T18B55232D72009B52F1290BB009CD87CAF40D7945FD94B7DE06DA7E69A27C6A4CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2dedf15d1242a6d2f04f47d8e540736b9284e308c40ceaf1b72d8c3419415a42
MD5 09dbddcfa766377812fa21012ce99ae3
SHA1 33d2636fc0a6f1c2261509ce1bc74c61d182c451
SHA512 e2bf3922a2a0cdf36aaa1eb6ef448c4926d3421e9aad6815331743df2b5ca7630d703f609ca218b6637dc4c694e8de9eec6f261767c1555f006d4d9c429e99ca
SSDEEP 12288:GWOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:GD4Y24NiszT2H3o3XQ97
TLSH
T1FE55232D72005B52F1294BB009CC878AF40D7A45FD94B7DE06DA7E69E27C6A4CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 00b5aabc04796d572a2c2794d6b73f60ec4f919d9a9fff66c268b88631d7a7b4
MD5 d3742aa382e38db53a0b2336ebf9a7f3
SHA1 b8d7fa612133a3cf6f0ec9d944d2f9b1de5fd48b
SHA512 89e1aefac8c7ea11052cf66f898bc8078a21a73d06184f077fadf1bc2bf23c41c2005693f12b6b9f87b13845811133808f082f38a6cc29753989d351072a4acd
SSDEEP 12288:OKOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:Ov4Y24NiszT2H3o3XQ97
TLSH
T13A55232D72005B52F1290BB009CC878AF40D7945FD94B7DE46DA7E69E27C6A4CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3a62e025c6ee18e394c3b34d186015404fc14cacc08fe6561db532bcb5fdf0b3
MD5 10e469b7e3a6efea71ac9d1a5302c709
SHA1 d5e242a6283a591ccf46509afd9ec1e7b7da98c0
SHA512 f13a1ba0cff66e75ccee5a3cd42af32953669957d627dd0a0bf502e42f34138c7893cd6479834bca034aa0102e751cae31e1cb14771cbb678fa904fcf31c883e
SSDEEP 12288:CiZwbDzzFEoS2cPvyiOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:lZM3zFVSOX4Y24NiszT2H3o3XQ97
TLSH
T1187501A9B35018F4EC67823EC9558906E2B27C595B60C75F03E4366A5F333A04D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ea6e51a53c552357b93f121ec9a35bfd344aed49b434bef0de972525d649971e
MD5 199f313ea9bcbf0cc7a1da7a4344a1dd
SHA1 06a06b52b7bad903a80940c4f32faa5eab3a0ef5
SHA512 b2710611fabc18eae4da4d6649f4ac582592aeb4a726b940151f587010f5beefecbe3aef609f8ef2226175f42bf283c1aaab58700b33e737feba966144e0d070
SSDEEP 12288:HDOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:Hi4Y24NiszT2H3o3XQ97
TLSH
T1EC55232D72005B52F1290BB009CC878AF40D7945F994B7DE46DA7E6DE27C6A8CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 adf4414924392ddc343c3aa4c5e69f40765fecb9c5a6fe24302c88fa879304e0
MD5 d9c8cbd31d5339a6faf37c8e341c755f
SHA1 11e1f17ac1e63ae7f52df3bec5fc4970cf122d8c
SHA512 0a2309f0afa3f1fa1e5efc75dc6606d5ce454947ec0c3da22e9b1aa0540ecc162af7a3d25a43ffe427562fcb14f4c0cdc24ff076f3c5a695580d5967cd3ce86c
SSDEEP 12288:KvOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:Km4Y24NiszT2H3o3XQ97
TLSH
T1A455232D72005B52F1290BB009CC878EF40D7A45F994B7DE46DA7E6DA27C6A4CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 315699b77ec9e6bb4fb218f332718d021dab2cb9ebc23eb634f60e5a5889387a
MD5 792037aaf7d72ba0d10767d6d8034263
SHA1 0af265c121861a99f396b0e37378996157a0091d
SHA512 5478022974874a068c08b0716b783bc4da218e5530bf6e82ea0a9317db26eefaf487a3388d16259b886995f4eab638370154dd33ca86bdf86d1f14352b50e982
SSDEEP 12288:JyPz5L8OOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:ozyL4Y24NiszT2H3o3XQ97
TLSH
T1CF65021B739131F5E136823488D54A46F376B8315B609BEF07A4177A6F366E08E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 745c8375c37625bae85be4240a743b070ec14ddcb7e48a21d17d95b9bd8e0d19
MD5 35d81bf332dffbb06f25217d36f0b917
SHA1 b06fb2f4290989e826efab684711dfa448722865
SHA512 e141922e2729a0656b907c4b8752b55598b887b5b501800daf4e05159cd93d19487c26cf83c9d16901042d567399716658494822a5ea6e86eb77bbbd5eb76385
SSDEEP 12288:VDOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:Vi4Y24NiszT2H3o3XQ97
TLSH
T19D55232D72005B52F2290BB009CC878AF40D7945F994B7DE45DA7E6DE27C6A8CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f747c5451447bc4699f905aff822fe57f9b6a92ddc02c74ae12bd0776a1bfae2
MD5 7561da22aaea9c863e45a8f7caf23281
SHA1 16e9758072fc23653252994fd1b41341a950b531
SHA512 2fd4ca7925ba245dd1d57733e61c584274a8e6ffa0d11f2a4316b8b6499f36cff3a04fc3c06d6c90b24d153049c86877b53c16554e57f7e8e8168dd53f96faff
SSDEEP 12288:jDOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:ji4Y24NiszT2H3o3XQ97
TLSH
T1F255232D72005B52F2290BB009CC878EF40D7945F994B7DE45DA7E6DA27C6A8CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a6ebd58a5120ce2da984ae6e26f02c5cfa8835dc50f0318b85c2c85d54107324
MD5 74a5fefdc8f19c54d9463626c4eb40b8
SHA1 f7c00f78c0a4c20650c85ba0c8fe6eae6bc357c4
SHA512 3bd5712a4750f8f5cfdfdef2437cefe446f0da700733a6faf672a06834aeb04bb3fb5ec385249af047f97af14df0c0d7002269bdc6a0d5b0b4ad3bb264b347ae
SSDEEP 12288:RyPz5L8OOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:AzyL4Y24NiszT2H3o3XQ97
TLSH
T11065021B739131F5E136823488D54A46F376B8315B609BEF07A4177A6F366E08E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 4b12267167f3c67406d18a042d41fc1d553b321a98575f0336519f7d57476342
MD5 a1b5550fc4abab56adce3e2dfb22f076
SHA1 64cb545f28ecd6f5af7edbb59f1ba6cbc849aa56
SHA512 30b088d0cc0b83afeb60173659ef28e2924442184716ac20c9965984f636123d3e04253deb556408c2a4b2c9008da5856b95950ee1b58332d4bc615201f90131
SSDEEP 12288:LCd9NWYoaLHF3z0z04PDvh0OsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:mT0aLl3z0zDt4Y24NiszT2H3o3XQ97
TLSH
T1437501A5B35018F4EC27823EC9558906D2B27C5A5B60C75F03E8366A5F373A04D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ca13f304ae828092d5720dd8950b0bd77309a5078903462abc1bea9787234ee9
MD5 b37b370456c1fa4c5988103ffa377bde
SHA1 6bdee370f38d8b8fc9c7b714a7de7feab18d7ef9
SHA512 e1f39b0a593e18cd06a298feeb68ad9f850ad55b500dcd3094c7ded151f1182c8ba29551ee3f56b07972358477c35945e69e4b27351d214ee3dab8d8404ebc67
SSDEEP 12288:qi4e7sRdTfgwCHKy7GLbbdIvVOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:q31d9CHKy7GZp4Y24NiszT2H3o3XQ97
TLSH
T1C985CF90F3E414E4F0B78A3589768512DA767C5A5B31DA8F03A8265A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 25b1957e871a9609f648caa72fbaf12006af693d3a5105c411f82b5f5645a606
MD5 f96a5993a84431bfa813212736c33a95
SHA1 4d94fc8fbd7f502ad375d8762ecc5d78bc8bae00
SHA512 3bdf072d1c38817278bda9898bc0df8873cb9adb3465e7b0b30b62948e59962dca785363758b1d8d78a98959e6be6e16a7b2324cd0b045ae2a722e272b72edb2
SSDEEP 12288:mkOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:m94Y24NiszT2H3o3XQ97
TLSH
T1DC55232D72009B52F1290BB009CC87CAF40D7945FD94B7DE46DA7D69A27C6A8CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d1d4f6b5b2474a0b37bf2a96e4548f173e96b54a5db8c73ddabe33d19acf3b08
MD5 cd1ee6872db3a2727990efe83220b378
SHA1 5bc7eb236e0482167a6c01d8613400cf14a981bc
SHA512 358cf3ef81727d91c9264e63a27ec7c9f42940da5fccf8b7efeed7d47f551e15462e64cdc1875b6f197e33a8b5cd4b7e2f8cbf65fc0667642863ca850b622433
SSDEEP 12288:1uOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:1r4Y24NiszT2H3o3XQ97
TLSH
T19B55232D72009B62F1290BB009CC878AF50D7A45FD94B7DE06DA7D69927C6A4CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d8513b3c54093fc0ea82f359f0e3fc515193043ba61c6dc8a5a25f86500c517a
MD5 406d0d28ac67221f97673a771f17f40c
SHA1 e14bdeea080d68468747e76dae873f70791d677b
SHA512 8f46f728d6c6c2b347f9d19f6621c5211f4c70f31230a1b5632a89a12179ac5f6eba2fbe4fc7c3c8e1ed59c689255e11dce68cdf7a7f9181b1b0744cfb09cb16
SSDEEP 12288:JssfzOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:hy4Y24NiszT2H3o3XQ97
TLSH
T1ED65F11AE24402E4D02E5274CB858A45F3277C25A7E1E3CB52D0F97E1F796908DFAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpsupdate_2026_05_26.log

Path C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\update\wpsupdate_2026_05_26.log
Size 7KB
SHA256 3058da909e7c0b6871461d50c3e2787708d08caa88bdc7c8d6400d2f4f8bb4b4
MD5 98b3ab004bf054e78031b3371c6cf594
SHA1 ed8ea0a2ba1745785b553ca50b8feb6c430961be
SHA512 b85d3c6142b1f6f26ba04099848dbe31bbf7848418a42e30d07d16100e872b80b0b53839821af1b74c2540902a6df590d023225264ef97eb237d8f5faefcf931
SSDEEP 96:7ZvKYu9eMC+rubn2WoS+rubn2JQ+CquDK:1vpYm2Fa2OnG
TLSH
T15CE1145F3EE8054AB6B3EE0A85F25413FABB3A57BC34DE0D01D6034E4965600F971B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 497063d5f493e9c70574ad0b3213e24c6e1963eceb98c6deeb28feecde0864d5
MD5 1c75ae15d61768039e78d9a30d090b32
SHA1 6e99068c865223e722b04bb77ee38a8c54977f1f
SHA512 8dc54f0b0e1642ecc4e0af37c934ede4bc01defd27213b40eef5e44325a4151135e22d56efcbcdd536f48f11f7d0b052bea3556d02c6fff485eb27d7b8ccecd5
SSDEEP 12288:nkOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:n94Y24NiszT2H3o3XQ97
TLSH
T13455232963049B12F13A0BB009DDC36AB10EB954BF54B7DB55CA3A9DA1386E4CD31F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a6cbe8e3e0ce26f516200dca84d6df8b369d36618636b84d7e843b14d2789c04
MD5 913437f96323fc8fc76e0add4b8bf65e
SHA1 6a8fb0d4d6ec80fa3b3d16ed5217052db13ed128
SHA512 7dbd7c04b0ff744274b5525cae10f5fe1b8f9156c84d7cf86cfb557eec3944710af023b316a2f7f7d656749695773673716e22cbb9e3bae8c981882dcc1cb43a
SSDEEP 24576:98RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC74Y24NiszT2H3o3XQ97:CRZwQCyiHiQEaiPnMqJxNiyT2X0XQ9
TLSH
T1F485AF1E62DC46A5E0BAD278CDA74407E6B278165731A7CF0191C27D1F27EF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 700KB
SHA256 4f6f84d7572465c6280bb56170e45664319da07895bf7ec8a20ac9b545d8dd42
MD5 229bb678891849ca56720fa18c3da3c1
SHA1 2f4fb77a0dbf2bf9f71f8a455a027b844f37fb65
SHA512 ee366406b854f700ec9c122d224da8c8d65cbebab9b5ad0753123ab45b0536a8816aa37418dbaee5f55fece9ca8eff2e9aa388dd3c251c3b5d6d9e7585bbc353
SSDEEP 12288:S9xA1U7K52HqlfI1M8jGzys7/+pukbsL8EzQru0+/56TVLGAdTbqImgJMBE:S9xA1UG552vjGzyo+pu/vQrI2V9PMgJW
TLSH
T1EBE4125F62AD24E4F2A6B23D88A24006C731B826172187DF14E5837E5F37FE4AC35E55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.8MB
SHA256 87b328e8d042c85f082a95593661784b08f6afbc4a6b52d6963ba6dbaa5ff657
MD5 464d7d1060afa24c0046bf2764e0cb60
SHA1 6c866ddd94ef745d3b5a7294acf72a3dcb22df7b
SHA512 45ca1e26f34a45035dfdd3450ecdfbc43ae3839e321efea45f82141e597eba84f438810953f086b9688e8f86e673a629314f677bbc6890ba85ae9809eb720315
SSDEEP 49152:7mRPz4HfVqzlA+rnWMvjGqoQM23HW6JxNiyT2X0XQ9:7gqOeWHFNjTm
TLSH
T11685D02EF2B910B9D4AAD236454107B5EB71B42D1F209BC701B0C634AF1AEE89E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 b67c0bc80edad648578d5feb781fa673a4092c3a0566a3784712c0e0cd1a37da
MD5 ea3fc7abd2a71832aacd8a14a811d802
SHA1 419310763c7b7a643c46411b40f57b88890cfaef
SHA512 25d1e1fb7a97a18c6662dfffea462d09a9789879d2784e8e3a896797e4bf0c0ec20ed7b172edca45441135a7297f54c72538b310721218754c3da83ef10dae98
SSDEEP 12288:F2OsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:Fj4Y24NiszT2H3o3XQ97
TLSH
T1A055236D62009B51F13A4BB009CC879AF10D7A04BB5577DB04DA7EA9927C6E8CD31FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 ba599ec3e262fe0c5a40432109600a983450212ab503709753b125935c6187d1
MD5 c91f8853d1c9600cc92564ca445930a2
SHA1 2b356c3752be5f34e7cb74bdb472352ee8351a35
SHA512 c4e9f8554e2de2c75a2f17f8881043440406f98fe67488a0990095e69562e72b5d7bad2602ab48d09e408145fa32dfc68af91ab1fb0593553a00eb42bc8d2afe
SSDEEP 12288:sOb4A4LWO+vAYFTwOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:RwLBUTB4Y24NiszT2H3o3XQ97
TLSH
T1E375F155F79400F5E93B823CC9A68A16E272745D1764E7DF03A84B691F237E18E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7f54febdc4be8d022300d3648998a9afbff47068bf2aa83631b076457803899b
MD5 6b9de5a543a1d5d260d38a44166dcc1c
SHA1 18c788db88975e4d45dc34a450fbdd9a969dce99
SHA512 5b54d808065715405271d6e4047051e7fb80466618657e257803403c3be0bf357f17fe0934a97e0695cadb19b0bc54a99dd8eebcb939a9fdabdc196b0846cd9d
SSDEEP 12288:a70VmuIYNvUyBpnOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:rKYNHY4Y24NiszT2H3o3XQ97
TLSH
T1AF65F12F625C1DE1E53B91798AC28209F27378561711A3CF05F0827E1F27EE8AD3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 66e5b2a6505571a2eba738bd9ffb89e1534231fcc44da2ab9aa86355d11b0f5f
MD5 3117de386602024ffc986cc4b8129444
SHA1 6c55c7507745aa2bb9e2a0c3f5e05674c4ba2506
SHA512 c27bc84ad56ec4f09bbc33d22b64d2a228fe2b7e5588dfaa4e175cedc2b6699540982ed44d966ac68a6845efa62998f293ff5279cbe78e58b0e52e5cda8df24e
SSDEEP 24576:onXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKi:onXoJJYH84VVS6AmEcJas+cHBjSSKHPS
TLSH
T12D65BF6EA2BC04E8D5BBD17DC5C24506F5B278611331C6CF026182BA7F27AF59E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 00a20f890b17ce55252f813aedf8e229bac818ee5bfba511261ddc306125bc82
MD5 03f92ae1ddb967c36b779ccd5878b9f2
SHA1 0f7cfee8475284b53a152db5d760f53dce8837ea
SHA512 65850575731275f5a487113985c10e8c1bb23a80a320ff67f37e6a10e89e458f6b68bf43ceaa05c667d38a6f81518d65140f7e02bf62d7f9491c70bc40fde7a3
SSDEEP 24576:qv7Xbxd9Tuycf8M/TYlSuxrr2PCW4Y24NiszT2H3o3XQ97:qDLL9TuJ0M/TYj2PDJxNiyT2X0XQ9
TLSH
T1D0858D5EA3EC42D4E07BD6BD85A79146FAB2B855273081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 7a92ea6f4e17da17afdda0d64d2181f2f90f2b16a681da4179042002c06a68fe
MD5 74d90e9efe06e724467090c7d377d4f9
SHA1 7d9b85a51455f7402070aa51242feb53eb98f408
SHA512 bab16c3db27a06f759ab88390a321ecdc044b4b2bdf403cf6db7d1ec54608c15dba6980a19caee15f5714b884b1bc9291dcce6a70e96d1b1b0d2293695bea949
SSDEEP 24576:gegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wB4Y24NiszT2H3o3XQ97:gngOJOmPOHhBJxNiyT2X0XQ9
TLSH
T1AE55CF3FB7BC15D5E03EC17D8A968906F6B1782613255ACF01A0827E5F2BEE45E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 2ff62556be5ff0d6120dce3eb6d45d02b759c4928a6766a750431570c97b4f77
MD5 8da32b54d62a78da9137cdb7c4645011
SHA1 3c1cdfeb59979e71623c952a5e570b3fee00d6f1
SHA512 cefe02bc99836e6609361fe823f2c63f496b06940dc5bbbaa2cf30aa4b4d02c859499547c20816fcc855d0fa553024c50ed221f9f493ad29e0334b191413ac46
SSDEEP 24576:JLJnJiTk3R3waE4JrOD4Y24NiszT2H3o3XQ97:JLJnJK8R304lUJxNiyT2X0XQ9
TLSH
T1EF75D03DD2A810E4E077C2B4819A5B56FF31346C3B256ACB19B4D5353B22FE09A39F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e792cc6851f4a0a19ebe9618bb9e1d47ba0a6a4774476088bd5a91624089d600
MD5 105280e6839711b4a55cedfbce6be734
SHA1 45e301406a2cc3bd9025879bb2cc0e9f3c3cbaf2
SHA512 a86423e0251d2aa80cddc60bbd3a6c7670692242a06cfc93dd40388d8c47e1908f68c88d65977368a70abb9deb36e55fc1b1cec32f3970ff04274b4b824a79c1
SSDEEP 49152:M9mqCzDScAZmlvTcFg8Ph6vJxNiyT2X0XQ9:ucNjTm
TLSH
T15B955D05F7EB5294E8B3CAF1C96694159B327C409B34F7EF0A80CA6A1E32BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 700KB
SHA256 7ea1c1c967cfec2d1f32801a85b73efdc74aa3167d6221d78cd500af90ea0444
MD5 f699ab2b309d78ebd5f5168d526004fa
SHA1 d87f4f75683b31cd9a7127930147ad3e15dd02ce
SHA512 e26d962d49beea4fd64cd1dfb1a1263e705acb5586eed60beeeb04572434d1b9d898967fbb8285f161c3bbd0825a07df2c307bae37e4c3963e8cac18b54bf4d6
SSDEEP 12288:ElYJeXmEgkuOuEA2HqlfI1M8jGzys7/+pukbsL8EzQru0+/56TVLGAdTbqImgJMW:ElYJeXmEeOuEA52vjGzyo+pu/vQrI2VE
TLSH
T1E7E4128E766D30E4E25EA23994A20505C331F0B527525BEF09F0C27ADF56FE66D38E48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 6ddbb081b2cb1bad7ffcff448c9dba5080300108290d45b6de3b4be379566434
MD5 85da525f8fbbc4fcbb64f3086e27d584
SHA1 6d04bf9eba00ff1a3308bf3b22e765afa18be6a4
SHA512 5cbd7afe4077662f639fdafb1037f847183c9e3ce2f060af46bbeacc637d44edd4d867616371ba4c4ece4147250375b3850337c6552c3fb76bcdb10b390f0f6c
SSDEEP 12288:d9u6kyFOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:dstyo4Y24NiszT2H3o3XQ97
TLSH
T19A65121923806690F1390B749AE68295EA39BC20AF10A7DF45D1FB3F6A397D4CD30F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 8b3346f56b5de961efc5c4e659ab1bbe70a75824d637fc5e5bf6a162dbfc91fc
MD5 8c381ccbf4cd39a49326567984c4d478
SHA1 803bd9969a56debd2f3ca6c16d73e98dfc2c5e69
SHA512 09cfdf750a747574c8b7cc576ab28bd29700032e1703bff2694e06980d8dfab2d5689b93aa0c6a0285a2a1acac99c06dcf869bab0dba9da98ddac00a02cd0672
SSDEEP 12288:ZPwOsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:dB4Y24NiszT2H3o3XQ97
TLSH
T17955232D23006A51F1264BB009D9878AF11D7A24BB5077FF04E5BAB9D67C6E4CD31EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3a5fc59062c151315b29240fd980de30ca11614d2cc764c6d3907b4f506a41d3
MD5 f9337d146085301a5663b1d1fb601d15
SHA1 d60771f7fe6dfc246b39188f4c13bc9c99afb84e
SHA512 4dfc9e4408de82bb437da4b36f0473e9683f2dc222f230090f825c140e66397fe4a32be0419c9c852458287d1a3683343aa549c719959acf4ab11946f630f55b
SSDEEP 24576:5C+TyQIu93VAumZr7jmS4Y24NiszT2H3o3XQ97:5/TfIq+YSJxNiyT2X0XQ9
TLSH
T133558D1DA7E91DCAE276C675C8A34493E633B472137196CF2084C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 4f7e4eb48f5847be5e1bcdd2157c977cb99140d6417b8dcd191de92d99ec967a
MD5 5874f20b78d3a60e5b9085b2927b0cf4
SHA1 064dff526b504db73367f81279429d297c6e471d
SHA512 2301e564e332310c89b9e961a87c805100694b5dc0c805700b9407fc04dd28e242f022e54c9b8ddf2e308768267d08f7db72e79bc4c791e8bff87b137489d396
SSDEEP 12288:McyrWOstaa3kcs8OsL7MXmfABHztj2IBiszk4XDLxZUHH3o1RXQ97:pLQikZl4Y24NiszT2H3o3XQ97
TLSH
T1F765F10FB36A10A1E067827C88854256F6737474671267DF02E0CB7D4BBB6E9AD38F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3973ec3c1a0074c57b767ca4f702f3157aaa762fb666a0c01977de746b19b65c
MD5 7bdb285676c663d33398ad94600146ba
SHA1 05eab9e37a142aa343692a738eff5cf18ff5f68d
SHA512 fa3b133af66dd0ad225ea5a600dbba6c44d35eb4eb2b17cc40068781037dc642068738af4346bd4966f8133f876a22a8d61d4fe49f7fe0f74ab6a6953051f9a6
SSDEEP 49152:BpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPkJxNiyT2Xr:SpC7b4+80GTkDNjTm
TLSH
T151A57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.9MB
SHA256 a0c89932c690e6522abecc5f838ed78086c34693f8a54f8e1d426046e3f0dcaf
MD5 adb5705baf7c0cb4cf43cbaf1bc30790
SHA1 2ce2052869ab14be705676bdc196fd6fb8b9cd5b
SHA512 3d7ccfebf58aa5ee8a52556d7ccb3589f5b8133548a7749c0b5aa5ece083f4117ab1e5870db92ed348f53381b24f5f946193fd937b7c28fa6c192eb34782575a
SSDEEP 49152:Ko6CIo4Kol4dQ9MvjGqoQM23HW6JxNiyT2X0XQ9:CTKwOeWHFNjTm
TLSH
T17495D11AB7F956E4E17ACB74D663C611FB727822133167CF4290853E0E26AE89E35F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa8aa5f0ccebd5c8.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\aa8aa5f0ccebd5c8.bin
Size 12KB
SHA256 fda122080194ba637b114636c7071c1ce8d4d704616dd6ca8727d9afaafa85e0
MD5 f04bd09ea5e1bf3d0d9076ee90ee6f5d
SHA1 d3bea1d355b199f32857e672389808831f9c93f7
SHA512 476d0b2b1aff8506bbe9e481d9a68ab161d47da0bf8067becd8d1d8d406eb812657bba5e3c2ae3e2dc4e82a7d8a4b040aeecb0b71f2a01014e49aaf8d121ab07
SSDEEP 192:k11WMTKt/szmCagX/LJaQMYg/SMJRpSmVH+rUd1OogNE26/bDOYN7yWirz3khft7:M1WMWt/QMQ+SMc+pLRgiUeyWOrkhf1H
TLSH
T11E42D0AC1076348539210EBC1402CB43E2D79D084EE28A27D1D577AF0CA9DDA593173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 2.0MB
SHA256 d4a0c874b69fe0b925b84c7b0d6552d5ba56e4a65e7ea81ccf343289bd94a71c
MD5 eae6ea247baf5f4cfc46b08f0ff67037
SHA1 3bb915079350d80a42ef679b42528e1c457929d5
SHA512 ec6083fa6f3007a0eb18a71fe6340eed0e675f3484d5deb10808797b030e8cf77e2f2b160255a58fcafa666df38103d0c8c047d507591211790e76b2b1fc20e2
SSDEEP 24576:2Wv8qjpx4Y24NiszT2H3o3XQ97B52vjGzyo+pu/vQrI2V9PMgJMB:2Wv8YJxNiyT2X0XQ9dMvjGqoQM23HW
TLSH
T176A5234E625429D0F12907309465816AC135BC753761AFEF28E9EA7ECB74BD4CC3AF28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-78-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/124-72-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/124-257-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/124-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1104-1-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/1104-50-0x0000000003300000-0x0000000003360000-memory.dmp

Download

memory/1104-61-0x0000000140000000-0x00000001408D5000-memory.dmp

Download

memory/1104-158-0x0000000002F50000-0x0000000002FB0000-memory.dmp

Download

memory/1104-154-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/1104-7-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/1104-49-0x0000000002F50000-0x0000000002FB0000-memory.dmp

Download

memory/1104-41-0x0000000003300000-0x0000000003360000-memory.dmp

Download

memory/1104-33-0x0000000002F50000-0x0000000002FB0000-memory.dmp

Download

memory/1104-156-0x0000000003300000-0x0000000003360000-memory.dmp

Download

memory/1104-0-0x0000000000630000-0x00000000006FA000-memory.dmp

Download

memory/1104-172-0x0000000140000000-0x00000001408D5000-memory.dmp

Download

memory/1104-9-0x0000000140000000-0x00000001408D5000-memory.dmp

Download

memory/1688-229-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1688-395-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1688-231-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1688-223-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2140-553-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2140-551-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2140-351-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2140-211-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2140-219-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2140-217-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2208-70-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/2208-88-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/2208-90-0x0000000001580000-0x00000000015E6000-memory.dmp

Download

memory/2208-82-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/2208-191-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/2208-96-0x0000000001580000-0x00000000015E6000-memory.dmp

Download

memory/2208-190-0x0000000001580000-0x00000000015E6000-memory.dmp

Download

memory/2208-195-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/2268-550-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2268-301-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2268-307-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2268-312-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2596-333-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2596-557-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/2596-336-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/2596-327-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2680-240-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2680-243-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2680-234-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2680-499-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2944-254-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2944-248-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2944-258-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2944-500-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3020-196-0x00007FF795B70000-0x00007FF795C56000-memory.dmp

Download

memory/3020-28-0x0000020B05C80000-0x0000020B05CE6000-memory.dmp

Download

memory/3020-29-0x0000020B05C80000-0x0000020B05CE6000-memory.dmp

Download

memory/3020-27-0x00007FF795B70000-0x00007FF795C56000-memory.dmp

Download

memory/3232-108-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3232-268-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3232-117-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3232-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3516-929-0x0000000140000000-0x00000001405D6000-memory.dmp

Download

memory/3516-934-0x0000000140000000-0x00000001405D6000-memory.dmp

Download

memory/3516-879-0x0000000140000000-0x00000001405D6000-memory.dmp

Download

memory/3588-908-0x0000000140000000-0x000000014059A000-memory.dmp

Download

memory/3588-900-0x0000000140000000-0x000000014059A000-memory.dmp

Download

memory/3944-335-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3944-200-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3944-206-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3944-208-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3960-260-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3960-280-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/3960-266-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4440-19-0x000001E147820000-0x000001E147886000-memory.dmp

Download

memory/4440-152-0x00007FF7B25C0000-0x00007FF7B26A6000-memory.dmp

Download

memory/4440-17-0x000001E147820000-0x000001E147886000-memory.dmp

Download

memory/4440-16-0x00007FF7B25C0000-0x00007FF7B26A6000-memory.dmp

Download

memory/4564-393-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4564-361-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4564-354-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4564-566-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4564-340-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4564-377-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4564-346-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4772-294-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4772-295-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4772-286-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4772-549-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4912-129-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4912-123-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4912-122-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/4912-281-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/5420-321-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5420-325-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5420-554-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5420-315-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5556-182-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5556-174-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5556-180-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5556-311-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5584-925-0x0000000140000000-0x00000001404FB000-memory.dmp

Download

memory/5584-935-0x0000000140000000-0x00000001404FB000-memory.dmp

Download

memory/5588-278-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5588-297-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5588-272-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5588-282-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5588-292-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5840-160-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5840-153-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5840-283-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5840-167-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5860-197-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5860-324-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5992-679-0x0000023BC3120000-0x0000023BC3130000-memory.dmp

Download

memory/5992-680-0x0000023BC3120000-0x0000023BC3130000-memory.dmp

Download

memory/5992-676-0x0000023BC3120000-0x0000023BC3130000-memory.dmp

Download

memory/5992-677-0x0000023BC3120000-0x0000023BC3130000-memory.dmp

Download

memory/5992-678-0x0000023BC3120000-0x0000023BC3130000-memory.dmp

Download

memory/5992-675-0x0000023BC3120000-0x0000023BC3130000-memory.dmp

Download

memory/5992-674-0x0000023BC3120000-0x0000023BC3130000-memory.dmp

Download

memory/5992-673-0x0000023BC3120000-0x0000023BC3130000-memory.dmp

Download