9bab430625a76da74b43ce7e39bcf95192b21d0d5ae99dcb872816cb413e38ff

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 3.3MB
Sample260527-jqyr9aa191
SHA256 9bab430625a76da74b43ce7e39bcf95192b21d0d5ae99dcb872816cb413e38ff
MD5 396e11d2ede490bd197f07ec94578457
SHA1 b4058068b42895d6d1657dd173c813174851ee97
SHA512 529492947613218e94d8bc6067fb4c8fc1254e3787cdc270b7faefea2d64f47cd0c72959e84efe11eb5c2c536c1c24dbacfb3e672a0487bb05edcc82c857b8c6
SSDEEP 49152:E6mAnm6OqSFPvMD3uHEnaKC0nmnM4atqZdd1v+0KrbEDYf5zaCpXxPuR6E9dA:zHngVvMqHEM0nmnM4aqTPKrbKoDw/z
TLSH
T1E2F5BF50B3BB44DDE172C53495029B2AC6B1B7426233822F7015AE58EF777831E2DF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3040	alg.exe
644	DiagnosticsHub.StandardCollector.Service.exe
1960	fxssvc.exe
4400	elevation_service.exe
4108	elevation_service.exe
4412	maintenanceservice.exe
4984	msdtc.exe
1160	OSE.EXE
4888	PerceptionSimulationService.exe
4588	perfhost.exe
2548	locator.exe
1048	SensorDataService.exe
3704	snmptrap.exe
3348	spectrum.exe
3388	ssh-agent.exe
2056	TieringEngineService.exe
900	AgentService.exe
760	vds.exe
2264	vssvc.exe
2380	wbengine.exe
2468	WmiApSrv.exe
2188	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dfedcc8ea19fe9b3.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056b483e2adeddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082c4d4e2adeddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000944130e2adeddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df35dcdfadeddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d59f8fe2adeddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020ef7ee2adeddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
644	DiagnosticsHub.StandardCollector.Service.exe
644	DiagnosticsHub.StandardCollector.Service.exe
644	DiagnosticsHub.StandardCollector.Service.exe
644	DiagnosticsHub.StandardCollector.Service.exe
644	DiagnosticsHub.StandardCollector.Service.exe
644	DiagnosticsHub.StandardCollector.Service.exe
644	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1764	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
Token: SeAuditPrivilege	1960	fxssvc.exe
Token: SeRestorePrivilege	2056	TieringEngineService.exe
Token: SeManageVolumePrivilege	2056	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	900	AgentService.exe
Token: SeBackupPrivilege	2264	vssvc.exe
Token: SeRestorePrivilege	2264	vssvc.exe
Token: SeAuditPrivilege	2264	vssvc.exe
Token: SeBackupPrivilege	2380	wbengine.exe
Token: SeRestorePrivilege	2380	wbengine.exe
Token: SeSecurityPrivilege	2380	wbengine.exe
Token: 33	2188	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeDebugPrivilege	3040	alg.exe
Token: SeDebugPrivilege	3040	alg.exe
Token: SeDebugPrivilege	3040	alg.exe
Token: SeDebugPrivilege	644	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1764	2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 4672	2188	SearchIndexer.exe	111
PID 2188 wrote to memory of 824	2188	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_396e11d2ede490bd197f07ec94578457_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1764

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2336

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4108

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4412

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4984

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1160

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4588

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1048

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3704

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3348

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4780

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4672
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 669f85d5a2708e1d1653cac3b8f2518f4d290ba451d16d8685bd523811a28d1b
MD5 4e4939458b5f614a6a710dcc7edcb909
SHA1 43b0fa5c868523217315b4f58712c88bcdd49ffa
SHA512 ee0da4c459a2c2f5dc3ac767d682fd906582463a537e4ee9557996f173a34853d0083186ef49bbd9c7b5f3c28af929f006d29f35f93c1d559c3d819076b45f39
SSDEEP 49152:nb+632BuPkFKRrdE6ohQstBhuXjfS4LWxn8DYf5zaCpXxPuR6E9dA:V3q6tjBfoDw/z
TLSH
T142D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a62abc7593ef339ab439d797764617ce08a993e14dbd4efb59a35dc484486dd3
MD5 970e2bdd1d6409624e4d8f5c11f06fe3
SHA1 a648a5570d31541eaab69c1a9c113fb530bac3e7
SHA512 0c3f5b86f9e3bb4ccb0e452012e87c72e1dbedd431f63f74bc8310bc3e517a8f8bc99eea2319c918b8c8e79557ce2d262cf9f1e320a5054239c12b1494c33998
SSDEEP 24576:gXYfDtczAk0Djsf9nz4mloFQnpXUMPQDR6q79dA:Xtc6DYf5zaCpXxPuR6E9dA
TLSH
T18A05F129AB9404F9EC77423CC8A2C111E672BC5147A0F79B03E499665F337C95E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c5602f568aa73526232d9f5ccc06044d7aadb1af45d19c64f571169e6170b3c0
MD5 7e1ba6392d12f9e905d4f5601d56faf9
SHA1 82b0da777c1ab02563c90eaeefcd56401396b7fe
SHA512 fde7c5e424aa84dd560409f0aa89c1ae548e6da01b0e1693a801344c9bfe6aea437a566ca85c318500dea2d6ed6768b8f4acccc38747a19c35266ff41aff096e
SSDEEP 24576:f0Le5ji0hmxnrMX0Djsf9nz4mloFQnpXUMPQDR6q79dA:fPji0AxRDYf5zaCpXxPuR6E9dA
TLSH
T12335AE16F6748335D073C0B9C5D2A69EEA7130825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2a2c435eb9bb0cf22084a2ab1efde52f057e0aaf3d8eef97bd65869e0677334e
MD5 7edc7868eb5d607f38fbea07f536d386
SHA1 3dab7d0f5fded29195eec15e48280062faff9d33
SHA512 efd216a7d763cc4841216ee03315352f978cbdcfdb3df4987ea441de1639713a4768410f02382d137ab62665db40f50b0df4a239a2e1cf30716872290a15cb3f
SSDEEP 24576:Ka7/ezSC6vUyDZaqgrvWx6q8wyu10Djsf9nz4mloFQnpXUMPQDR6q79dA:9/ezSC6vURPvMHjydDYf5zaCpXxPuR67
TLSH
T1D6756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4a82c3c0092236e6e098027fb2ab2e1fbce966ef9dda8700b5d45c025edd61c0
MD5 0aac8c7ed1d6e96a0f80b42e15c83377
SHA1 557fbf83b430c3152685d3d45ffb41d5358aaa6e
SHA512 92d4e47846de410a0d249992f0b2ee9d6d2f2b08366e7240dfa52e61dc97b7bb5122d8646fc08febaac2ad76474842d2c2f9efaf44621954b1deaeb4b3f84f4f
SSDEEP 24576:aVbqPb88hv/lV7Y0Djsf9nz4mloFQnpXUMPQDR6q79dA:aVO88hXlV/DYf5zaCpXxPuR6E9dA
TLSH
T19E55AE66F6748331D073C0BAC4D2AA9AEE7234425B318ACB1246D76C3E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b4f62f3dbbd55988f5a2eacf757a78e2640eabac4c18e6a81f93e56d9e884636
MD5 bba5b6be96543b7583eea2525ca8f27b
SHA1 8a234f3006ad9ef2be1d5beae4e901d2763c3714
SHA512 be5da1e61d0fd1c9011a7633b57763316c910dd8c51111387526fdecf47477db6c32cb19697a1f20a46f3aa9a5418f7231868a411c475d89daf4e61f1bb4c271
SSDEEP 12288:sG7OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjLq:sG70Djsf9nz4mloFQnpXUMPQDR6q79d
TLSH
T15FC4238ACF0850F6D4722F3C28B1E225D3D4BE207DD53E6A77A1EA8A8C7474BC465587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 d9b6eca607f575b5a334234ec09ca5844b95b35b670dbc4a4f995c827780ea16
MD5 4621ef09ba2e5ffdcc58caabb4c84ed8
SHA1 dff2d573d172c8d7493564976764c1964994830f
SHA512 dbdce2a31780953092a060d2f65bafec686e10546e3d3ab6c9df00e9a73beaf4464d4d9735388342c12ca195b9ef97ef9e4a2591cf4220dedaee2f9efd2cf241
SSDEEP 24576:NJIUA0Djsf9nz4mloFQnpXUMPQDR6q79dA:NJIUDDYf5zaCpXxPuR6E9dA
TLSH
T14705BF7BEE28FCE2C27A5D785A91C200D7B278304F62A3CBE165820EDE236D55D79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c9582185a7ba90dddd820b65a7b6e154eb50a788481a621f95cd1afdf0e960c0
MD5 d989d176b4a2363fc81aa0b83174e296
SHA1 8c8b6f7ba8e3b667e15730bb3c4c6149857aa487
SHA512 e5266a706c3db4df4352d4cc84c6039d2d2f7717d564b1fadb5263a4de0b5a7a80c4565d439bd3bb55c8b9b081ec47cada097deb67235b1db40160f93480c89d
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THI:zQvGAdlCEL8c/pRNw5CkoDw/z
TLSH
T19C266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e99d928fb8c3e224091b7aed484fb2c6c5e515669fbb16f5dc1e11132208d1b5
MD5 9f4e794477fa2814ced7752b58f716f2
SHA1 8dfacde56dbb4a4354ebc1e8a1dcff8e60a31126
SHA512 ec7fef474adacacc9676bbabc577e851a8a02312057a21242715e7351a8202b03470912a7eba71456e7e282a1ede87fa5e956f7ad1ad9c3c2e6535e35117d12f
SSDEEP 24576:XwewsAj20Djsf9nz4mloFQnpXUMPQDR6q79dA:AljhDYf5zaCpXxPuR6E9dA
TLSH
T18A15E031FE74E036C27B0DB51B36D716546CB9204FA12AC3E3E89E9E59702C26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 da86531d6016dc7e68a5cbccf51fdd6a4d3bf324887e8bef25998b04cc3d734f
MD5 c54d099d5770abce4befc29ab7c7e553
SHA1 9954bb84a10f71a50c1aea89d5cf29e2d4c8b566
SHA512 90cff522a2eeb1a00627285fc3608c6faa92937a339cad18b004531223cf2c5dfd86396d60962707a305348c5d23bd54e1ccfda116e0a5f5df51b1389970c6f3
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHWA:8UEtQevvqc2W1cpV29I32W
TLSH
T1F9474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 444eb38dfc9390b6ad262d87ff5c977a8bbe8f948280eaeacc5478ee2f0cf759
MD5 b2db3d4ed14fb1b217c7cef453c305f0
SHA1 8df9e43378cabff6d825b838c5dbb5914fc0085a
SHA512 6bb62257b7e292ab7aa805483d67d32f1c849d43a57b9416b0db38a3e4cede5bde415260ff71abdd9c08999928331af44fa380ab1dcf83d72f8e157a880cf752
SSDEEP 49152:UCbRquA/m2yL5zifFiV+XenmE3/zBDYf5zaCpXxPuR6E9dA:9oqHVjnmooDw/z
TLSH
T1ACD58D0976B882E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 878f935cd4760d2d6683acc5585498e34e7e0872a3d3a038231fab275ad92c56
MD5 2f71c16d2f9a344194ab9ff08f32002b
SHA1 ffb6f43b966edaca4364f3e6bb81f2b9435f3a18
SHA512 459a344fcaec426dbcd80483e84dea95d7af07793bf80146debd3873d13473525cc704bf6816b493936321c111b372c6084c9fd7b3b3ab5c887e0c40c746bf89
SSDEEP 24576:nAhGLmIFoiwtA5l7S53B0Djsf9nz4mloFQnpXUMPQDR6q79dA:nAM1Foiq52DYf5zaCpXxPuR6E9dA
TLSH
T1B4359D81EBF951D4F5B3AA7899B69170EAB6BCA55E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ea9caf8716526b8be8312e48ebf2e36db88427546f5aeefd4a40fe08cec57f70
MD5 057f71f62bbf981ce25807159c6467b2
SHA1 5e89a0d10ef96f1211bc7925509fc182f2a4f91e
SHA512 891cf7e3927baf352d91d0b7060594ca2c02e9548c4a9139a01a884f6f55713bb373bc39ef45355ddd35a871d6dfb3fbf0e2be9708a2e48269a18a0a4425c3f5
SSDEEP 24576:SwuXOWS0Djsf9nz4mloFQnpXUMPQDR6q79dA:SwQOyDYf5zaCpXxPuR6E9dA
TLSH
T1D405F14A7B9418F9E87356388597C136F7F2BC112A21DB2F17A0C65B5F33352AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 bd3eeac8b5435a7754c25758e8d5bb5785d7178d5fefb5053b41f6b10cc7ff02
MD5 61fe1de28def67067d499519880826a2
SHA1 48808208b6e55c61efb7e32fb47de9726a35e49b
SHA512 b2095c000da3d53eb1ce715cbb9c2165090e0ff822cd268a2e22c087ac7c4efa4130731739f165ac89334aa4d736abd123955f05107851b9bbecef47b520db06
SSDEEP 12288:MbZ1IyGOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjOq:UZu/0Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T145E4128E6B9420F6E0731A3C98F19215D3B17C227B7227DF2660869A5F33BC65D39712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f7a4ab93dfef82ece1be639677f097ebb1b433cc92eef4dcb1a07c06f2877759
MD5 def0289c504fa23b39cdae0b9a3cbcaf
SHA1 7e99850c234e9b7f14109a3950b765b7f335e919
SHA512 c198835a1d5744143ba8a007f9243d8d7dd65c701fa28d1f7347a78fbd096e498b9d09406a605d1bfce5db6dccb10fff6dc5b50fd0991d746de0088f90538264
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UM:AQRQyi36YOcPuLvw2gAf+PN3boDw/z
TLSH
T126667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dd44e6a3b974e4127355f6cae3b4d499e43079f11e6ca4360ae7714d63bd0661
MD5 9ff0c013f9e2be05fbf27bc46e853015
SHA1 480606776559b5bfe41b1a08d8f4610c2e20282f
SHA512 0d81dfb159a16cf6909cc65db358ca7d2e562b1b688eeccaece8cec8c39477363beb4786d94b1483b40358792746b4fd73f492754feb8fb414e0646a69ba80d0
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UM:HQRQyi36YOcPuLvw2gAf+PN3boDw/z
TLSH
T10C667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a4303cdb5bf0a6e5e0e7b18cee3e48ad8541c07b8cbe22bb45326c5891c62923
MD5 002d85a668bba2ee819dc6039c2b1940
SHA1 2d7b08bca36305f9111d28828003450ca68c14b5
SHA512 40060fa65de9ef3f1a57d8ce492662899e5455ddb5a277280b2f5d03f842c428ed592a056b0a2b0e697cd4376997442f3ec3c5466c612ad2ce38f64872c2adb3
SSDEEP 49152:g68Qg55nhxeWu7PNU3/RDYf5zaCpXxPuR6E9dA:athGRc/BoDw/z
TLSH
T1C8B54933B2F600A9C45DE1769F4A873196D17C718FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a0065944ff605a60a2c0bddaea0f766d1005ebd4ea0cdaf0ab712a95a1c8bca6
MD5 ae7c5577040866f4c1b911d8b57dde8a
SHA1 78d1d3b4c59f4305241b51d238b022e0d27469e8
SHA512 63a29a1a239aa7355a98b832616c159ab0ff29e3382029bd5627a69aa7c818b77a0b8508e1c3b1e335d5286f02d330f60eaa327e19cf5f436d0d8dc0f00cdb4c
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:Iy5112gYy5azzVvD69nLKnhZWoDw/z
TLSH
T1A5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 69a5585e5a5395857a8ebd80c52499d04729333f4a80618ade1b2665149962d8
MD5 ba45cae5bb7e86abe3b1ff3e6a1151ff
SHA1 6791b7baf347dff288bfb5d0ae8495e88d01fb12
SHA512 93f6dfa6ea86fb1e2fc950e7d6aae63e4b46bec1acc1862d0a06182afe6a7445c06bbad807af10774ffaa74a0ad3b6447fdd89be9e83f9a2580cfc91e40e8196
SSDEEP 49152:YB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glXDYf5zaCpXxPuR6E9dA:yu6JmQxd2dzoDw/z
TLSH
T14ED59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a3082bbb753933ef11655367e10d8988a749e0927ba860b40533608df21921da
MD5 754f2988e94c963664a400b6202422e1
SHA1 496e659276c937ba0c8b378ddd17b0446b105d0a
SHA512 db46da580060f32d1c7e17aa84838fb7ba42c915ae609e0b408e019ee538f2031db5444c33008c70afce2a7d69926fe0dd294f1b6edfa2223a090306ea1e6087
SSDEEP 49152:P1hpsNoJpF1A6yU44CwH7R4xjDYf5zaCpXxPuR6E9dA:PmifPVRooDw/z
TLSH
T12CB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4752111ea8bdaa16adffd860d8e2d5e5ff00061b5c83ecad59d92fe2af147b04
MD5 6934e8070e6a5345f20d66aee4ccd432
SHA1 ae21a2a3afd98cc41ad0370fd5832db3368bc519
SHA512 9bdab964b0770b39ffcb7aee3a856727b00bdd024a49316a0f5b1514ffd8c6ef9fd5a9bf70f1567189d4c7c91c06ff0691ccd0cb104e927b8d98cc87ab04473e
SSDEEP 49152:1SuZQIY0Be2KIRVtOnks6NMHqMDYf5zaCpXxPuR6E9dA:b5dKOi61CoDw/z
TLSH
T12DC5BF03F2E941E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4257eb14513edde32d738a7d18d30c5148d2315b3dd24ed12930d0cb584499a0
MD5 852bea7025174654f44757f52c4b8ac5
SHA1 9a235ea58ab933853496314aace70f376d403f93
SHA512 44ff418cee06472c1401673d66040b3aedf8bedd81de05489385ca9627a20f0a8ecd35d9314dbb447f27ec0af00651f5d9ff1622146ff481817e80930d425dfc
SSDEEP 49152:DhtSn8EApI0figGgiDn0AP5wnDYf5zaCpXxPuR6E9dA:iX2i/phsoDw/z
TLSH
T15295BE13F2D900E8D06ED178C7568632EA62BC150B35BAEF0A90B7561E7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a6edc9fab3bb88f9708ed79f150dced416ddc3a17c21b2f27e2a1edf55f13be7
MD5 b180b402e61188364f63d24520109f90
SHA1 0c2041acecd5cadb753e6df777e26a8fd8bc85ae
SHA512 e2ab2a29e6971f222c719cc04ed65cde1908eebca17da1f4424f6c81e6d459c02dcbcd12d4cf9e1ae6fa48dcda5e56e9778742ff5681b61c7d1f83dcbde865c2
SSDEEP 12288:GDOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjnq:GD0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T137C4238EDF0951F6E0312F3C18B1A324D3D8BE21BED23A7A77A1914ACD7578B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2040bcbd927d184ed28bc4a718d57742b081be7edabfb73dcb804c307351308f
MD5 81d67db1397b3d31ed7d3829d48c03cb
SHA1 e87a5e451ddd50b52ddad51af3bb6fde9f96ebed
SHA512 e189dc00c9710cecfc2db344d96b94bfa34467c49a46d12738777c92ca5cf897cb9fc2d4da1393d3e3417939a2e0161d347e25ee040def2130d789dd0070159f
SSDEEP 12288:6qOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjnq:6q0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T157C4238EDF0951F6D0312F3C18A1E324D3D8BE21BE923ABA77A0D54ADD7578B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 707e0f0990f8d81226c2ac8f0af67deb69c794e4216d9c185a49352f58e5aca1
MD5 b22fb5c2de04bc275670481d97afc4c9
SHA1 f5f9f2af699850916bbe7cff429d21cc31526cd1
SHA512 d978d514f6d59a9bf0197ee041be06542ca15587a7bfab8725109934264fe23216cdc8f5e8811e3c20164d461d37c205e932805fb8cadf67f6af912e10b56499
SSDEEP 12288:eIOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjuq:eI0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1B3C4238EDF0951F6D0312F3C18A1A324D3D4BE21BED23ABAB7A1D54ADC7578B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ad5de477b0380306415e6993395379e258cd943fb206466d84af245c14ab2eef
MD5 7f38c277dfb290ed7a5cd19a510e0326
SHA1 22d8df4f24bcefb80d54e595942e8e7158000971
SHA512 12323e5e4040879aa9586986f4ae9e61557d126825f7a944c8b491ff99bb050b25cf46615904b443043dc0d1e4b3c6b8dd27e1594ca5682e3d9067b9e954ae63
SSDEEP 12288:KVhOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjVq:60Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T180D4234AEF0911F6D4722F3C58B1D225D3E4BD20BFB23BAF7750854A8D7178A9474A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a7b9c984ae3c988f3835c7b16d1731e61a3329d89b7c128e2b7194a8ce9ca86d
MD5 7313b218c20b4e8f40f27567321f4dc3
SHA1 cb6424c106402ab5878db7b61e6c84c41276c1e0
SHA512 e36fac36f2fc8d8702e651ae64eae24bf23c9569eee7cf840e4690bb84c322a62080bb12e959464fb7adefb88b898660847c05868c5caf7ba503bf0842b8849d
SSDEEP 12288:E5OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjuq:E50Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T13DC4238EDF0951F6D0312F3C18A1A324D3D8BE21BED23ABE77A1D54A8D7578B40658C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c19ce2ca672b9abe7a8956b0a97f1c00c5ad8bce0b19d4c77086a19945b7065c
MD5 ec15d84624f82e77b0f4ce04c017df7e
SHA1 c3257e71a3439ec92be0cb60d50db9bc42bc446e
SHA512 b8113ca474a8b3e5bfd6e40e465ff7a05e90fd914525a6070f98b682b686f4ac1b10b28d0e2ca4413181b69ff96fdc6d20b11485adf50e7b5ebd3d14ff34a290
SSDEEP 12288:V+OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjuq:V+0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1FEC4238EDF0951F6D0312F3C18A1A328D3D4BE21BED23A7A77A1D54ADD7578B40648C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ba4c24fb530bc80bc63e7784b75326b7263ef77e914513632d8ce7666597e792
MD5 d4fa076634179dda656e98e04fc97612
SHA1 b0582b2c772a415183baed67f61b978b0d04295c
SHA512 150439b6c7be6783e4855469642ee93a1b3ba17119b7f4ee2d88cfa0fd976d24cc087e5e858b36a057266af3771b352fa5916eb421145b56bf64fbe8ebf438ed
SSDEEP 12288:cCOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljj2q:cC0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1E1C4238EDF0951B6D0312F3C18A0E328D3D8BE21BEE63A7A77A1D54ADD7574B40648C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e3c63495338f4d16d3dd98ba2762e899a65491d0aa2d0a47a0c84c36a09ba4a4
MD5 f7481b8098e0fe5f2ab7e265f0600237
SHA1 dba6d0964dd5a56c6d7adef163846c8351907af4
SHA512 35cb463ad7870189048e6f3c569f4da7019b381019ab16568e9c583ae42ee30021f1ad4257ea4b90655d1f313802af625a91597ef5e45c335734a7e858da3600
SSDEEP 24576:TZMJzFVSOK0Djsf9nz4mloFQnpXUMPQDR6q79dA:TZMJzfZDYf5zaCpXxPuR6E9dA
TLSH
T14505F199B75018F9EC73463D88619916D2F27C261BA0CA1F13E4366B5F333921C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 0894b62513066f63c576ef97dd6217e720428a2b94814d8d616005756dcc17c2
MD5 5634f5a8b3018323b87bd84a417c390b
SHA1 004d2989fb9b51bf9add62cc6194e4667c15a371
SHA512 687a66a77cb5fbbdfa9c96659797f7f834f968dc96488578dd1bb258a69b69e6caad89c8c24c5e094c7f5b3211016520eca981738a754cc0f203e542187572a9
SSDEEP 12288:DPOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjMq:DP0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1FFC4238EDF0951F6D0312F3C18A1E324D3D8BE21BED23ABAB7A1954A9D7574B40648C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 89f68907a7595675d88481c9f83383f6cabc37bc1c12ea0632f44db85de9aea8
MD5 a71f45de67d95e390f4049dc4bab4bcd
SHA1 9a6aa2a30f90cbeed985901c8f00713efd0fdcef
SHA512 f32660c3e23ed22dbfdfd387167988a6cd1fae04eec51b3c2308ed8bfa38db0a880e89918b9f0a5e2baf32c6674d6cfcf8b8e787c842f89c24d31559b1bf164d
SSDEEP 12288:7LOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjMq:7L0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T169C4238EDF0951F6D0312F3C18A1E328D3D8BE21BED23ABA77A1D54A9D7574B40648C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ca156ed4fb825fb27857f938766523bd76e97fbead9b892f7cc8c43b764a5fdc
MD5 9fbdeb82e574353ec0d187657fac4897
SHA1 47d968d7dc8ce71a6dec012ab9facd2a03717740
SHA512 a7747c977be1ddbe62aba6f89bef031043b580a8ac7a010a57f8f5bb293874fb1f4ec72fde98e9cdb766aca8d02bc85011174811962e99ee6031bcfae334b17f
SSDEEP 12288:ZyPz5L8GOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjxq:YzyG0Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T1DCF4024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 b3e788a9743e206576ca4eada129cca392d1003343abfd07f6c37b618c72a759
MD5 3383c40fe5822d00727c3aca0866c305
SHA1 17eb0270b9caecd4d0b59d641ad3ce1ed6282ca2
SHA512 5437b728706e4c035df9cf83f2ca1e637e3d9dacfedd3f3c6ab5566a8f65c17f062f88f5410f1a9b88ad0568942f48179c7599f0e615ff7a6b0dfe47bee6a789
SSDEEP 12288:PPOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjnq:PP0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T186C4238EDF0951F6D0312F3C18A1E324C3D8BE21BED23AAAB7A1D54ADD7574B40648C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 88eb12af6b0e3c3d79440263d4348182591ea6c5d83fa8510513370b57410b1e
MD5 24b1e74b312e6d4aa704743b29225de4
SHA1 df727785fd07f2f0ec18f7ba88549e9e784fdeb0
SHA512 a99e6ab08c6888e7c7b6c46d6ef76a7dc89ead1a7cc3ca1dec0a4b2189531432ae1d5cb9c7836ff0819204e3b1b4d3d7713d5e126088be362bec3ef3ff29abfb
SSDEEP 12288:tPOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjnq:tP0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T165C4238EDF0951F6D0312F3C18A1E328D3D8BE21BED23AAA77A1D54ADD7574B40648C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b9f9389b58543c4625aded70cd0656277b269e9d9abdcb184d57f9ae2d53a69a
MD5 f651b100384f6099a71696bb061a5e09
SHA1 58e9869287104b1e5754ccb86f0468a23c44c9de
SHA512 2f2a7a9c7e08d4698946433ec34096dd1f0856e172d2f92a63a8e2e821ea5d47248c00d7790130f8dad941f098fea1045a077ad699728e3e3c160822ef620753
SSDEEP 12288:LyPz5L8GOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjgq:mzyG0Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T19BF4024BBB5530F9D032563C88A25611F3B1BC325B606FAF27A0477A5E337819D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a16bbd49446b20f83219fe8f6c8355dc0e7e1d61325efc06031bdac1b5a009bd
MD5 9a9b6d1d676ceb02012c088269d8b778
SHA1 28ea4af273aa230c3478dea5e763f44852e583a8
SHA512 1f5ba45eb145c79cc231725a283af3407cd47ffec4e8ff60d39f0c18d95e3ff9866ea9297721afae0862318dc4ed2cbd63f5e60df6633157665b892222df3422
SSDEEP 24576:FTuaLl3z0zD40Djsf9nz4mloFQnpXUMPQDR6q79dA:FTdLljKDYf5zaCpXxPuR6E9dA
TLSH
T12205F199B75018F8EC73463D88618616D2F27C261BB0CA5F13A4366B5F333915C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 a0fe58ddad44acca50d673ab85785a5bfdaf75ffa1b18cbc392bc625d2f093ec
MD5 654966ff715ca999cb17e3ff89b80b5c
SHA1 dd6b74f2cfec7b0b447fa5f9092c0be9d63681ac
SHA512 c9a91490f30b8a0c5d8d2d71e45e8306c8a9beea10cd61e1c4e7beaa670afeecaa70a13970d588e53a1c4f08b6bf348729becf75e00987533112d62619737602
SSDEEP 24576:ocP4mcvIjkGOxhKP2l71SNKbrh/8KBH0Djsf9nz4mloFQnpXUMPQDR6q79dA:TP4m4IpOO67N8KaDYf5zaCpXxPuR6E92
TLSH
T1B065AE2DABDC0096D0BA913885658A49FAB1742A2F3286CF1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 52b5005c68228f24ce649db217ed869b81dc90fa11b07c73f0656aff74d01fda
MD5 f1211aacda9c4c5630c040b17db6381e
SHA1 595f0371ea2b90192c17ec9590580342efe506e7
SHA512 ddd3d27e145952ffc7d3b145d0e6e3562d57b02e86a91e1dcb354b7f139713d354125fe45e9f952f898cc7989e120ab8676721a4d87b90ee96baa48090c79496
SSDEEP 12288:7ksf/OFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjGq:n/0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T146E4F14AD64802E9C07E2638CB619601F3737C21A7E1A3CB67D0F57E0F766859DE9A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 749c1d1ac96f7e90f86eba30d4d99c9f31f51e4d91bb97e9a7c3dbe6d6c5c7ea
MD5 725487573a3534991fa18e5af2c58b86
SHA1 49c7bdfbbfee1100d12c984a62869e830ac569aa
SHA512 1902315bd1f7ccb983994b7ab2f0be354b942dbc9eb3283d9abbf6f0e6234cee08a171c03df06bc118396970bafb547748f95a88d2885989604be8039149e975
SSDEEP 12288:VfOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjEq:Vf0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T166D4234ADF0951B7E0712F3C1871D234A398BE30BF917AAFB79096499C74B8B8874947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 664f596c2a0eed9ea5dcecc8a9aecf2145f142005a4456511a7f3821ab2e709a
MD5 d1f80f008cfdaac538d76d6e99c31be2
SHA1 560d413de3bbb0faa9a67f8575c35a9f20cfe929
SHA512 258ce92623b9dd4058fe382aece9ff37dfd1db40220781a7c460d9e757ab59ce354220c98d652fb36579fe3564fbdf50afe9bff7c842ba3a96cea8fb0dc7622e
SSDEEP 49152:wa0h2GEkuAe73q3pp46zwwQeDYf5zaCpXxPuR6E9dA:wa0hNYG4Jw5oDw/z
TLSH
T1F8859E1E67DC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 c414c5673aaeb54b589857964b1357f82c4585d75ab4d489b7ee1a10e53957fc
MD5 0fd08bcfd14c75bf5092956381cdc240
SHA1 48187e91dffe6938d5bcf07a85993b4795fab211
SHA512 7582564fd4f34ec21dda084d1cec91d4b3011773ccefd372d24b7dbfee54b0d259a6c0397f0d39aac07cab8dd6ee48f9e534e48cd4b2e31e820ad1b2fd58c302
SSDEEP 12288:vhbHjfXaOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjQq:vhbHjPa0Djsf9nz4mloFQnpXUMPQDR67
TLSH
T140E4026E5B9C20E9E071A63C54A1820AD371BC252B6167EF23D1827E4F37BD95C35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 fbf4f0ae6465bf4eff5ace6112748bea06dbbde1aaa8b7fb12c3ff6e8e78e803
MD5 3247cdcc67ea8855827b97435d91ce42
SHA1 23ee2619a3a18f1052ddbf7731492cc4ca0cb34e
SHA512 41307c422d3e04b9413952caa118503484bbd530e1b1d78f472d60ff53f32be0e671da9246e2ee1a0c70e0c54b9626dc0dd0b011a62869dd7d7194b0aa1a8997
SSDEEP 24576:G3YgnJcRTk4yti+R5dpR/S0Djsf9nz4mloFQnpXUMPQDR6q79dA:GIgnaTk46ppR/9DYf5zaCpXxPuR6E9d
TLSH
T1C645BF2EF7B910B9D8A6D236450143B5FB71782D1F209ACB0170C538AF1AED89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 eb3279cb77e7f96d1d8c192d9f0ed06e083b335b3754fa34dc0f7340377fcd4a
MD5 6296f816c9ea13b92b46e2380ddeee94
SHA1 897eda113898972d7af525d67f1dfa3e93d9dd35
SHA512 fc4c6352be3c41c7f55a3ad317b6a375e89c1da64a480b26bea185a0f4e24ac2e482f87a3e822ecfb090c963462cd018c686314284ba9e393619e6186fca7abe
SSDEEP 12288:KbOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjrq:Kb0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T177C4238EDF0951B6D0312F3C18A1D324D3D4BE207FA23AEB76A1E54A9D757CB8474982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 99b392d92e5153096159391e8ffeed2c2af779e9fbd55f9ccc1511eff05dffad
MD5 d94f48f45c18e335e10ed7e4c5d436f3
SHA1 506db228d3c0c000fdcca6d01119fae852c50a6c
SHA512 35c1c096c90ec3d886d93932b968ea36b07b0475879b72001b8bc9c8c8a23a80734bdfb87728893838c9fab9dccbfb9007ae09b6b312fab74b8afd156ba23d0c
SSDEEP 24576:PtL3UTk0Djsf9nz4mloFQnpXUMPQDR6q79dA:PtL3UDDYf5zaCpXxPuR6E9dA
TLSH
T187250155EB9400F9E877923C88B28616D2B2B85D1760E7DF03A88B551F237E64E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 c70fff936627d7f3d6be4d94b08dd66bdb9cc74dc84594b3699876a121587c49
MD5 a3b8b285ddfc7a8b4f1cd92fde2c2ee2
SHA1 d23576c83e7d4defc68f87c4caf4d905b1634194
SHA512 eeffdb9b2ad781ed4a57556df12179be806e9d78e21db0755c512979daea2ca0a2aa0aaaa6e2b4cce08c7d5bf8c996fcd4966f06e8ca6e4907c2ec5acf034937
SSDEEP 12288:ApFtUOgOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjOq:jOg0Djsf9nz4mloFQnpXUMPQDR6q79d
TLSH
T120E4025E7B9D10F5E076663C4892930DD3B1B8211B6227EF12D081AE4F73FE95C39A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 62201e491cb6456ba00e84ae0fb60f45eefad5f4cac4376a3776c62355ca8361
MD5 ed5ea12779a85ee22299a88f59d84801
SHA1 4d672cd7075edbcbe06d517b6ecdb0fc80b7cee3
SHA512 c7c3a5066c81ca246518f9451e58884f712c8068d3092376a7ef71c77d22d5ba57da61108444aec0b6b2898ca4cca99aa8659d633473ec3340f0ac3f51213cd9
SSDEEP 24576:A7NM9YmZqmWMUkPjZM48Mv6bEhsP0Djsf9nz4mloFQnpXUMPQDR6q79dA:A7cBWMpPjN8DbEhFDYf5zaCpXxPuR6E8
TLSH
T106659E2E6BAC81E5D477D13DC9A28205F6F1B4611B318ADF1262833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 00fda5d1524151cf2a70e67107b996373c861d5af7f0e0c6eea286233fad73e7
MD5 e9232d2335d77110f74535348ee6608b
SHA1 75b3927635ac40e2851205ec2445b2e05ebf38d6
SHA512 be5d65d11333e45aec439aa56f4fadfb89ff76f4a133e1f11fd639a6e6cc6de8e865c83e1a915540f1203e6bcc139f548e4ff4048ea80fffa6686a7c028b2038
SSDEEP 49152:MF2YuHNETovcvNYf8km8DYf5zaCpXxPuR6E9dA:p6tCf8kHoDw/z
TLSH
T107858E2967ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 51b0f17ff5b486129cd95b37d057e47724dd9742295008ed728277b87b2e2074
MD5 f8802bbf87d2c83969b7a48bf276a4d0
SHA1 f9678a4b84547940436b107cdfbfa70ee7697bf0
SHA512 08e1d58d1dbb41d436e1f91d5fff990dd7449fda12e7a8f7ca7305987e0f774d1c46d270a9603306098341b0f205349721a9bf7be9ac68b1786edeace56646bd
SSDEEP 24576:XAFs06+Omlf8NXEbTos0Djsf9nz4mloFQnpXUMPQDR6q79dA:wFs060lYXu+DYf5zaCpXxPuR6E9dA
TLSH
T18D65AE2F66AC00D5D07ED17D8997C91AF6B1746307256ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 49ed6c9b891321203da088dfaaca3864f68e2774909a668d505058180687a533
MD5 01ee78fc4dd906f52688734bc769a404
SHA1 fce33afa939264d5c41a909527e0b7a1e4610538
SHA512 32edb796374414d46df1d4a74dcc6b1793aefc51ce535a9a067e6448d5727d8163542e407e63fe09a28a32bb3f7b401459d33405c658508c5626ccd19c83224b
SSDEEP 24576:vJnJ5D3WtZ0Djsf9nz4mloFQnpXUMPQDR6q79dA:vJnJ5DGt+DYf5zaCpXxPuR6E9dA
TLSH
T1C415DF2DD29810E8D4B7C278819A5755FEB2383D2F226ACB28B4D5357F22FD09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2c723ef38f15d1029381c1de273f543bbf0e71ee54934141d7173b21210a8245
MD5 1a7724c99768f7864a2870d256be91fc
SHA1 361ca7048cd54c18350fb13390d8038f7265a94a
SHA512 4ea9e2de53f6f251a837319cc6b7b08d203772aacdd964d6a13b8509b37c236aadb7fff0235c54be1ec5159cf6df076019a36115040708f7ce54c07952e8eb41
SSDEEP 49152:Vo06DIKdwc+eQnSt65aVwDYf5zaCpXxPuR6E9dA:C8oDw/z
TLSH
T1F2955C16BBEA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 20711243392d0e28f8480d42f2c5879a2bddf996c6122f26ecb0d7a098941a7d
MD5 1c4f4ee731964eb14d2d87b0681dc9da
SHA1 b751c803fb2e52188bd6a1b06aa2e4598d574e29
SHA512 2944411718b94dfe72a8c46c162f10227d5f942a9e97bd75ca2cfa09579ccd8f2ad3eae8339f944457f69dfee3e1f05aa6d6dbf8cfe54ff80c73bd57fd56c890
SSDEEP 12288:fEP3RrVOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjOq:krV0Djsf9nz4mloFQnpXUMPQDR6q79d
TLSH
T106E4025EAF4C60F6D032663C54A18205D3B1F4306B523BEF66E1C27E8E77ADA5D38A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 3e5193402d277fceb6275610980963f97157b8b225dec135f5a44b26bf117df6
MD5 c9bccac1fb7b28f5d12fdc5b920c7bce
SHA1 6944c01a4c08e05421d0625754c8cfc0deb1e777
SHA512 514692a62a8390394b8e1ae29e32e573724b349011c78e899e6c13597d5a87a555a82436a45967d215c6c705cc2ae8ab98f1a70299b58ddb491c59d388f79d27
SSDEEP 12288:+jkyqOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjgq:+Iyq0Djsf9nz4mloFQnpXUMPQDR6q792
TLSH
T132F41249AB4860E5E4711B3C58B28264DBB4BC307F2167EF71D0E63E9E76BC59834B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 e2e6ae85f0fa1949159404825eaad9927dab237cba7a4681ece51b84c73a8b92
MD5 0886499be708093280c45872783f5965
SHA1 203cf629a4d00de5474fe2356eabe3c2fb12c5f2
SHA512 9f616867125e279d17e91e67e8743c8d8cd85f180cdc73a9ba8d1b50ee326e5ca7b70f26348d802ebec04c74e375b3bfb463046b2c29e04f59a740e9d9d08356
SSDEEP 12288:6FwOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjsq:4w0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T1ACD4124D9F0960B6E4312F3C18619224D2A47E307FA13AFF76E0E56ACE757CB9075982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d920e07db825883da7d33d4ab040587acb60a04e635b8427df3b3113c55a9891
MD5 3af6f41500e7d00be3d6de61446968bc
SHA1 657a6812837473f0af9f1ab94b9b83f6682eb1e3
SHA512 2d26c2f0cb88f30f9552af6e278738597120217c5f7c9941df3662eeaaf3fd5543398fe1cb4fd5c33594544fd477ede94c181df72e08e21977f4ad911fd4ad99
SSDEEP 24576:5Q9MxZKdcz97w330Djsf9nz4mloFQnpXUMPQDR6q79dA:5VKXEDYf5zaCpXxPuR6E9dA
TLSH
T131558C2DABE9059AE173D23994A250C3A673B4311B35D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 f3b5d6a3ecc6ca4b5d5360cbc890a47584e9b39a484bc6347da588d51459bd14
MD5 f3c4741b7f474f68cf85f7c9c24e95cb
SHA1 f64bac62cd95c0cf4ef659b9fbb7136d981da58b
SHA512 b62d1c06e858c656c413b9bf89fddae8e49ee663a051b11f1faf6928edc243156af275169346e6df91e1b2a05389dcb34935be0f4b6737f74922699f08e04168
SSDEEP 24576:AyocxAp20Djsf9nz4mloFQnpXUMPQDR6q79dA:NocxAphDYf5zaCpXxPuR6E9dA
TLSH
T176F4E01FBB5940E2D072923C88858345E7B3B4306B6267DB6691C33D8E77AD9BD34B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6f948a10cdf46a4813053bf7e4b2f6d154b70383ced1bfe041bfd8b64e13cf25
MD5 93753b55b51cfb8feb0f6b2fd6af1b85
SHA1 8f588bcfcf62e43c00880b7d044803193a5f08b7
SHA512 8d1a8198e6e5653a7c5bfb0287112cf36582694b4a456ba3db69899da4114129f2a22b0207a193758967f8e7acda7c9c00c509a1d1d88f231945dd87d998e303
SSDEEP 49152:SWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKhDYf5zaCpXxPuR6E9dA:E0zuNIloDw/z
TLSH
T1CCA57C3DA2BC00A9D8AAC379C5451365EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8623bdda9c0a954cd67431b7ffa9f8421768a7b5215f97cf24bbed44251cb0f3
MD5 9add02fbaa13965077a77fd0550fb94e
SHA1 ded2e24b10e8976e6f281ffa48af9241e15e91b9
SHA512 ddcee11a48357f533a13788bf0d8c928cc4a73f7017ef082c19e0253006557f30db7bcda3815e13b4c51dc5fc4d766daa788a923ecbaa8039542be22021e032e
SSDEEP 24576:11QT7EcpfxR+N5AWAz3ooiYqjMqbV0Djsf9nz4mloFQnpXUMPQDR6q79dA:wTDxR+N5YzTEjMDDYf5zaCpXxPuR6E92
TLSH
T16A55B02EA7F815E9D17E86789A23C512FB727821073193CB42A0C17E0E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 b52e5554de70ccce2b28fcb9956875ca385e3cbcaae7b8989651c704dd40f8ef
MD5 96565edc30b05af398edfed9cd75918e
SHA1 bf85c6e7915b59ab6921bcb391a9042d94233636
SHA512 d586c7662976989358bf1b9979808bf3d65ddf8be1d1a0e16317c571d9445863a0a27c6ff0d2846c8f1571570460721ca685dcdfb38f631f3d8a63218510b24a
SSDEEP 24576:kTMdOz0FFS+vmSLh0Djsf9nz4mloFQnpXUMPQDR6q79dA:M0K+vmSLmDYf5zaCpXxPuR6E9dA
TLSH
T14415E17EA75D14F5E47BC27C99538A06E6B2386103227ADB06E0C1792F6BFD43939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 001c02a62c506763d2bb2e98f9d1c794c36826dc9d5897ad48ac4d1be664589a
MD5 14c480ebcbe2387a940ccb91b5fad0d1
SHA1 b3e91fdc945cefb886acfaa374ad241cd301c7fe
SHA512 2e405a625b0a0a574961869380f773116da16e4ca40a6710e1efa86f68eed64bfac3897fbeae269a77938af9c64b50093cad747e5cd9eb1f9542d07ac2c6e473
SSDEEP 12288:f47kOFjHjVOfSCuBn+1V4mlzEFQyYVgwvPNaMvwaQDR6q79LRgRljjgq:qk0Djsf9nz4mloFQnpXUMPQDR6q79dA
TLSH
T147D4124D9BD830E5E4726A3859728215D3B0BC312B653AFF36E0C57A8F367CA9534B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/644-36-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/644-95-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/644-30-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/760-378-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/760-212-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/760-206-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/824-508-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-521-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-511-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-510-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-512-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-514-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-509-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-519-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-520-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-518-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-517-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-506-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-513-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-507-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-515-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/824-516-0x00000226B8FC0000-0x00000226B8FD0000-memory.dmp

Download

memory/900-202-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/900-199-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/900-204-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1048-373-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1048-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1048-502-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1048-504-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1160-384-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1160-105-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1160-99-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1764-465-0x0000000140000000-0x0000000140355000-memory.dmp

Download

memory/1764-8-0x0000000140000000-0x0000000140355000-memory.dmp

Download

memory/1764-457-0x0000000140000000-0x0000000140355000-memory.dmp

Download

memory/1764-458-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/1764-9-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/1764-0-0x0000000001EC0000-0x0000000001F20000-memory.dmp

Download

memory/1960-46-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/1960-40-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/1960-84-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/1960-86-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2056-377-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2056-189-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2056-183-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2188-339-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/2188-383-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2188-587-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2188-247-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2188-253-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2188-380-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/2188-323-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/2264-379-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2264-222-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2380-226-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2380-381-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2380-232-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2468-242-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2468-382-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2468-586-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2548-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2548-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2548-372-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3040-25-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3040-505-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3040-16-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3040-24-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3348-375-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3348-168-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3348-162-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3388-179-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3388-173-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3388-376-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3704-158-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3704-374-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3704-152-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4108-368-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4108-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4108-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4400-367-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4400-50-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4400-56-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4412-70-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4412-80-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4412-82-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4412-76-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4588-122-0x0000000000730000-0x0000000000796000-memory.dmp

Download

memory/4588-127-0x0000000000730000-0x0000000000796000-memory.dmp

Download

memory/4588-371-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4888-115-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4888-370-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4888-109-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4984-87-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4984-93-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4984-369-0x0000000140000000-0x00000001400B9000-memory.dmp

Download