6e81cfc3ca1bc7b72b2a9b9d43f78545d20867dcc92b20bd6ff28a0161e59c37

Analysis

max time kernel
138s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_5103d8dbfe8c99d40c4cd4138d05c9c4_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
Size 819KB
Sample260708-e9w1jsbx2p
SHA256 6e81cfc3ca1bc7b72b2a9b9d43f78545d20867dcc92b20bd6ff28a0161e59c37
MD5 5103d8dbfe8c99d40c4cd4138d05c9c4
SHA1 b531830a2b22df580dc7222dff834d88d3941d3c
SHA512 8756eee4a6dff3693dbf8364ee54b0d126be69d1b86e5e47ef50d4c3a443f1bb3c5c8254aea00280d62638419e019c906450d27792193586f1055367854326cd
SSDEEP 12288:H8PCHpwpc29yJYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46be:14c29BpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1DB05012973A108F9EC27C27CC9A2D516E6727C550362EADF13A446251F637C0AF3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 22 IoCs

pid	Process
1480	alg.exe
996	elevation_service.exe
1292	elevation_service.exe
2368	maintenanceservice.exe
4416	OSE.EXE
5800	GameInputSvc.exe
2532	GameInputSvc.exe
6068	msdtc.exe
3468	PerceptionSimulationService.exe
4156	perfhost.exe
3448	ReFsDedupSvc.exe
4324	locator.exe
3408	SensorDataService.exe
1140	snmptrap.exe
4708	ssh-agent.exe
2492	TieringEngineService.exe
5296	AgentService.exe
4008	vds.exe
2800	vssvc.exe
1000	wbengine.exe
200	WmiApSrv.exe
3804	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ca66209d8ede1e.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_5103d8dbfe8c99d40c4cd4138d05c9c4_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_5103d8dbfe8c99d40c4cd4138d05c9c4_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{9093A7CC-6006-4A46-A1EC-2CEE3ADC4602}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{44D61DC1-EA77-40AD-8CA3-A0B65603141A}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2116	explorer.exe
2116	explorer.exe
2532	GameInputSvc.exe
2532	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4620	2026-07-08_5103d8dbfe8c99d40c4cd4138d05c9c4_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeShutdownPrivilege	2116	explorer.exe
Token: SeCreatePagefilePrivilege	2116	explorer.exe
Token: SeDebugPrivilege	1480	alg.exe
Token: SeDebugPrivilege	1480	alg.exe
Token: SeTakeOwnershipPrivilege	996	elevation_service.exe
Token: SeTcbPrivilege	5800	GameInputSvc.exe
Token: SeBackupPrivilege	3448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2492	TieringEngineService.exe
Token: SeManageVolumePrivilege	2492	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5296	AgentService.exe
Token: SeBackupPrivilege	2800	vssvc.exe
Token: SeRestorePrivilege	2800	vssvc.exe
Token: SeAuditPrivilege	2800	vssvc.exe
Token: SeBackupPrivilege	1000	wbengine.exe
Token: SeRestorePrivilege	1000	wbengine.exe
Token: SeSecurityPrivilege	1000	wbengine.exe
Token: 33	3804	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3804	SearchIndexer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
568	sihost.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe
2116	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3252	StartMenuExperienceHost.exe
1536	SearchHost.exe
2116	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 2116	568	sihost.exe	97
PID 5800 wrote to memory of 2532	5800	GameInputSvc.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_5103d8dbfe8c99d40c4cd4138d05c9c4_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_5103d8dbfe8c99d40c4cd4138d05c9c4_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1292

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2368

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2116

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1536

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3252

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2532

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6068

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3468

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4156

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3408

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4708

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5296

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:200

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ea347eeca22d0b6fa144589c19d89246516116437540239b2246d2d6534120fd
MD5 f2ec80d63b9868179a3bd543ec543777
SHA1 4337d23cac2e791fd273044fdead4118cd4fbf09
SHA512 539fa051eb47cd061bdbff3122c812740861f37d402d769d76c505e0213344d520084366e36299179754c67ad9c57ce7ed6c88aa140a31f2f8b5cfb68526af9e
SSDEEP 49152:8b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnOJOBR8nv9PU:m3q6gjBxSR8nR
TLSH
T14ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 dcbc6eb2e23e5c69bf6d7d997fa9e4274845561d7cff8c4a76665ed8efb99717
MD5 179382026b0145cdeab3e2b8c4117e24
SHA1 3d272625e3db382730a593533c069129db754d46
SHA512 007364c7bc0a332a418b3bbc86da8276c87f6a49957dc9abe43d51e7265ac6887e7b0eb89ef1592334b6668b6a7940e23342d16d36a0482ee4859c7eea946efc
SSDEEP 24576:tXY2LzczAvpD3eBR8nvn9ZyXLYKM/s7q:LzcwJOBR8nv9PU
TLSH
T15B05F12873E108F9ED6B823CC8619506E673BC8143A5E79B13F489255F637C89E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0c9ce6481b6a22942ff3749bdb04b1b159ed7fd68d840b7f6a85526718669123
MD5 34b07a47bcd3fe5ff01a34befbd3d2d6
SHA1 8c19de34d7f12464e71001762f772f6b93da5fe1
SHA512 155afbb28f7198cdf33dda62508b1b32903fb1f8a579fa219959af10b003abe5596054c0e7084249b85bba978a6f5b745bedd65d6067ca7cbbb532567ceafdca
SSDEEP 24576:r03e5Xe0rmxOrMWpD3eBR8nvn9ZyXLYKM/s7q:rrXe0So1JOBR8nv9PU
TLSH
T14F45AE25F6748331D073C0B9C5D2A68EE972308257318ACB5296C76C7E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 27b8959dd745c05960365bcfdcd0ca94b73b310bebb22b51706e7e0c52756559
MD5 0ed57bd304cbdce12200ae4a44d00c29
SHA1 cb2f8483700cb2fd239c8e895e5185c60dd61246
SHA512 fa7ed1b832454340dd29b5963bed9ff535a5225a681bf7d562a4122988dfabaca267e5371e29e135c7f509714e88a1ae241793055d6cce642eb45c2619ab8303
SSDEEP 24576:7ae/ezSC6vUyD/aqgrvW/6q8wyunpD3eBR8nvn9ZyXLYKM/s7q:H/ezSC6vUzPvuHjy6JOBR8nv9PU
TLSH
T1F5756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 a872abbd143340b4fb8e4b71f12a4ca90ad1604c3d93b9156e18010ff85655bc
MD5 76f9b8f080f61286b0db9b1864bfa363
SHA1 532e4e783339a7f70898299170d8c11792dc866b
SHA512 bae8a31d6b6761b245d17d76b3e58772330b1ec90d6394fc62f8be6af576757c8d2de3dd266af2a10761ecde7dc521104e2b4d861f18caa60743504057f560c2
SSDEEP 24576:YAbWP7HMWv/l+dWpD3eBR8nvn9ZyXLYKM/s7q:YAuHMWXl+IJOBR8nv9PU
TLSH
T15C559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 c6c408b388db75098499160e1c165cca8c10001da1834b71326f412741d7b43e
MD5 c50b7b031112b36fcb497b5f72d70d38
SHA1 5245a3ca79bc5baf0c6931393f2abd5942bfc8d8
SHA512 05a8fbbd3abe09e780d95cad43b27f5029cc7a630b5f41a37eb3de0819e6115bc14a2c7bab65d0218436fdabb8c5bea6d639fe2a5e2090c426496b5526ca8205
SSDEEP 12288:AUWYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:AUhpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1A7D4231822A17895FB1E873534247A0F15B5FC82B1FFB95D39BB6904A8E6F80D30527B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 609f28dada8f34af46f1c618cacbdc92d86c6e486cbf39bebf650334ae62896c
MD5 84a4c224f66bc9c0a08856dcebf1aab3
SHA1 d89491c3ec020f25c7ac794b7efba8c184a7c9b7
SHA512 f1429ec4794ab5c25a8c3b78527f64c4275443e741109b22032b249c8414756fe8ee6358eb2b823b69159b86a7a81c23a6950a84b370ea6c168e9a7af52f1834
SSDEEP 12288:QeBNUbTVO86ULYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46be:QJIUkpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T19C15C03BAE28FCD2C27E8D795A518700A77278714B62A3CBE175830EDE136D05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 8d86b6c53ac5ea76ad423808bb765431f4d058a463c30c593dd1f67dbd0ac8a3
MD5 f8af03da432e7c8978f2745e13cdcbb6
SHA1 46ccccda389dc2d557a0b7902314e777ceac0329
SHA512 3c31b180f7f58c6e84c150480f3bd11ac0a851b811b94c85df1740eb71e424234f030558dc2a8ca9b67f69ea4179c8c350fbfae7deae10c78f35b02bde0c5331
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJx9DN5JTNRV3THy:nQvGAdlCEL8c/xRNP5CYSR8nR
TLSH
T13D367D656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 ab0b9d2b0d9d96c97239bf4e99c4f02a241fb1925ea5393394dd3a2b9a3e0d6f
MD5 b6e2b6a65975b5084e85b8322227617c
SHA1 8b01640e3e8ec30e50e2118715b27b8642d2174e
SHA512 6365e502f97033dd1a1402c66ed8e57c6ee5b6806ff8e31092ae385d4d16f8c6f7b885d254605b0e9c6357386eddf3a4c17e539689d1d07a6792797915122e6b
SSDEEP 12288:AiwSfxL/2Dc3bDLLmt0LDQewsAjFYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCN:jmewsAjapD3eBR8nvn9ZyXLYKM/s7q
TLSH
T15015E030FA74E436C77F0DB61B25D71A147CB9604BA22AC3F3B84E8D59606D16336A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c4f0d2fec1526f4adcba5cf2f52b3d14b77dfec6b77e3d4416555f6cfa8c9695
MD5 a43552de8dfb3b431b79cca5671ff259
SHA1 7f745d06897b183707f1e1811368bf34bbf41da3
SHA512 7604c16cfe3968640dfed7687ed8469f980f0459ce12e40fabeafb0ce443b4293a5b84cce95a5f473b3383205a290bf3a9662cfe8d08e0be874b14b2068cd17d
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrUdPlbuJHCY:BUEtQevvqc2W1cpV2Xrg2
TLSH
T1C8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aae361054349b76bdf75d3116eb40b746849670be76a52f54c1eabcd0ada0345
MD5 4cc8c7284ce6de76e2b2a3302f2dfc6e
SHA1 206c3943de412bc1a8de2eb80e4247fdac9974cd
SHA512 3604932a9b95e7351616ebb06964067566507285d8d45cf6c7cf6f36b45a1e9f3847e1847df2e51aed5b22aea9ebf84aee8d1079c9279a1c2da525a1589c1cb6
SSDEEP 49152:GXbRquA/m2yL5zMfFiV+XenmE3/z9JOBR8nv9PU:woq1VjnmASR8nR
TLSH
T105D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF5266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f5915b911e0fc58d9e84266a4b7769fb99310642506594d928efb2202b48eb87
MD5 ebdb7ddf6efd2607750230cec11e10ab
SHA1 1b24c7d0d9a9d2cabdb305f4f295afb6aeddbc0a
SHA512 ad18b3209665d66661a58dc2240a7031c84bb4092cac3b9d2a8a500fe062d2209213f7437ceffc80f0a8769a1360c74ead13e583e84966c2b67268727e71ad09
SSDEEP 24576:RAhGLv7FoiwtA5l7S53rpD3eBR8nvn9ZyXLYKM/s7q:RAMHFoiq5bJOBR8nv9PU
TLSH
T1AE459D80E7F955D4F5B3AA78A9B69571EA76BCA65E31D20F2160C10F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 d9c5c218fd13e55221d89b6cf31716c985643768dbb7a5a387c60d290020aa2a
MD5 02b2accf319d57438bf16906776bd5ab
SHA1 a2de0b67beabbd39d8a477afb209d3a8e0565245
SHA512 894bc47b9e26d948724435eef1b29ea52f009699305aff62f5b730e53db8dede613e22358a4a7394f0749630e91b4ac7ef3e22d24582f12196c99e562cebafa9
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CnYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/B:uwuuOWdpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1CC05F10932A41CF9EA6782388557D536F7F2BC022676DB1F2770C64B6F67350AE29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 e9efe1c1c0dcb0652647767ac8c55df238c62046b8b9dc125ad0368d589fe6ef
MD5 eaa6ec54dd181335d629abbc5e3a04ef
SHA1 90d776cf1df4b05415ab14a2f2338f6d6ac47c4a
SHA512 9926ece3e3e858b3171f042ffdf4842d3cc6b199e4718a08dab3e78f9b911cebc7560baea7bca83556e37c854e8de460245b7d0c21a0f3c4658614ac0cb5213c
SSDEEP 12288:9oa1IGEYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:qauUpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1D2E4121933E430F5E667823898A46A0A97B2BC42637793CF367646455F63FC19E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5a0f0358a9a6cb09189e5671049d80570dbc4d4956190ed1eaf2fedb87315830
MD5 c98095c807e60d22bba3dc63fb7989b6
SHA1 2a6b032e3d461294b589d4d19812497281aea698
SHA512 8541dbd616bd3ed28dfc3c8318ee7e76c7b0c38896f59c19caa86ad326f8f5c4f0b9b72c15f9caab829328af574be081e9743ec5e6b5156c2e97c9afdaf5c58f
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uz:ZQRQyi36YOcP8Lvw2gAf+PN3sSR8nR
TLSH
T1BE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fc74f46b102095f04e6fdae5998cc1fb0bd59d760c71c7fa28f6cece0ffb11ee
MD5 e3f0e80457a05775d8f87c7ee4c00763
SHA1 70a58c4b9a03e4497dfce2dcdfb60257a7993638
SHA512 f69a1fdaba3d6600bec5f41030d6adbd59fc9b47182e64aa47f2af4d6bfee1640767f733d086f7de43499c32f0ca827d4c08b68a08c4f64faf586eb5e6cb7e83
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UP:ZQRQyi36YOcP8Lvw2gAf+PN3QSR8nR
TLSH
T103667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6ffd9f60d6683c2e4392244de74bf8cbf7aae4e7fed36862c375ae8d4113409e
MD5 8fc749548f0f589002019eabd1202329
SHA1 0726bbe549807eeb405f6200b8a71ffdb1b196d0
SHA512 1a728774b65b742c5a2593ac6a4b080d9de09172f7da4c8c124a5a2b047b293b22dcaee69a2a6026dd1eb645701a543f46ce40494bf11fd736f6154e01d5344e
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0dpD3eBR8nvn9Zyk:A68Qg55nhMeWu7PNU3/yJOBR8nv9PU
TLSH
T12EB55A33B2F200A9C44DE1769F4A972196D27C718FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ff6d15c8ae8780847595a1ae14a303caef55c053ac58dd2493b740fdbbe2ea9c
MD5 ca5a5a3db2b8b1edb4d2f6675ed7546a
SHA1 4b4b25bd72577ae545f166692de6e02dc679d117
SHA512 474eb3fd13e4931f2e42404c24ba454086ad5b0a0903952fadadc5f05d6a646775a7d8ad9d8b40724109b2c452c13c7cf863aecbb98501a7cfc5a2996d5ffd06
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99P:zy5112gYy5azzVv569nLKnhZlSR8nR
TLSH
T11E167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a996dfbcd8e97dcf44029e2f82664f17fbe7193173e6c1a11aa7adb3627922d6
MD5 e528a42d2219ed17ad111fca28e482f0
SHA1 8c276cb1362bf8c1ab177ae44220bf38db96d599
SHA512 c86a7c461fc994423a940347c4743a14c04cd5f6331e3ddc57981e2602fee68873baced8cb76e288226f7496c90eb6de8b85bff39b80f3a5dab550577e70ff04
SSDEEP 49152:tB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl8JOBR8nv9PU:zu6JmTxd2dQSR8nR
TLSH
T1BED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 887fd71518067f77b1b1937d2f455d126111d81ecd91477b2a6417ce0560bdc3
MD5 113a3f3cd1713e420cfcca3ec5df208b
SHA1 311eb837f5c642cd4fec707a6468b35c355c88bc
SHA512 6a53614ecbbeefbb3f0f686b2049580ffe2b0a76e2cba3db6baee5b562ab0329c5b549bd2b2602c7cc790210c7266fd98a703e7b43d84a0322ef675fefebc3c4
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4xAJOBR8nv9PU:OmifPbRRSR8nR
TLSH
T11AB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7fec53c607419e2223114a655c5f2b362d0681e55e2c3dfc2e440efdeb8719e2
MD5 d6d60f24dd8f7b6587bbf9af07b97c0f
SHA1 4547a858d1758664ad5b36c776e5cfa5d3887974
SHA512 efa982adbf3caf80f4e082c25a6d64a5c00d613facc18a79d692174941853568ccf0c0edded43111df11d3069763d36fab27687ec8faeff7af241ec77fc086df
SSDEEP 49152:0SuZQIY0Be2K6RVtOnks6NMHqNJOBR8nv9PU:m5dKoi61TSR8nR
TLSH
T151C5BF03F2E940E8E0BED67487659236EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2db87695ccf029124164837bbe0d012032478d144e8757d78c2278086ccea606
MD5 efcdd45ff14ad930e1d58c49e00d47f2
SHA1 314db1b062c137e84b25fea1067e5022da79d0c1
SHA512 83e5fde8043521780c98a273c7793a0ce2851775d328947a37b3a3d2eaab112d5efbb3aa9adc49f6c28d2af228f6dbc150ef8594b132c9160c99a2fb4c382fe1
SSDEEP 49152:khtSn8EApI0figTgiDn0AP5wAJOBR8nv9PU:lX2iyphxSR8nR
TLSH
T1EDA5BE13F2D900E8D05ED178C7568632E962BC160B39B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 54f0eb4dec8be3ae37900c285fb66560703bff47e64440c3b15521d4cb5ca9a7
MD5 3ac997b3dc8805648d4c761fa201aa40
SHA1 cbcf931caa9a78d25a35c7aa67733a8dadeb6497
SHA512 63c845d95cb69813d25a59f5ecca0137b3b4fa2542f37da0cb6342c1b5c3c5129b9821984d0ec8604ac7a86ca4d6316fdecb44c084180c2a278b8b165f34ac3d
SSDEEP 12288:joYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:jvpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T122D4231831A26896FB1D873564247A0F25A9FC83B1FFB56D3ABF0501A9D7F80D3052B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 47fa10c03ab297d7e095a80a581c608013b9219b774b3113eed321894b2d51c0
MD5 c4a07d85421d5af91c75db6348dea85f
SHA1 3a1d3d58a41fc4e4f9259bfae61a32a81814ddd0
SHA512 e2a4179f9e4d43bc0b372c70c74ad328f54a77423073e4f86c708360c416153157b459bdf6df356b2da4b97337ac36b7ffd30e8b3058585e6c5c7c8c6854af44
SSDEEP 12288:FkYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:FTpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T10CD4231832A26886F71DC7356414BA4F15A9FD83B1FFA56D3ABF0401A9C7F80E30527A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 5de75328ef65c699b3f4fb9519bf8e76cd7dae7fdbb58dd84e1ba5ea63be0013
MD5 ffa21e6cf8c91eb080e69084fa30bb3d
SHA1 2a5a4ecfc3b0a5a6c7b8d8c71c783283b6805231
SHA512 0124c8f4d7c99b0907f760e6f388271d51768d80499de11ff8047b6c1d7d6f49cf2378f43e25986c9f332d8bf091de79e22dbee1175161dab30beb90ef08c1f0
SSDEEP 12288:bglYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:bg6pD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1B0D4231832A26846FB1D873564147A0F19A9FC83B1FFB56D7ABF0401A9D7F80E3052B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 b3487dc6eb851ae0dd924392884f87af5869d7ea42ce12f50d93142c97083361
MD5 4a4773205b4f629d017a41da7b7be6a5
SHA1 c56be3d465c44e83171f661a32d350b8c74b5951
SHA512 fba31f25076713a074c6b52cd4aeee122eaa9b580efdf913eb58ad256027c454d541a288c634a6c8e4b41eae7256b56200955612a8e5edd3a7c4e67cba22ae26
SSDEEP 12288:QlClYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:v6pD3eBR8nvn9ZyXLYKM/s7q
TLSH
T176D4231433A624C5FA2AC3349420760FA6B5FCC2B2BBB66F7A7705055DE3B80E614779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 fe879a0d7e3b1faaf464e2c1cf144cf6fb1e17671bf04a50ef1e9c725cb590a6
MD5 b9af2568eb6cd036f52ccad70f3adade
SHA1 d4a1b46d0595f0cc988006d144c1e89460be0d19
SHA512 6714ecb7032576c8ca53433410e4b6b9696f95ab8c764d29bf8f40427ef7b8a1377c5e0262f3befa49bb86effa8d8ed4f4f6dc033ae4281bae2a1ea0d104b0cd
SSDEEP 12288:aLYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:akpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1B2D4231831A26886FB1D873564147A4F28B9FD83B1FFA56D7ABF0500A9D7F80E3051B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 183ec59d7a20041e1b5e60dd1b02bdb90fc46cc9ce8cb6b7ea744b1d104a742c
MD5 35a83be8adb9f3a9124386b3b6517b1a
SHA1 babc5bf85f93d61bc109715aad7cd9662efa3d51
SHA512 748279e3777acb112e01eaef3c25e53beb9c4f46f415ffe180fe8acc516dbab827887dbf3bbc91eb1a25fbda90b39b551535ba3439e555d0eee8c6865e76bb9c
SSDEEP 12288:J2YpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:JBpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T152D4231831A26896F71DC73564147A4F19A9FC83B1FBA16D3ABF0501A9D7F80E3052BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 20ea402dae684d5c6d3dae9dd038e4dd66883ac397a436a8f0cd1c0b5f26715f
MD5 f885e3d000ae4a7da48b0d70d88d7982
SHA1 645edf3ef337f1eefd42860ada1f49f17a5ac93c
SHA512 bbba0467405086ea80e4976caeadd259663096d43a6ed61c0945aa559c322ff43326cc32a33c9388de3003af0f6f45e7681fcc1ef13f2a742340ac3e6b5a5395
SSDEEP 12288:qVYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:qKpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T13AD4231832A26856FB1DC7356414BA0F15A9FD83B1FFA16D7ABF4400A9D7F80E3052B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 3668bcd452d6f7d0ea8c668595bff294099591e30db1744217fd31b955ae5db8
MD5 5d86f1365ba02bcbd06f3736696411df
SHA1 e2deec2b529a3f3c34e7750b526258388c2d5401
SHA512 e00ae1abf713a0d2e595a3671d8c9ae77ddd96c968877f1e582f6c478ecbddc4569d1be5e8074baad5c68f63fa607e4c65a40fda1206b320ffd4c659311ab067
SSDEEP 24576:RZM+z3VSFrbpD3eBR8nvn9ZyXLYKM/s7q:RZM+zFUJOBR8nv9PU
TLSH
T1F715025473A01CF8ED67823EC814990AD6B2BC4616B0C61F23F936175F737905D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 d5844668f72fef1959e92082de3db80e02947bab63f41b5ca0d5190b57d06f39
MD5 ad4220381b8c25d0ea4af868b2c80956
SHA1 fb1208ab234f527f0abefdf2875006af895cbe52
SHA512 d9d9f932cd495bf06f068b01291260f12535068ff56d0246d06617aa58b4ba7113756d3252c58d8fdbc73b4fb1a89c0e7ae314236190e32b1db891eb00854e00
SSDEEP 12288:rojYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:rocpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1C1D4231831A26896FB1D873564147A4F19A9FCC3B1FBB16D7ABF0500A9D7F80E3052B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 333de97b7073e5a478f2e456e2c24a9f81c7569ab0eaaac0e4745d559a067959
MD5 6c9d0b6b18eb1c94e77f400fbef80bb7
SHA1 f37fc2d32ca43c5deed50b0c23e2190afe98bbe3
SHA512 008d21aeac766364c8ce10de33d8961116a51f853238206472c73937cefdbb1f8e805f15e1c8564b27199a2e268767eb828e447fb9bb2d6b2681b563d122c885
SSDEEP 12288:J6YpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:J9pD3eBR8nvn9ZyXLYKM/s7q
TLSH
T189D4231831A26886FB1D873564147A0F19B9FC83B1FBB26D7ABF4501A9D7F80E305279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 f4d02e6eccdf45e3c738a59eb3ae2ee1a9f678061db10a2d3f07dcad9c177efd
MD5 da130282d238f18e23c2e8e35b336adb
SHA1 a913d613fbe7fa18bb2ba3b1e65b7eb75f5de6d0
SHA512 3b5ab3f6cd8e81cdd4c8da1f831b0e7c5b8436c0edc16f8e3ff5858c28d5d3accc01ceb1bd6d8ff2bb31684c371c3197e263066392cc9c95b8a1587f0789eb6a
SSDEEP 12288:TuPZVL9zYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:KZDMpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T100F4121733A130F9E13A823888512A07F775FC7253769A6F27B507662E63790DE2A770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 cfb9af3a3999cb718b3b6e3a7923e7be7c603ca5473766c4194e1922996b83b4
MD5 59aea54a1db0935d0f4975d17ff8ea0a
SHA1 399e0b356b649aa777b989dfc2d923f8b4a1039d
SHA512 5de853de5ee435a3887bdda87b46ae8208478bc50845f5bfb72c3ca7fa10ebf536e0ae226b666008d51bc523ca3b97e54dbf0a9dad1f26ee81543949625099f7
SSDEEP 12288:PGYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:PxpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T178D4231832A26886FB1D87356514BA0F15B9FC83B1FBB16D7ABF0500A9D7F80E305279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 f8ee78aa441fa87eb2af7a7b47253d5b709e0c37a754b686a0bba034946ef8e2
MD5 ee3d2a944d16af7a980d94ed2ab10698
SHA1 aca02dc07469faf698703c7f8a90afe329dc6a2f
SHA512 b952d495f72a6b940674734cf0c1ff9ff23cd7625eb56b31f88367b1378f834983bc0a1378203bcb3b948e2f4faed1b68979e4580cce26c73e1d2955e4700482
SSDEEP 12288:TzYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:TMpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T180D4231832A26896FA1D873565147A0F15B9FCC3B1FBB16D7ABF0500A9C7F80E3052B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 099a222a409b9c93d9574490af756f370fc1b2f1b0ec7c0514da53e24ce6492e
MD5 17a56c7f5083ee8bb1f10d4d5104133f
SHA1 adee0656d86910e1f47570b176515197084aa1b5
SHA512 1527f4de6a093cbf682f25d166f1fd772e5801b52bd505d264475376a6f998781e41f9f2533e1bc3ab7da518c058ca398f3fe16d46f0c43e03659721956ce437
SSDEEP 12288:+uPZVL9LYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:PZDkpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T160F4121733A130F9E136823888612A07F775BC7253769A6F37B507662E63790DE2A770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 0bc6fb0d22d5c428a839eab650ff6e6023e7e3614683ba18fd0329eb442a36d9
MD5 e0a14338a19850b62ecf85b4a0902c53
SHA1 3a76ca95bc4b9a5c4e3bf5f664b0a5add86c8992
SHA512 b387be307fdde73df96fab2fc842feeb7fa73e93e50a9cd8c2607e7437a99ea8234809bef74fe33d5c402265383a8400647a646d7b3758e07a3c1d42a4949537
SSDEEP 24576:sTgaLG3z0z1kpD3eBR8nvn9ZyXLYKM/s7q:sTnLGj9JOBR8nv9PU
TLSH
T14815016473901CF8ED67823EC815990AD2B2BC5607B0C61F23F936165F737905D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 3e1b814ca6cdd39fa7ce878d9dd2135c553097a11f0cd8d018e42a1124cf0965
MD5 a6517f8bbe70c7e41f9c87c9e93fbb19
SHA1 27faaf3ed9200f60b22e3c99223cc7db1a09986f
SHA512 39f47c01ceee324e0b25873ac2b5402ca52c39f75affb651761f53a3e6da6033dde68bd15a59e05a024eb7629dd3a41802aa31113393ebad0e76feafa1b10751
SSDEEP 24576:b37dhCHKy7F0YpD3eBR8nvn9ZyXLYKM/s7q:77dhCHKyxvJOBR8nv9PU
TLSH
T17A35DF90B3E414E8F177CA3589755502DAB67C9A1B71DA8F13A8251A1F33BD18E38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 480ea8e78b7122cdf46193c331bdf8048bd223bfdd1864c9890794c64b53d164
MD5 4432c9b87fd7ba8ed95957c61a8b3afe
SHA1 396609a6685236a2ad7f8ea16a86e7c80af5889e
SHA512 b7e58156fae6786b569f4e2ba1b0a27c40e8a5a6c848f12b1650b45acd7f46059356a3deb373ace49530c156d68272845b55e1f41f91c79af179585907370f48
SSDEEP 12288:tYvYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:tfpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T10ED4231831A26896FB1DC73565147A4F25B9FC83B1FBA56D7ABF0400A9C7F80E3052B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 1acba56d08694bba0f8f612584935f48337f612d8bc3b23e19e67f94d1c42d85
MD5 ba9875dacfabc4ee3566caa75f3a568b
SHA1 5a28715d110336f804836feb21b569a250dd54a7
SHA512 df382046f206b5b0f5a5e619871f712138f7829f0fc33613b2b37284aaaa14149671cbaf7313e10e82e54f1b8e5dad0a2cff4ded0d6d401ca89ce4f8af21b721
SSDEEP 12288:VQYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:VXpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1D4D4231832A26896FB1DC73564147A0F29B9FD83B1FBA56D3ABF0401A9D7F80D30517A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 cd49f4af6a7e93f7334f5c6d81682f18c95704160e5d713ada5735afdf758954
MD5 354946c68fd4a7c96a046a94d16c56d5
SHA1 91337c84b9c7fa319ae6727935b1414d01d0dfa5
SHA512 a663b766e3bf8d486731d0db8b6974393998af8564886f7fd8c2d7095b763a497e124c435141fa569b97bcdbd7906ad365cc52071900521875d001019c98c140
SSDEEP 12288:WTYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:WspD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1B7D4231831A26896FB1D873565147A4F19B9FC83B1FBB16D7ABF0500A9C7F80E30527A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 9e8e48251248df027a425385ef75cc567558f24436106ae23e23fb198cf9b86f
MD5 ccb0d8a7533a650fd7c4bb19b0563365
SHA1 1f1165b961f43a2223d2e2b62b2e527296533946
SHA512 aef1834e627f3bd61fbdccb2e442ea0ec6bfcb05cf5417a3743ec6fc65a8b3d29ae8096b3a04a2551f192e4b06a258bf41660bf4ff674cb2626341cc89b53316
SSDEEP 12288:NgYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:NHpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T106D4231831A26896FB1D87356414BA4F19B9FC83B1FBB16D7ABF0500A9D7F80D3052B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 52179b29bc92af63385d41ff89f04914bfe4549bdb885a16882a09ef6a3a8cd4
MD5 923487130ca78c8f9ce238be9e3299bf
SHA1 a756dfb897906d479b9f590d772ec74eb7fc6589
SHA512 c6958c97f561ad709792de26b2624a44de90beedab7c23f9cc2ce2f03a69535a06cdbb4450c09ce3b04d0edf6a6b6f0bdc33e0882323f1eab16818bd681b59b1
SSDEEP 12288:GJsfRYYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:H9pD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1DAF40119E29411E8D12E9235C7156A06B373BC5193F2E3CE22E1F53E1FB6A809ED9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 e2ec2857de0c742bcd9eae93fabed4f8d38a40854224a59bbf0ac2fc14a1b32a
MD5 8271bd0c0a81fdcc3658a3e752224bcc
SHA1 cb9e5ed5ba09bd829b649eb0f0c6c6d3be22205e
SHA512 5105994d260fd58ba3e0501ad09d3008d3bc620c04256aa5d3af97ccbd047762d3b197aa14979375847236df3d263a0ee0a7e839fb11db8c9b084af11797dcd5
SSDEEP 192:KmVcylT0xSyX8llQglln/166SyX8llQgllV:tcylTtQ8llZll/MHQ8llZllV
TLSH
T1C072D957E7D0F942C8A30231D8A5A3FC63A8F5A4DD034B77728C224DCC689858FB2685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 aa520e5bfe723c4bd9cb348ecfcac4fc810c3e7c039f4f5a359068b09ad4e26b
MD5 e3f5db6ca05bfe01b6431924d4eb1e2c
SHA1 f29b350fee8e43ea6bede2cfa562cf397752bd11
SHA512 f2481a412f09963529bbfe6f35b274316e773621b8ed0d3ac18e83cc9d99f4266e2c736ce0c641c0242648cb23c22677139a6b39f4f91a1b2200eddba6904834
SSDEEP 12288:RI70YpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:KDpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1CCD4231433A56845FA3D87342418B61F256DFD82A3BBE19F796B0505A8E7FC0DB2123E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 198ef1fd72bb74b9a4b79a6a5c55ec14b85acc9d0a5f9b96ff02394cfc9ca51b
MD5 af8388dc620313cba66b078bb8242050
SHA1 0bdb39f947b044d8998eb274605597d19b9a50a0
SHA512 8b20b7832bf7e1dd05079ed6d34da06e3b159eca7aa8be17d8823d58d54260c63cd78e4f5be26d0dfe2ad99ac2651ca3974060c0a8559cc3b1d390ab5be3e835
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYmpD3eBR8nvn9ZyXLYKM/s7q:ygb4mBIBhGFnJOBR8nv9PU
TLSH
T13165AF1E22EC02F5E1F9D2B8DDAA4417D6B278161332D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 3cee7156ef314629fd752a8e24fe058de95f6b146d84d5b193fa2f0d4c8def36
MD5 03f948a8e83e8175185788d04fefb6e3
SHA1 618fc6beb3b410fac50afa4d2f1493a2cbf02fe2
SHA512 d1b518662633bd48eff910f5232c620fb566e91dc38626aa3da1a333fe2b0978ca727a86585656b1133adfaa2abc674658bc45d7f04baaa1465a6c97f3783e84
SSDEEP 12288:MaGFYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:3GapD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1BFE4122C31F23494DA3EC3385420B51B34B1BC81636B61FF29FA95259E96ED0E339D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 c6c0975df68b92f9e22546f8bdfbdfb5db66d27525db17589170791b4c522b58
MD5 823e7bd8371a2f2ff53bcf601145faa3
SHA1 26df56cbfe8878f344fb8b40a9fbc176c3fa3196
SHA512 b95cc22eb63db841bcd0d5bdd4ff5dbc67f8588f4dd74fd5b573b838496a4f66dc57b233d408b7f22f9dffce0027f6e3267b1815cfb7729fb9db62faed0dde7a
SSDEEP 12288:C9YpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:CSpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1DAD4231832A16886FA19873524147A0F25A5FC82B3FBB5EF75BB0501A8D7FC0E73517A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 d04d7b3467b13b9a692736696470f0516c1472d2f8a6f8524a1023ea36a95372
MD5 aab7a3bd3d0e17f3d1f52617e939633a
SHA1 941744bdcfc461e355ab3788fcd755ad7a973131
SHA512 584444fc7e1c4f68429a9c19c3af138a75ec7303f326419c4dbdddb00cd18ee00fa7aa3410fdb17b9830767cf3de1ffd89b97aab0903412f9c6feb120fa8234b
SSDEEP 24576:7U18u8FpJqH1Izria7/m9pD3eBR8nvn9ZyXLYKM/s7q:AKZFPqV3a7/AJOBR8nv9PU
TLSH
T1A435F12576E101F1E47BD13889864667F6B2B8121375EBDF07AC8A511F23BE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 17a7b323c1b4d067ad66016da2055e4d7c4efcf8361f6bad58e157c93ac0bdca
MD5 e8dc4b582dcba609cf49bdf551a4abcc
SHA1 689154a7e702b6a7a3d8c3c34d456cf19064a853
SHA512 003d2b29a681a473f45b36f71248c89db7318ea79d5ed1da4ba63e3b03295e6034ccfbc8af31a59698805180921337e424e5e0eb0d2f0e432978595d94932e29
SSDEEP 12288:vHvUrBFrEjwaQV7YpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I43:vPUr+NQV0pD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1D105F12E22E918E5F67AE13D8541970DF771B8521313E2CF02E1816E5E67ED8BD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 b631b52de03f160af07cb00e04b977a15f12d89bf653ab5f12a3321f79f8a4bd
MD5 89dfaab102f7e0f9909dacd784496769
SHA1 d5a010c8a749ccd7246fe007837d0ae46d56d560
SHA512 8901a4c14b609faac84ea40d09bb140c4b39cbbd5b6edcfd2bcb38c884a3d46eec2ee0fa33776d2cd10780b3b11966bc4df764afce39c6c6cc457e4f24090a5e
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzJOBR8nv9PU:+G05lO43bISR8nR
TLSH
T1DDD5CF6E62EC11F9D1BBC17CD9864A0BEBB23815033556CF02A486A91F27FF4967E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 e9a317e65966db9c0353f3d49f794da8f2275e42c80aaf645c57ca348acadd9a
MD5 99fd07a15b12a43a0b31e10544c56d2c
SHA1 4f0b348ad44b1c84597ed07bb9f6f77442124c99
SHA512 2a83853e26c3ff19ed08b1274396d395ca5d31cb46469724b40be78b0645ab4e359f09d9c663662105e79f742c2d867abbb761d5de43164ef49d952e53a70c0b
SSDEEP 24576:Vsa5POZ3dpbWVM50JicR2hG0lasx2+47eidnopD3eBR8nvn9ZyXLYKM/s7q:Sa5POZ3wJt2pasx2+mOJOBR8nv9PU
TLSH
T16A65BF5EA2F800D5E579D17DC583461BE5B1742253329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e7bc3180287033b19df8581edba0c58cb3ca5267bd261d7638dc4516371c07ff
MD5 b237fd69da7387b7406a2648ec448c42
SHA1 a076c2295ef1090b345db790b7618c90c9e1eb3d
SHA512 96866ec3b51027c3a3029d8737ba6ed163d409f12cdec44aff8a2fa0c8bf3e92fb10f1921efe9ce8f039e7f5bacb96dd55aeb9befd6511d182db3007f87d55b6
SSDEEP 24576:ZNcwHdjbyQ4nLC18lb/EOjowL7FkNpD3eBR8nvn9ZyXLYKM/s7q:ZNc/zEOVHF8JOBR8nv9PU
TLSH
T149858C1623E901E4F5BBE1BE89779546FAB1786513348ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 1304f06e394a76a48a4e9a2b272413b1eb325a73ca38f0cb0a510ef60e722ad1
MD5 726f77e08180919e0355796738f86051
SHA1 a44bcef2778edebcad6c43a2fe00e5fce917ad25
SHA512 90054a4ed7d19b08b75f59e865c6cd2e75e88428d33e10c4118b1f719ed2cbef9537bcf22cf340198837d45d0ecca1b544f9fe9caf1d99071e46aff39793d8be
SSDEEP 24576:+JnJPbzB4SEpD3eBR8nvn9ZyXLYKM/s7q:+JnJv6SEJOBR8nv9PU
TLSH
T19415E13DD2A810E8E4B7C2748119175AFF71386D2B2669CB29B4D5343F52FD0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1b609b1958eb7bd0d22e03209565fe767a762a8bb81d95da75cafcb894b2e2f2
MD5 9f69d88d5527011fa25fda98fd3fb29e
SHA1 9cadf4da25c52872ba7c82a1b52b24439aafb08a
SHA512 d725d30d1ed9fb214da870651ef7fd5da2ffaa90910f1f9d560b7cb0b2b5d8209aacb1f66809194637bcb732df8a51565fcdf959b4ba53619f9bb37af2ead8ff
SSDEEP 24576:/CLHGL0MoeVtFumTijCmlKQWDkQpD3eBR8nvn9ZyXLYKM/s7q:/CLHGeeV5ijCmlDWDkQJOBR8nv9PU
TLSH
T102A56B05A7EB5184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 3cb337c3f36335a2369a2f047b2fb2d6a3a063f6a6a39d1d8c0182a674d09153
MD5 10bcb3ee47b791f86fda03d68ec69c7b
SHA1 f395adf8ea66c4c68c4f83a8bb2e3f8dd27df489
SHA512 125abb6da8c49caf83e84bdcbb63cbda7314898114f69f2e269a9ab3ed2141058a4e1debd219ecae627dc8a759a0fd462a53e976db7b66c7a97d5c8fa7bbe3b3
SSDEEP 12288:K1Hck6j5ZI7NxfYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46q:26DIJmpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T14E05021C337610F5D12BD03D85820506E2B2B8A193676ADF17E9C5799EE3EC8FA38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 9a211d6c9587307ed89b56bb1a6629deffce097903060ff6cf10c75ac5695194
MD5 29cb351fb6df049e8a3b19b252d26c75
SHA1 43fc4aec164c6bdcfc8b0e64919d86fc7b511a20
SHA512 33afe2ca97caae31a08dda590706d0fa90a43e4d966efa2eb3e6185d40cb74682171a7e4dcda864e7957a8c89b6160475e0d334fac8649fdb9e48fff20c5c385
SSDEEP 12288:SG6ky+YpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:btyJpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T1FDF41204239474D4FA3943389921A2565A75FC016377A3DF35E2A61E6F77FC0EA30B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 414216ed90226db21f0aa671d0d1839d0928590a0c50765b016137f07ca5d145
MD5 5bcf33dad88eb7c3976890fefff8d589
SHA1 c153cd544680bedd3c9a01372574548fde32cd6a
SHA512 01f723d68c5654a2b0fe7a46e6fd35fca39773215ac87d78819e772a6d26acae0d1fc70d4ae447b2863b1ca29ae5846689277102a99068f4dd9cb687e74fceec
SSDEEP 12288:AKmYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:xRpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T131D4232C32A17885EA19C73920147A0B25B5FC8273BB65EF79FB450199D7FC0E331A69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 2eebd86eade0efee652b15f5e1cd7c9cfbd37e7fa08a5212e5cfd26ec142c187
MD5 716fd66b139e08883c6bbc5b7dfd8a4b
SHA1 ddf40aee82ba80a387b87af8fb40e45e12f10481
SHA512 ca531e2963bb428cbe8016f2516e786f46961af876e9fb17847629923378bc118098bf2b019c08856ba5e49ca813834f74c6eafac65315ce526bc6da91244876
SSDEEP 24576:prgaLoTfaidZ6pD3eBR8nvn9ZyXLYKM/s7q:5gpTrZ6JOBR8nv9PU
TLSH
T158558C1D73EA05CAE2B2D239D8625493D633B4315372D6DF2458C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 4adc2fecb83e8ef7422e1bf96293c5b087b2912703a3d2b935b4723bd11afd34
MD5 e19c413252ebcba520a60b3f9c172be4
SHA1 3bd8a131cdc2e5276a88349918f76d9485fc20f4
SHA512 a90bd759c4ec9f4f502944f39649e023e91305adc825bc00d142854acb4a54447f288d0279adb049229202039add3cf05e3f67dff73bca80c8c82bdce78775dd
SSDEEP 12288:jpJcm8CNrYpYL6+tO9A/XlhtR8Y4nMBQOQX9kQU2oecCcoQw/v1IMM4I46b7q:jrcmREpD3eBR8nvn9ZyXLYKM/s7q
TLSH
T12205F11E72AE00E5E17BC23C88414606F6B3B861636367DF12A2C77D4E57AD8BE34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 04a776bc2a0bd35080b1cf4896d931052759f7c567547d99081ac3957b15c85b
MD5 08c2dc9e6d9a838a036d3c2e3d7adf85
SHA1 36ed80480e4e347c7a2f3c6af8f69b47cc5a0948
SHA512 14b51fc6f92232bf03cf9810e897163a045110ecf95d5363459faab0967e7b35e96403a6ab066ab1caeb486fa274c18101f5b429a7b2e23c5267b27bab8404f3
SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3OJOBR8nv9PU:j3Upow8sBnSR8nR
TLSH
T1D7A58D3DA2E810A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-577-0x000002472E7A0000-0x000002472E806000-memory.dmp

Download

memory/200-578-0x00007FF7DD690000-0x00007FF7DD7BF000-memory.dmp

Download

memory/200-575-0x000002472E7A0000-0x000002472E806000-memory.dmp

Download

memory/996-28-0x000001C168B50000-0x000001C168BB6000-memory.dmp

Download

memory/996-25-0x000001C168BD0000-0x000001C168CC3000-memory.dmp

Download

memory/996-27-0x000001C168B50000-0x000001C168BB6000-memory.dmp

Download

memory/996-26-0x000001C168B50000-0x000001C168BB6000-memory.dmp

Download

memory/1000-565-0x00007FF7DB840000-0x00007FF7DBD47000-memory.dmp

Download

memory/1000-566-0x000001F836FB0000-0x000001F837016000-memory.dmp

Download

memory/1000-564-0x000001F836FB0000-0x000001F837016000-memory.dmp

Download

memory/1000-648-0x00007FF7DB840000-0x00007FF7DBD47000-memory.dmp

Download

memory/1140-508-0x000001CF6B800000-0x000001CF6B866000-memory.dmp

Download

memory/1140-507-0x00007FF687810000-0x00007FF6878C4000-memory.dmp

Download

memory/1140-509-0x000001CF6B800000-0x000001CF6B866000-memory.dmp

Download

memory/1140-586-0x00007FF687810000-0x00007FF6878C4000-memory.dmp

Download

memory/1292-37-0x000001F191F80000-0x000001F191FE6000-memory.dmp

Download

memory/1292-35-0x000001F191F80000-0x000001F191FE6000-memory.dmp

Download

memory/1292-36-0x000001F191F80000-0x000001F191FE6000-memory.dmp

Download

memory/1292-34-0x000001F191D60000-0x000001F191E53000-memory.dmp

Download

memory/1480-11-0x00007FF7D8BC0000-0x00007FF7D8CE3000-memory.dmp

Download

memory/1480-13-0x00000206B4590000-0x00000206B45F6000-memory.dmp

Download

memory/1480-14-0x00000206B4590000-0x00000206B45F6000-memory.dmp

Download

memory/1480-64-0x00007FF7D8BC0000-0x00007FF7D8CE3000-memory.dmp

Download

memory/1480-12-0x00000206B4590000-0x00000206B45F6000-memory.dmp

Download

memory/1536-113-0x0000023802CF0000-0x0000023802D10000-memory.dmp

Download

memory/1536-136-0x0000023814190000-0x00000238141B0000-memory.dmp

Download

memory/1536-89-0x00000238001E0000-0x00000238002E0000-memory.dmp

Download

memory/1536-103-0x0000023802E10000-0x0000023802F10000-memory.dmp

Download

memory/1536-102-0x0000023802BF0000-0x0000023802C10000-memory.dmp

Download

memory/2116-263-0x000000000F940000-0x000000000FAAC000-memory.dmp

Download

memory/2368-43-0x00007FF6FEA10000-0x00007FF6FEB78000-memory.dmp

Download

memory/2368-44-0x000001E994EF0000-0x000001E994F56000-memory.dmp

Download

memory/2368-52-0x00007FF6FEA10000-0x00007FF6FEB78000-memory.dmp

Download

memory/2368-45-0x000001E994EF0000-0x000001E994F56000-memory.dmp

Download

memory/2368-50-0x000001E994EF0000-0x000001E994F56000-memory.dmp

Download

memory/2492-526-0x00007FF6216B0000-0x00007FF621845000-memory.dmp

Download

memory/2492-527-0x000001BAA0E70000-0x000001BAA0ED6000-memory.dmp

Download

memory/2492-644-0x00007FF6216B0000-0x00007FF621845000-memory.dmp

Download

memory/2492-528-0x000001BAA0E70000-0x000001BAA0ED6000-memory.dmp

Download

memory/2532-525-0x00007FF75BC10000-0x00007FF75BCD9000-memory.dmp

Download

memory/2532-439-0x00007FF75BC10000-0x00007FF75BCD9000-memory.dmp

Download

memory/2532-441-0x0000028279E00000-0x0000028279E66000-memory.dmp

Download

memory/2532-440-0x0000028279E00000-0x0000028279E66000-memory.dmp

Download

memory/2800-557-0x000002368ABC0000-0x000002368AC26000-memory.dmp

Download

memory/2800-556-0x00007FF6DBD00000-0x00007FF6DC1D1000-memory.dmp

Download

memory/2800-647-0x00007FF6DBD00000-0x00007FF6DC1D1000-memory.dmp

Download

memory/2800-558-0x000002368ABC0000-0x000002368AC26000-memory.dmp

Download

memory/3408-643-0x00007FF60F7D0000-0x00007FF60FBE7000-memory.dmp

Download

memory/3408-641-0x000002365A200000-0x000002365A266000-memory.dmp

Download

memory/3408-499-0x000002365A200000-0x000002365A266000-memory.dmp

Download

memory/3408-584-0x00007FF60F7D0000-0x00007FF60FBE7000-memory.dmp

Download

memory/3408-498-0x000002365A200000-0x000002365A266000-memory.dmp

Download

memory/3408-497-0x00007FF60F7D0000-0x00007FF60FBE7000-memory.dmp

Download

memory/3448-482-0x000002C08D610000-0x000002C08D676000-memory.dmp

Download

memory/3448-481-0x00007FF616FC0000-0x00007FF617704000-memory.dmp

Download

memory/3448-571-0x00007FF616FC0000-0x00007FF617704000-memory.dmp

Download

memory/3448-480-0x000002C08D610000-0x000002C08D676000-memory.dmp

Download

memory/3468-546-0x00007FF6D5B90000-0x00007FF6D5CDA000-memory.dmp

Download

memory/3468-459-0x00007FF6D5B90000-0x00007FF6D5CDA000-memory.dmp

Download

memory/3468-461-0x0000017DD05E0000-0x0000017DD0646000-memory.dmp

Download

memory/3468-462-0x0000017DD05E0000-0x0000017DD0646000-memory.dmp

Download

memory/3804-589-0x00007FF6D3D30000-0x00007FF6D406F000-memory.dmp

Download

memory/3804-588-0x000001F501140000-0x000001F5011A6000-memory.dmp

Download

memory/3804-587-0x000001F501140000-0x000001F5011A6000-memory.dmp

Download

memory/4008-645-0x00007FF62A380000-0x00007FF62A60B000-memory.dmp

Download

memory/4008-549-0x000002270BE80000-0x000002270BEE6000-memory.dmp

Download

memory/4008-547-0x00007FF62A380000-0x00007FF62A60B000-memory.dmp

Download

memory/4008-548-0x000002270BE80000-0x000002270BEE6000-memory.dmp

Download

memory/4156-555-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4156-474-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/4156-469-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/4156-468-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4324-576-0x00007FF71E770000-0x00007FF71E81E000-memory.dmp

Download

memory/4324-488-0x00007FF71E770000-0x00007FF71E81E000-memory.dmp

Download

memory/4324-489-0x0000014C086A0000-0x0000014C08706000-memory.dmp

Download

memory/4324-490-0x0000014C086A0000-0x0000014C08706000-memory.dmp

Download

memory/4416-56-0x000001CE35EC0000-0x000001CE35F26000-memory.dmp

Download

memory/4416-57-0x000001CE35EC0000-0x000001CE35F26000-memory.dmp

Download

memory/4416-55-0x000001CE35CF0000-0x000001CE35DE3000-memory.dmp

Download

memory/4620-0-0x00007FF733920000-0x00007FF733A76000-memory.dmp

Download

memory/4620-19-0x000002455D140000-0x000002455D1A6000-memory.dmp

Download

memory/4620-22-0x00007FF733920000-0x00007FF733A76000-memory.dmp

Download

memory/4620-3-0x000002455D140000-0x000002455D1A6000-memory.dmp

Download

memory/4620-1-0x000002455D140000-0x000002455D1A6000-memory.dmp

Download

memory/4708-640-0x00007FF7DFF60000-0x00007FF7E0203000-memory.dmp

Download

memory/4708-518-0x000001BBC8450000-0x000001BBC84B6000-memory.dmp

Download

memory/4708-519-0x000001BBC8450000-0x000001BBC84B6000-memory.dmp

Download

memory/4708-516-0x00007FF7DFF60000-0x00007FF7E0203000-memory.dmp

Download

memory/5296-543-0x00007FF709C90000-0x00007FF709FB1000-memory.dmp

Download

memory/5296-535-0x00007FF709C90000-0x00007FF709FB1000-memory.dmp

Download

memory/5296-536-0x0000024A991A0000-0x0000024A99206000-memory.dmp

Download

memory/5296-537-0x0000024A991A0000-0x0000024A99206000-memory.dmp

Download

memory/5296-541-0x0000024A991A0000-0x0000024A99206000-memory.dmp

Download

memory/5800-430-0x00007FF75BC10000-0x00007FF75BCD9000-memory.dmp

Download

memory/5800-431-0x00000273CB220000-0x00000273CB286000-memory.dmp

Download

memory/5800-432-0x00000273CB220000-0x00000273CB286000-memory.dmp

Download

memory/5800-515-0x00007FF75BC10000-0x00007FF75BCD9000-memory.dmp

Download

memory/6068-447-0x00007FF6DF200000-0x00007FF6DF31A000-memory.dmp

Download

memory/6068-449-0x000001CBC2360000-0x000001CBC23C6000-memory.dmp

Download

memory/6068-448-0x000001CBC2360000-0x000001CBC23C6000-memory.dmp

Download

memory/6068-534-0x00007FF6DF200000-0x00007FF6DF31A000-memory.dmp

Download