d8d69a0bfb1bf350324f67e558b958b0e921cb296adbabf5e16a6a30f1300b57

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Size 2.0MB
Sample260809-3v1l7axeqa
SHA256 d8d69a0bfb1bf350324f67e558b958b0e921cb296adbabf5e16a6a30f1300b57
MD5 92e4e622cdbc87172983acd7bd6ff90a
SHA1 bbfee061a3e66b6464baadd956ecf8d9aed4b659
SHA512 53ccfa1efba78f0e55ed70caacc24f16983bb26ca0062bb176eb731bed03df7243e49a610352b7e17c3a4f88e8ec04c91a79d36a21f0172f69845b0af382b3e5
SSDEEP 49152:05Qc3U7rZNnOT6Q3Umy2emp2AQgAT76sQuE:Z9QpqGsQr
TLSH
T13FA58D2AE7EC41E9D0F6C27589B39547E7B278194F32C75F0A615A1E1F3B6A08D38321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4876	alg.exe
4796	DiagnosticsHub.StandardCollector.Service.exe
3028	fxssvc.exe
2436	elevation_service.exe
3116	elevation_service.exe
4904	maintenanceservice.exe
956	msdtc.exe
456	OSE.EXE
4736	PerceptionSimulationService.exe
1376	perfhost.exe
2448	locator.exe
1808	SensorDataService.exe
432	snmptrap.exe
3912	spectrum.exe
2380	ssh-agent.exe
2416	TieringEngineService.exe
868	AgentService.exe
1940	vds.exe
1648	vssvc.exe
748	wbengine.exe
4928	WmiApSrv.exe
3840	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\de405b48a19fe9b3.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a4fe3f25928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6372df35928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca9cf1f25928dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000297509f35928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094bad1f35928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8fff3f25928dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeAuditPrivilege	3028	fxssvc.exe
Token: SeRestorePrivilege	2416	TieringEngineService.exe
Token: SeManageVolumePrivilege	2416	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	868	AgentService.exe
Token: SeBackupPrivilege	1648	vssvc.exe
Token: SeRestorePrivilege	1648	vssvc.exe
Token: SeAuditPrivilege	1648	vssvc.exe
Token: SeBackupPrivilege	748	wbengine.exe
Token: SeRestorePrivilege	748	wbengine.exe
Token: SeSecurityPrivilege	748	wbengine.exe
Token: 33	3840	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3840	SearchIndexer.exe
Token: SeDebugPrivilege	4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4604	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	4876	alg.exe
Token: SeDebugPrivilege	4876	alg.exe
Token: SeDebugPrivilege	4876	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 364	3840	SearchIndexer.exe	109
PID 3840 wrote to memory of 2680	3840	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1168

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3116

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:956

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:456

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4736

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1376

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2448

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1808

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:432

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3912

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3196

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4928

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:364
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 797466edec72e184b9b2eb29bcdaa2109c20e0d89af4f232b2e8b3384ccd2a08
MD5 b18e1ff72bc2e57925dfd94991e7ba41
SHA1 a2d5e072232ec3815303bbaed2a7021f2e25c2bf
SHA512 5a2c87392244336f11191d06733f78e0e2caa0de977690f8903e570035a5f2ef6e6177a3d09d85482d9cc57bd2aec4c8e6d88d826a8756161dcb17a1b1cd955a
SSDEEP 49152:yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnkAQgAT76sQuE:U3q6sjBiqGsQr
TLSH
T1ABD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 0bc0af1941b0a0ebde435e9cc4f226870e4e74efae6c02ba37fc0935e614adba
MD5 a129c91fb61429e571df3fdb18e0bc65
SHA1 0c08e2070f8a2b80166526f4789c2801eee6d259
SHA512 df288dad99ad5325509a67cef2742db1ea44236fdd9078db303ca86ca88c33d6d6070fc277dbc70002cc4b1cb2a52c88583c2710dd404c7f1c3db020b9a5e1b3
SSDEEP 24576:kXYfDtczAdAfYLH8AcevDN0FImbwQuq3Wia7gD:DtcCAQgAT76sQuE
TLSH
T18575F12963D408F9EC67813DCCB28521E673B8A54360E7DB03A49A661F332D85E7EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f020ea3f66aa09d434403aeffc05be8700cd5f4f3758594d83755e2c0441335e
MD5 9c58e40d349e85f08ece73f2cf27d3fb
SHA1 7ffe299cd363085366f6796c124668e113a1474d
SHA512 81bb0e966443f719beb3c584eb0d9454c203d3f9474ea5a6afd1d545c3860da7339c237a4ea1d8b460adeed6ad8c88ffc38117d74ef0f444c249446fbb724043
SSDEEP 24576:G0Le5ji0hmxxrMcAfYLH8AcevDN0FImbwQuq3Wia7gD:GPji0AjvAQgAT76sQuE
TLSH
T11B85AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d64d418d0675e8c1a22ffbeb2457c6eb237443fddc8b0595a0758ceb690462a4
MD5 cbc05a6741c2f84416549c839b8358b1
SHA1 6bf3114972242b2aebdaf8ecdb22489eebeb057e
SHA512 50796ddd12f5c7a5a4891d1f60adfd3cd118f21f35eb5a28f0e450a6b851d2c4ac06b93523a78aa37755bdce5cd1b7241ca62362b3a6507ec844f965f5a9b077
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWn6q8wyuSAfYLH8AcevDN0FImbwQuq3Wia7gD:Z/ezSC6vUzPveHjyDAQgAT76sQuE
TLSH
T1F8755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0115e09dfc6bb2706c0c8d1cd41ca0c479c65a36273dd578455a3b0c0076c736
MD5 fe4198214e652828e6c7fd8dd4a3ac4b
SHA1 add6c396c227f26fb650a9bbe68908c8531b1d10
SHA512 1d5d3eb39036e47557554dc25d2c8ffdb7fc19014b53a2861d051037730b586b5550c1e404b529f35134c323695c1ddd0eca864f72a4904c6cfa1c0ea502978a
SSDEEP 24576:uVbqPb88hv/l+YJAfYLH8AcevDN0FImbwQuq3Wia7gD:uVO88hXl+6AQgAT76sQuE
TLSH
T133559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 bcd81e1f7052026dff9d4a9c10f7af712fdb5e0d2dc6f378098bea0542f6985a
MD5 b2dca8c3598c6103e1f77dbf9be4d7b3
SHA1 76612d28511464c3fa5112f142f1da0576715d82
SHA512 bb6c8117d39b569156ee1e3a6aab53d9348d64aa4a13de0604539ebbcbe9fe3266c99343277551b5e6829e622976b4669378d120ec20543df8dcd11e87c21d55
SSDEEP 12288:yLYAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:yLYAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T149552357864C70EAFEBBD1369CBBA5B963D1BCBC8284979A04063BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 10b03299048f24a0173c3bd1b1c1549ba1115ae8b6fae666734f83b8d30c2306
MD5 779c4f5ccfea900c30c65f456ca67903
SHA1 a7790008a76181d1be24815166422c98169eec5a
SHA512 b4b732440265c1cf825c0ee1474b881203ef918a7c4c51c41663787788e8a79bfca551c321d74784748c152b8096d56f8eb0fe67bb1f8201c0841f0a5de21b21
SSDEEP 24576:bJIUhAfYLH8AcevDN0FImbwQuq3Wia7gD:bJIUhAQgAT76sQuE
TLSH
T11375CF3BEE28FCE2C67E8D795A918600E7B278704B51A3CBD165830EDE235D05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7baaadd8d9b989bf8cff36d4a85398197d471584d6192646a1fb527b944fde33
MD5 15def5f4fde86376d0a039d0831f0db8
SHA1 a81c2a68c2b407540fc1a611c83f5dab53ea08aa
SHA512 285225007c21ee4813adf0ed1312fbcd5b762fc8e9fa45f7c208e1d6ffd08ee09942fcfb25db1a75d7e375c4a0671b62418511c70af52ad4ef0dcd74d63a8f87
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THK:MQvGAdlCEL8c/DRNw5C7qGsQr
TLSH
T11F266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a03920c08983a2dcdb749e4cfb15823fab98b600c1ef9e6f7cf122bd2d9eae78
MD5 197829083c830a8ba6b4b640e2513275
SHA1 ff11b4e81c6944a9b7b11eb358e76c343e9a31dd
SHA512 fa37b85c1fef2595761ae330a3b657a8f58c1aabf15b32128ec95ce4d3fde4d3d68f07cc532ba8ecf342513bf03fa14ba3adfd804f1e3e1adbe143a291c94434
SSDEEP 24576:K0ewsAj/AfYLH8AcevDN0FImbwQuq3Wia7gD:Llj/AQgAT76sQuE
TLSH
T1A775E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 323bff991703c315503f77ed1359327ddce8f164d3ddd8fd60b4d2ded638ea40
MD5 567a7e80c9775b56dca90040c89ff773
SHA1 b0e162901c5529da213e08f95e472ba422b6b33f
SHA512 8abc4261bae6ba30fa6312fb6cfa394016089b6002b60b2d47d44d58d225241aba9b32dbd775f5f4d45226460bb94c4de723267e740b1cab05be5d72a55585de
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHmj:cUEtQevvqc2W1cpV2tI32
TLSH
T104474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d26099e6fe817bd0837c9a41f2d82d079d59670ffb170f0bce833bc50be8f7be
MD5 59404471f451e7d0edf65cf041112d6b
SHA1 8c02f70895cb130e9268252020b9ddea257a0555
SHA512 b5d98d336a65b15de2b31f727a8bf789bb702919707795cf49ce43beca31fb86fdb85744a87fad7eb004424eb538a2a2f1acc0833c8cd18a2f1be14553af20c9
SSDEEP 49152:0CbRquA/m2yL5zTfFiV+XenmE3/zfAQgAT76sQuE:doquVjnm/qGsQr
TLSH
T1EED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 87f0b7d7434fb3980e874ea4e22f7729c80a1e905a54060bb811ef3679789306
MD5 331068d31ea0720f48f486c0e9ed8b89
SHA1 fad538a5d3a29f6975d0eab96c593a0b0373a29e
SHA512 5a74e76815563b617f30a536bd913dbdd1159ae639666b16d60068b7d4d8db4c1415746068f3b84a60464ab33fb308a54fea62a79cb6b3fbb4961b4afb9622d2
SSDEEP 24576:3AhGL3IFoiwtA5l7S53GAfYLH8AcevDN0FImbwQuq3Wia7gD:3AMUFoiq52AQgAT76sQuE
TLSH
T121359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 6377cbdcb4a7b7cd8a02fa35c23cd5722457f16f2d0dcc2784c0dc3e4dabb31e
MD5 3972b0867e3df62063d944aa4989bfa6
SHA1 2a5ee6e55a00d8dfc834345d49b87aa43fb36a3b
SHA512 09b0f13cfae5e7538cd6dd20d3ccd28358e97ad243bf68b3b4edad1b58596ca42abc2e97c2151b1b794aba6703b55ba0234549fae36cf59595884959cb991889
SSDEEP 24576:Bwu4OWjAfYLH8AcevDN0FImbwQuq3Wia7gD:BwvOqAQgAT76sQuE
TLSH
T1E765F14A76A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 93ff55eb0c8a4772bb3db1817d0d585d7839880ee357e3a4b0bb8b2ab5a84cdf
MD5 241089f163bd6485b75c65956a90ba7f
SHA1 d9b90f01994e8ad87e50fd9b437e8abc6d3aa254
SHA512 6c1db09c8562d1198b34f03e93468aba9022b9e749248faa007e9b8e1e51622d42dc8359038d62af1af533cc5b009cf2acb5a4e1cf20416db10bbe6551be6154
SSDEEP 24576:oZu0AfYLH8AcevDN0FImbwQuq3Wia7gD:qAQgAT76sQuE
TLSH
T1D955129B239830FAE5A7C239CCF25655E3B278A6532183CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b2655e136f1c462f27678590e45f6b1f3356a297d84a93681fb67e6a25738358
MD5 f71086c0d55e89008cf17ac8e62cd745
SHA1 13d74e94e88c3df42721c34964538eaa3c233519
SHA512 a7490fa25e757c07ca48314d1fdc9aa39bf843993edd85a9152fea20cdee84630ab3c9cdb8e5ece66b913ae738aaf6bff208f795c1ca478091369fcd94501e1e
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Um:YQRQyi36YOcPbLvw2gAf+PN3eqGsQr
TLSH
T1AD667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 656e6c1e6ec401cb4a155fa74f8eee08f8550ed2b9f828214c8a4ba4b639f114
MD5 649b3e461528533948906a554986b4be
SHA1 3cde1a9e77c1a2c5c075ca8811a01ed6b4a9fe51
SHA512 c466ea9c057d48e4a5474f3a78ed36f44238f53d54dc64384aebcedf2d178436d2b8cfcbe1c8abf43b925c7c7d2d5d41eaee7e79a53b4c6a4b046531f34b6564
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Um:jQRQyi36YOcPbLvw2gAf+PN3eqGsQr
TLSH
T154667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d55f4f204fea421c76d0adae3c625b825aac3294b18a4691907c031cbe663a01
MD5 2e1031f620dd9d47d272fa73e7c29739
SHA1 e0abf0f37220c6acb027fa653c3cafdcf06973dc
SHA512 bd530b202743f909ffbfba99a69fff6005ea8bc0dc32d9450b75ce14a3dd7d93018b3bd0b4a968c18710e44e09f2f79aef930ae79cc435dfe572c2f3545465c8
SSDEEP 24576:EwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0kAfYLH8AcevDN0Z:q68Qg55nhceWu7PNU3/vAQgAT76sQuE
TLSH
T1F0B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e8d1e721f3c2c8051f3516da2cd741ea0bef9e471cd75bcd788a1e7df0f01814
MD5 9be051370a17f18889d3ab8be0fb2c1d
SHA1 f2329e5e4710fe7d3f2a0ec34a75cf6c9977ba6c
SHA512 77642421e55a0be345f7e232528dfe058b26626f53648627bc80a7761c33c84a4ec744fb1263e8af930abe261e0863639424405e710a11f3a2a8b82df59a52cf
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99c:7y5112gYy5azzVvt69nLKnhZtqGsQr
TLSH
T148167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 770d1822de42ff704bc7c34d3275b7208bd51582888b2c5580086742dfb980ba
MD5 d9a1f6bdf55f547a254d26ac4a4ae407
SHA1 b3fb1679adbd03fd00133f9167f09df4c5a20de4
SHA512 1f3db0d032efbcbd56d218ad8b5a2803445b82778e9f84be2206495ed22203cbfab1e51eb5356bd9ad5e3c5d1a6147317253d5147cd5479f7ef54a15a2958ea9
SSDEEP 49152:eB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glNAQgAT76sQuE:Mu6Jmdxd2d2qGsQr
TLSH
T1DAD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d7b7c6f478e1869ba82241e3bd5ecf9ccf28939967ca3b2f9f4ef203093e87d2
MD5 e7845f45f51e1c1cb9f268555a466117
SHA1 deb908679df073dbde3a91fad62a4050921c9dca
SHA512 df1d3d96a0d780c002e19654b0eecad7561ad5a849d93515293c2f9bbd0b1c038fe600726f5418b4dcfca314b9c8ee47ff8dd18ef2bc9025df95dd554ff3c427
SSDEEP 49152:F1hpsNoJpF1A63U44CwH7R4xBAQgAT76sQuE:FmifPWR/qGsQr
TLSH
T15FB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 da40765c8e6d9487d0438e60a01f448ca798d98b6b36340b39c0dda9e52a35a2
MD5 5e9050e01aa847f1a6d15aeaf52ea47f
SHA1 8d27ae232d4349291cf50f175f17a0a381f11843
SHA512 870ed016d29d709ab3bddb7a026608358082b79af21502016d2bf12aa5580fe767fe85aab765643630026a6b3cc2d7f3a7565c670050905a60001ec5fa4b4928
SSDEEP 49152:NSuZQIY0Be2KcRVtOnks6NMHq0AQgAT76sQuE:D5dKii61ZqGsQr
TLSH
T1C4C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1eb18f723c1a6e3ddc640c75f0b30cc1476dd8413306b042a8301f7de4ffeb1e
MD5 cfa9934074acecb39cec57fa5e443262
SHA1 f05661f1f90dbc3e7e1ac6b5f7cb12e41b76e340
SHA512 4f3d0407d60a321f8df80497f5f6436ddad8456a7830bb997749a6e0fc2406187ac09ac9ae7ef2744b79fa99a4161a7c88f13893e1fd7351f12cca83c1565c68
SSDEEP 49152:5htSn8EApI0fig3giDn0AP5wdAQgAT76sQuE:IX2imphjqGsQr
TLSH
T12795BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e19ac47c9d463cd2c3e661d644dc26a205ea11bf2d77cf1c9f978af179300ea6
MD5 e00626e03e05358f48fa39f96614f25d
SHA1 62c3f0aaf0922fd954baa1e913d938abbf4ad6b0
SHA512 b4ddca315fcec923bd8c821cf739b45bd183c1eec698a251cb95fae8bbb0149642704c953322d3a5fd4985af3234ea7b2faf3a559abaa13cfb8c46a512436c78
SSDEEP 12288:sQAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:sQAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19F55235B594C30EFFCAAC1368CB7A1B9A3D07CBDD345939A110A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 36cc1385854f0eff1a7dfa83aded1cde008ff200186142a48443ad654e081bf6
MD5 aaf57a114df0d0589491ff1f76107205
SHA1 ddb497bb99e0f0a807fd11ddc0f5c66bdc727d56
SHA512 440bec33b86c98d2db1043a421a82eae085f4c496dc412fa30cf380c60a444e4b499bbccb915372250bfff888a6c40fa5aad0cc778c48126d69ec7df4a31c9cc
SSDEEP 12288:vLAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:vLAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13F55235B594C20EFFCBAD1368CB791B8A3D07CBED345939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 32640192787b31c51bb88bbb2f73ad520315899f19e62c90d2eeeac8fc26635f
MD5 5df46836075259469016860f145aad90
SHA1 8d7c9d078f77f58194c5887764fb2973e8f030e8
SHA512 09ece55f63f9a2ff3451563748409f850ee7e8c6f736846591d8eeaca40d9fcbcf9cc7188d38cb9cc8399a607668fd2fc176f40373a9cfb0298dd4deb61c0a99
SSDEEP 12288:h5AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:h5AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10455235B594C30EFFCAAD1368CB791B8A3D07CBED346939A150A3A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 10ad78a3259a6d22b3597929534f9c2d18f2527cbb8b7821e95d10ddede19734
MD5 6ee37aa4b6748c65858313dc7891fa1f
SHA1 8100e25251c456b2e9a5979272aef49499aa0310
SHA512 9823a0231106b24f70655db6d7077b8f67d7c2d4cf99388b458595ec103171d3cb47b04df94a698dfbf0b6517ca2ded83505f979634e420b5ae6def81c480203
SSDEEP 12288:LVmAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:kAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1BF552357175C20DAECBBD136CCB79179E3E1BCB9931293DF06011A8A2E3A248D5B4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 53a64fd78c53f5be3b6839207f4fc87c59f2bceebf58b376b29c66567d525e9b
MD5 37e2f9ab20f1ba1538fdc0800e9f3173
SHA1 b37f0c08227c4bd4ba70c26a009cb654e5085204
SHA512 96bc4fef3a9aa62b5fb215b37c1c9515b311d7fef864d5711f8a8077dee8c6f0879a524dbc7c8e6c729f3f81909060811a1d967322f68b218fc4a26dc5cb61d9
SSDEEP 12288:MuAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MuAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1CB55235B594C30EFFCAAD1368CB791B8A3D07CBE9345939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 79d296a79c805a7893e52dc8933b88ae764b12fb0383a594cbc76002fec42753
MD5 2f6fbf47a73e4916d7048486d00d5ba7
SHA1 77efd434710f8fd08159e8226c848c0b4654a2bb
SHA512 f58c8407807047447fa9a7bcdaa6292c7011d2641aef2bfcbf7abd85f315eeb8c1e7d45ebac51eb7adace09db15727ec5833925a543269ea754372f25671d3aa
SSDEEP 12288:y3AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:y3AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11755235B594C20EFFCBAD1368CB791B8A3D07CBED345939A150A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3e3df0f724af7341b9efc06dae30a546b4b24d05a57f8dab83c136d1e2784117
MD5 e1270a62ac7c4f4f59aed0ed7866bff4
SHA1 6169a54ba9d4718816b15369d27f7ea4257f1044
SHA512 91e065780c18849900fb411fe8c11f21273032c638303506237aa820e997b3ca86eab4e02e9014c0693e3d8843a9c4d4725cfa27471c81e533d01c478767d4a3
SSDEEP 12288:+TAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:+TAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D555235B594C20EFFCBAC1368C7791B8A3D07CBED345939B150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a9322d89673a5ebba8fa45ac6bcf7f718e355f9da7f258dab5f2f9d6040f24c7
MD5 52f56605857d142f17a23b3d9526f7c6
SHA1 6be774d5f4497092f327bdcc47afbd3d4116e3b0
SHA512 367953a9781f00639839be3a0d4d3aec21f35e6871f65d1f057f93e8816a952b19b4609757466c8026bf18fa1882f48dbf7d9e894faf4b716e3c19df586bf7e0
SSDEEP 24576:PZMRzFVSOrAfYLH8AcevDN0FImbwQuq3Wia7gD:PZMRzfHAQgAT76sQuE
TLSH
T130750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C2DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 78827c656e424393c18d32c9519821d6b63c989c87a64cb246f71424d2f53aa3
MD5 12d657dc6b64c8b93eba74c2ed73acfc
SHA1 b9506d7f0e8515ccfc99cb633f6831df6ac98ebe
SHA512 58e6cfbd982b954cf888459fcde70c3ce332309853f18b1b1b1af781a23f168a25751c48a35ebce8c8690212a3fe52437d3f78ba40ebdcd0ee7005cb6cf19ec3
SSDEEP 12288:EEAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:EEAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13A55235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c750d7808e2a1f632ccf2a57517bf3c1c833314ec9c15b7d3d32d8e83331e95b
MD5 6122147fbe352f1d9dd7830deb3182b5
SHA1 a2d1dabe1e0eb68f59c7ad4a1065194305b50d98
SHA512 566b79c5e6f30c89100a4480895acdc11876f982ec80eb82177069c82cda7819ebc05de0f43c1d01e93056c636ec218c993b060aa09e56dfc7b02c6ab79688e5
SSDEEP 12288:4oAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:4oAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15655235B554C20EFFCBAC1368DB791B8A3D07CBED346939A150A2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 04ef97c302af03dd4aa6293d0acbdc40034a8e599b0cef42062984a282383b83
MD5 aba5a7d275d192865c98a00a0ec8a74b
SHA1 506da15ea1df7970a38ad55c55b68c3859ff7ae3
SHA512 66d2e3bfeff199986144e129aa1bb62cf866940c52481c5aea0f288bd8e9b964ec72464ab03f6cd2d9aae1228572dc5c0311891e841d0f27ab1fa8a544349f91
SSDEEP 24576:IzyPAfYLH8AcevDN0FImbwQuq3Wia7gD:IKAQgAT76sQuE
TLSH
T19C65024763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 701f656985d9b35aa85c283711da7ef8ce7ec3cef909c82a1d8d95a694b095fb
MD5 b5fe59e76ab29ad42223e2f4fc619f01
SHA1 0b283d990d465a3399295ab2b159471646b5d5c2
SHA512 49287d5e819e84c22263516a52f59c53b6a15bd14072dbc8eafcb9d647ac1ab75cf8cce1f637db3f6eca53d189676e31aa8bd668bbbdb864b2caac70d10f9485
SSDEEP 12288:9EAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:9EAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1CC55235B554C30EFFCBAC1368CB791B8A3D47CBED346939A150A2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 bb77d6abb44b0e336ec2176cfdb7a3e13e6bf8dc836e4830df8b7ec1d6d7bd4f
MD5 c16e60fb805f74d2054cf876b8bcf217
SHA1 caf7d8a05d08e0e65366e7aa0fa00d269cd44de3
SHA512 f3c079f201a43ee5e99e8544cc1b0c37a37f1c77097dd34b2b758996855810510ee9fae67a1af11b88edd3fd12e6de5323ce713152821c9eca9588a7e86129a2
SSDEEP 12288:iEAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:iEAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13855235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150A2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a9fa7a8ccde1563b6f2857a3460c49b82ac4290f05f93be59132b7e5d611b48f
MD5 0518aba0b49fde50b0135ebf232176c9
SHA1 a03e8df9201bfb5433a5a4aec3e0b35e0f1aa5bd
SHA512 83cce0b8c9131cc7b4cb36b32cf3a5ae747ab506ac6893c43391384f9304a8e2324dcccbc76668cc7927b4a8874dbba64a35b198af980a78219ed6b27c143f3f
SSDEEP 24576:ozyPAfYLH8AcevDN0FImbwQuq3Wia7gD:oKAQgAT76sQuE
TLSH
T1CD65024763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 36f90e5995aa606f218d9226aae13ed92c9f0af58e9da41dc907ddfc6177d7f1
MD5 9c58ae345cbc2e861906604121ab4469
SHA1 6e1f1ed25af1fe8896e2ab85bdf50c24948683cc
SHA512 1ac24133cf63533b617cf70fc68dcba6b4980f90e768f75c8b7008375814375aebbf06fcedd76dd7d8cf050106491756ad47bb175fbc220b5585bdede524f3b4
SSDEEP 24576:NcP4mcvIjkGOxhKP2l71SNKbrh/8KBMAfYLH8AcevDN0FImbwQuq3Wia7gD:yP4m4IpOO67N8KiAQgAT76sQuE
TLSH
T17065AE2DABDC0096D0BB913885668A49FAB1742A1F3286CB1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4cbf8c083fa982ee0a74f0e84cfb4ecca0bb61a631f4e91f7b55dea8accfa4f1
MD5 11e9c384c001637ff2e91c60c25971af
SHA1 404131b2187f224fb59ab215aa8f5dbab25dd28f
SHA512 f081701feb05c24505a014c0b12b2f1ab1706c98ff0f1baf52bf36f31a2cf91fca757c58b55376870f9d58f72f36ac6cca19e46fe63fad5f2d06855eeeb1a0af
SSDEEP 12288:cbsf0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:T0AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C265011AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7afe3d33eb0ac9702d9fc8f6746ed57a64577281d03c9c0a5eefce47e88598a8
MD5 405d03c4e9af2f3186f74091856f2661
SHA1 9d49281ad95ba12a3bd5cbd7293ca275ff405308
SHA512 917a9ac1be629e1e50c4a62deb1033d5973db3d781179e654a01a36de5cb652fb30f6dd114c8c7f5c3ac8870b8a5ab461412df55235e926111fcc4e6cca2c2d8
SSDEEP 12288:aUAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:aUAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13755231B878C74DBFCBBD2314877917873997DBC8B44C29B640A278A393D844D8E4E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8505044600248f94a9dcdfbc11910a14f9b260e87ac36695f00d801ff445c7ae
MD5 cee0f911e889e6c13f97cbceebfb31b0
SHA1 1dfea1c1cbb6dc3d3f9aef3a3312bdffe66070e3
SHA512 4a347a5f8d0a7a69b673dbded6292ca58f17a861ee7133f49a6e1b288b83c003b32230f1bbaf3460bdff0d46061df568c1613dd5693278d9aaa1b6fa01d0ba30
SSDEEP 49152:ea0h2GEkuAe73q3pp46zwwQuAQgAT76sQuE:ea0hNYG4JwsqGsQr
TLSH
T19B859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 fdafeb3edd5cdf76c85599bc01b2ce575cdfef7f5a5a94a020b0f45c1610d057
MD5 83ff919dd82e3487e709169f45a8366a
SHA1 1fe28eefb611a7fd1f6bdd3c407603f8728efcd2
SHA512 c7cceaf5932400edf082768208365cad7c118ca2bbb8844c2d903c42aeac78c93c8179c4ab5ca5cfa4e539bb530ded556e74c154ce75c5cfd1bba52fc3ac312d
SSDEEP 24576:shbHjP7AfYLH8AcevDN0FImbwQuq3Wia7gD:shbHjTAQgAT76sQuE
TLSH
T1B255027E16AC20D9F576E13D89A2854AD371BC79170193EF128282BE1F3BAE84C74F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e339d46bf3b5a2c4454a0dde04764f21280493098912a83b14bd06e548074d36
MD5 324146a62d7a1568e434b208dcaf6ec4
SHA1 4b872a19df6b5cb3f440d5f33943e4337595958a
SHA512 752e6d5edf2eec0caa55e9a15efc6bfe929e9d7d29abc0922841e027cab9a1f30a035ae6b0574c21335df8da93ce31c4d852520973c6554efff16e1d586a3db3
SSDEEP 24576:v3YgnJcRTk4yti+R5dpR/jAfYLH8AcevDN0FImbwQuq3Wia7gD:vIgnaTk46ppR/jAQgAT76sQuE
TLSH
T1CB45BF2EF2B910F9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE89E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 ad6d2abad5aa45e6d81ae20fb855e3a5ee26204b56732316ef749e7c97c17c26
MD5 28574b10ca8d057db6de524e6e846855
SHA1 c8b412e21bc54148f8d6a87159812704a0776dea
SHA512 287637f5b370509a722540e70ee99c21059700d30156a0207493eaae149e21e7d491cc7e33a943625045936776577a35ff5be87484ffea40b35213a51dee8f19
SSDEEP 12288:G4AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:G4AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C055235B464C74EFECBAD1368CB795B863C07DB8830653DB140A3A8A7A3E499D1F4D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 47cc06f9d5ed599c3dc98412a4bbe6eae6f14bfbe98da8e6534c7887e5123576
MD5 d4fddf0afb907dd0624c94ddf386b890
SHA1 7add15a0404f9fba1612a3f03199cd9467e59d8c
SHA512 a7c8f6682c795b8dec06ef9d8e5e596173f5bc5bc2c42f2122500397bc847cbe85fa13dec98127ce74f30bd20c0c51508e1bc42bb44a1b7c17e7b631e4382039
SSDEEP 24576:cbL3UTdAfYLH8AcevDN0FImbwQuq3Wia7gD:cbL3UhAQgAT76sQuE
TLSH
T1AA75F155E79410F9E87BD13CC9B28526E2B2786D0354E7DF03A84B551F236E58E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 967a252252be42f2ef7e02f7c54104783269715fadaee026f326719f6eb7d920
MD5 d4775aa45c87109b37f31ef7b992bb6b
SHA1 934d69368e0a8d990fdcb740bb7ca3f85ec0f8fc
SHA512 b3f07e3c720882094a88d842d858cd25ce46f6ad02d7d063c728a3e4b5093dbabb62d3a00cdda2d2b21614c86d865fb97afa47cb27967315f47063352bfc2d03
SSDEEP 12288:wpFtIOBAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:LOBAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17555021A36DC20E9E47AE13D89A3825DD3B1B875071253EF029041BE1F77EE89C79E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 667d7fad1c83188cff45f40fdc7f753c444560e29a4ad0e46c4291d6285ed7b6
MD5 4147f36289d57b17c18a798de0c7161d
SHA1 e9c2cdc1c580698af82ef092728f34e3632d4279
SHA512 6a0d54c5331d5faff49b2bd957c241699e3aa8e268aa3ed1bfbdf3e205e5bcc02c81b20b7a5643583d016bea700ece007c2f4ea1f8ebecd1aec3b5325d27c0ed
SSDEEP 24576:l7NM9YmZqmWMUkPjZM48Mv6bEhsEAfYLH8AcevDN0FImbwQuq3Wia7gD:l7cBWMpPjN8DbEhbAQgAT76sQuE
TLSH
T13F659E2E6BAC81E5D477D13DC9A28245F6F2B4611B318ACB1152833E7F37AE44E35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 c414a32098f6b62433afcd58a8c0706373dce5ff95c208bf4d7cd9690c728d05
MD5 485c96e5ef476f876ce8a72c9863cc46
SHA1 bd68d87faf337a75bef5611264557b7420bf6216
SHA512 f7135dfe83ae26c2bb34075ba81d96d1e4f67c9c24757b27690c4780b34b2131a788aa10f653edb8224e2e8333a3641161fe8ba6c489462c4ccab80e24788d14
SSDEEP 24576:OW6BApg2YuyuNDYTabvcRvNYf8km16AfYLH8AcevDN0FImbwQuq3Wia7gD:OF2YuHNETovcvNYf8kmkAQgAT76sQuE
TLSH
T173857E2A27ED80A4E0BBD27D45B7D146FAB2B8551B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c67ef5e06b68414f9a8b87f274fda6c0554f897a38c8c1ae7500046f89fcc126
MD5 18b2860a991ce1821159339580d851ad
SHA1 bd4ccba33ec882ad3bc295e79114f83f576f77ad
SHA512 9e0cda9f0f74b38f57217470ee9d7cc63dee2e3353a64e33116324fb3c8c21bdd49bbfb9356dc296ec782a062fe2e52372068cc835b26b0ca53155a8555fc928
SSDEEP 24576:5AFs06+OmlfkNXEbToVAfYLH8AcevDN0FImbwQuq3Wia7gD:+Fs060lwXuOAQgAT76sQuE
TLSH
T13865BF2F62AC00D5D07ED17E8997C91AF3B1746703255ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 ad8f9e3230ff4d9a7469bdefe26483cdb6249b5e725378bbcb646698b3582fc3
MD5 e3118dcaff2d9bbba2409a13794efdfd
SHA1 b72ab857ccd1e25dde63ab2fe9115df49aa35d16
SHA512 e5bbcd3ea47a7210755a662cd213958d957cdacf5a82309402990c9cb58bea0b9e632450d877afac531bf94ad915ec206e3f206b38c2e4faf4a5d3b3ee269c89
SSDEEP 24576:CJnJ5D3WtOAfYLH8AcevDN0FImbwQuq3Wia7gD:CJnJ5DGtOAQgAT76sQuE
TLSH
T14375D02DD2A810F8E4B7C274815A1796FFB2387D2B226AC72474D5353F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 486cad2f495bcc8fc6e646d8871c09305346491b7ffe8bfeeef93de720a31cea
MD5 f21be49de5670b942dac06f61e02f45e
SHA1 15ef53f16a1a3910bcd4e2b07cdc3e6bbc9dd178
SHA512 4f74fbac25084255cfca49c6396cf963d6932136386b7fe5811123e17a77411a23beb2a15963da9cb48ec027f6c746fd61177b84f8215ce8b37ee93d89ccec71
SSDEEP 49152:ao06DIKdwc+eQnSt65aVQAQgAT76sQuE:bTqGsQr
TLSH
T15B956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 c769bae09edef86fd6ec6a7139a58e56dafa0fb029f2db5591ec3a50f13897ff
MD5 f29f6afbef7e31f0dd42c2fafa2dc81a
SHA1 0a8b801242a661c2144645deebf37a6719c84780
SHA512 e766a81e97fc4efd65ac886fe63a81133475a387e639f6fee19da91d8007b9255b878eeb8e18c65ae646230ad86600153d94eaaf4cb3fff28e7e4bc2b39575f0
SSDEEP 12288:CEP3RryAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:BryAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19655126E279C70EAE47AD03D89A28259D3B2F474570263EF0191827E5F3B9E95D38F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 040b9a03eebb3096214b96b45213c5fced57d8cdaa0b36bab7f0a70ccbe116d0
MD5 21c3c8a41827057a79727b81cc87e533
SHA1 12a2ef3f51d0b9b29381e0b3d49e529cd1aa419a
SHA512 87866c87f86f7170e42c30bf55eaffd6d3b492e6ac815370793323c226b9918ded92b5432389ff2b423fa67ab7a2fe156d69aeb7f7dff9b2477f70f8c1ced7bf
SSDEEP 24576:3IyLAfYLH8AcevDN0FImbwQuq3Wia7gD:3I+AQgAT76sQuE
TLSH
T1CE65120A539860D9E9BA81398D7381B49BB1BC345B1193DF5081B73E7F3ABD4A874F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 b501560f4502a5e7f5c786bf740a52a0e47cf390ca4812eff00ea73f9381d431
MD5 18872ad56d78af05e4a30f96a9ecfc30
SHA1 b1d22063ef03c462d231b3aa66ba8e44b60d4808
SHA512 afb58bb30632075e1e4a615ad45a5bc2b21764abfb3bedfa2726fa2a50f33e30b9dea630d2738a70e0b3584582956d5e6a4ca76b8a272fc6fccdd3984f3632db
SSDEEP 12288:gFRAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ORAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19D55235F125C30EEFC7AC136887796B8A3E07CB8530562EF108566B9AE3E489D1F4D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c807c907b2129ed7589d1bd1461fae56d28cfd137782d547c5e3b348eb0875ad
MD5 a91bff781d5107d0102fd293ef6590ad
SHA1 4fe12a3d43dbfb1604a2358d9bd8cd100c2261a9
SHA512 b4c173b1cc0c3a1763d7a36558b6603886561bb5c733fbe1a0b83e14320253161a43b5f2bc0a85a8893ee70584310cf2f4af0f5c369205d42ba54fc321686f91
SSDEEP 24576:jQ9MxZKdcz97w38AfYLH8AcevDN0FImbwQuq3Wia7gD:jVKX8AQgAT76sQuE
TLSH
T1E7558C2DABE9059AE177D23994B250C3A673B4311B31D6CF2448D03D4D7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 3fc45975ad718cdb30a1807212bff56ff9a9eb671b797174854ae4df1fbda2d2
MD5 039a43eaace4dfa7411f03764ae01bc8
SHA1 0619d4a205c481f8c72878850202e0d8552a652e
SHA512 1fc426ada0a354310f4431e6d133d0d4b83f149b12467c5a446f48c83fa0c775f0457ff529ea61497cf3a21d067ea1e9925e73e4939a088fe58d3eb14af3f06a
SSDEEP 24576:2yocxAp/AfYLH8AcevDN0FImbwQuq3Wia7gD:LocxAp/AQgAT76sQuE
TLSH
T16C65EF1FBB6D40E2E076813C89968255E7B3B0745B5253CB6581C33E8E37AE9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9fd8eb0589d8ac8d00c665a2200037cc5364ca7c48ebaac1734f1b51af282bc3
MD5 0fa3722bb562a765eba36b473f189705
SHA1 b6726377492cff92e997c0e23babc037a9f8d4b7
SHA512 ab86707a0ead534c13de25026712f609bde0688de3cf51f3e3ca96bf00cd87df861ae061375327ebaab0f1da5144b243e0148f17ca7972422d6a5f936cf9f2e4
SSDEEP 49152:QWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK/AQgAT76sQuE:C0zuNIYqGsQr
TLSH
T1D6A57C3DA2BC00A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a56b0940bb63278442294560848632e381b41ba873146a1aa7305e841028619a
MD5 bb4860850ec60433899180befc59216c
SHA1 fab47ba11fb5da8dbc3e9b80b1883dd9376fa277
SHA512 42e6fd43c1bd1c164d66f0ed370725b7e9ff85dcb21aaa0254d75a5761b388b8ace928d567a13fec41c3700ebf1abc1c96a724167cf7e5878d123a157a0ca4ad
SSDEEP 24576:71QT7EcpfxR+N5AWAz3ooiYujMqbyAfYLH8AcevDN0FImbwQuq3Wia7gD:GTDxR+N5YzT4jMhAQgAT76sQuE
TLSH
T13355B02EA7F815E9D1BEC5799A23C512FA727821033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 2b97dd708f6d68b76f8738c226e58174a953e305bae691ed5cf039d1205eaeb1
MD5 3cc88d483912adc8799352ff2803902f
SHA1 acaf1ddfffdef56f90c64823655b066d4724fd76
SHA512 028cefe486dbc8f712bff07963376c05aef28a2fe9f6c2cb1dfcefb32cd518f66cc99e12273e35af0531daf133e0b28a0adb3fc7394a2954097d456fd0b5d23e
SSDEEP 24576:UTMdOz0FFS+bmSLmAfYLH8AcevDN0FImbwQuq3Wia7gD:c0K+bmSLmAQgAT76sQuE
TLSH
T13F75F13EA36D14E5E47BC17CDA538906E67238750322A6DB0690C1B93F6BEE47979F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 a0d83c2c529e3efb26d1bc379d04c8c460093c5855f557b4867fde66f08f4af7
MD5 9311439dcab33fb2d41ad51cd702e21f
SHA1 0ce56a14d717fb177557fa600b0b14f9914247b9
SHA512 e294087d826341141445aa76a18a629df75e15533b315a6f822d49084e357e37e5e9abd735d2be25d63a7343da439e1d21cc628db7ecbf3a60b376cad57674ed
SSDEEP 12288:D47dAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:GdAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12355121E13DC30E9F876D2358A77426592B0BC79130156FF24C09ABA6F3A9D8D5B8F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-390-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/432-141-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/432-147-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/456-383-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/456-101-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/456-95-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/748-402-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/748-215-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/748-221-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/868-188-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/868-191-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/868-193-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/868-182-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/956-90-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/956-84-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/956-411-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1376-387-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1648-211-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1648-401-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1648-205-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/1808-389-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1808-447-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1808-130-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1808-449-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1808-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1940-400-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1940-201-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1940-195-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2380-397-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2380-162-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2380-168-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2416-178-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2416-172-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2416-399-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/2436-46-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2436-52-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2436-384-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2448-388-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/2448-126-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2448-120-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2680-463-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-452-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-456-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-455-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-457-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-460-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-451-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-464-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-465-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-466-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-462-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-461-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-458-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-459-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-453-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/2680-454-0x000001E23D7C0000-0x000001E23D7D0000-memory.dmp

Download

memory/3028-42-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/3028-82-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/3028-81-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3028-36-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/3116-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3116-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3116-385-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3840-248-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/3840-242-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3840-565-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3840-236-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3840-284-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/3840-407-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3840-264-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/3912-396-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3912-151-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3912-157-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4604-1-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/4604-450-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/4604-0-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/4604-9-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/4736-114-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4736-386-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4736-108-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4796-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4796-32-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4796-382-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4876-489-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4876-24-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4876-19-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4876-13-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4904-78-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4904-76-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4904-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4904-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4928-403-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4928-231-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4928-564-0x0000000140000000-0x000000014021D000-memory.dmp

Download