7da619d39b259c0234cdd8fefb5cab6fba9842608c35ff3aa90420c90f72e8d6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 5.5MB
Sample261003-trcxaascpc
SHA256 7da619d39b259c0234cdd8fefb5cab6fba9842608c35ff3aa90420c90f72e8d6
MD5 1e8907826f619ae2bf58fd65a43cf160
SHA1 f951ecc79c0fefb2986433d389c0a928503d254d
SHA512 9a7aeee0500fbb963a2d4a5e1dc25592d38874c63a6a572f8f7e0e995332815b2827486da30e2ec4b2272eaa1e7618a57b22901077cf559e22fac6a282cac42d
SSDEEP 98304:irZUzLy1+3zPpFyjSGuRPQX8BjY5YB2YyjlcP/2:YmLy1+3zPpFyjLKPQXqYWZ332
TLSH
T18E46BF17A7A501E8C876C238C55A8603E7B2BC1557709BCF06A4567A2FB3AE54F3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
3208	elevation_service.exe
2768	elevation_service.exe
3520	maintenanceservice.exe
1000	msdtc.exe
2424	OSE.EXE
5024	PerceptionSimulationService.exe
1044	perfhost.exe
4492	locator.exe
4912	SensorDataService.exe
4544	snmptrap.exe
2924	spectrum.exe
5048	ssh-agent.exe
3308	TieringEngineService.exe
2520	AgentService.exe
3616	vds.exe
4088	vssvc.exe
4300	wbengine.exe
1124	WmiApSrv.exe
2476	SearchIndexer.exe
4032	alg.exe
4044	DiagnosticsHub.StandardCollector.Service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	elevation_service.exe
\??\F:\	elevation_service.exe
\??\F:\	alg.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\180d4e589b11239b.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2352-8-0x0000000140000000-0x0000000140F34000-memory.dmp	upx
behavioral1/memory/2352-53-0x0000000140000000-0x0000000140F34000-memory.dmp	upx
behavioral1/files/0x0001000000017bd2-52.dat	upx
behavioral1/files/0x0001000000017049-50.dat	upx
behavioral1/files/0x000100000001700c-49.dat	upx
behavioral1/files/0x000100000001700c-479.dat	upx
behavioral1/memory/4032-487-0x0000000140000000-0x0000000140168000-memory.dmp	upx
behavioral1/files/0x0001000000017049-492.dat	upx
behavioral1/files/0x0001000000017bd2-494.dat	upx
behavioral1/memory/4044-510-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/4032-554-0x0000000140000000-0x0000000140168000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bec9cead5253dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7e2fdb35253dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008db672b45253dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a904cb45253dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e0743b45253dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de8ac8b45253dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9f24eb45253dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d04a2ab55253dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012dee1ad5253dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3208	elevation_service.exe
3208	elevation_service.exe
3208	elevation_service.exe
3208	elevation_service.exe
3208	elevation_service.exe
3208	elevation_service.exe
3208	elevation_service.exe
2768	elevation_service.exe
2768	elevation_service.exe
2768	elevation_service.exe
2768	elevation_service.exe
2768	elevation_service.exe
2768	elevation_service.exe
2768	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2352	2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2352	2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3208	elevation_service.exe
Token: SeRestorePrivilege	3308	TieringEngineService.exe
Token: SeManageVolumePrivilege	3308	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2520	AgentService.exe
Token: SeBackupPrivilege	4088	vssvc.exe
Token: SeRestorePrivilege	4088	vssvc.exe
Token: SeAuditPrivilege	4088	vssvc.exe
Token: SeBackupPrivilege	4300	wbengine.exe
Token: SeRestorePrivilege	4300	wbengine.exe
Token: SeSecurityPrivilege	4300	wbengine.exe
Token: 33	2476	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2476	SearchIndexer.exe
Token: SeDebugPrivilege	3208	elevation_service.exe
Token: SeDebugPrivilege	2768	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4260	2476	SearchIndexer.exe	116
PID 2476 wrote to memory of 2392	2476	SearchIndexer.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_1e8907826f619ae2bf58fd65a43cf160_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3520

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1000

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2424

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5024

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1044

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4492

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4912

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4544

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2924

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5000

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3616

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1124

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2392

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4032

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2ec825c9a8c9f130202b4cbfd46b1894d4b960aa9dc172b5ad5e0936b8ef8c9b
MD5 a6647586db3296ca91de780a750651a7
SHA1 8608029c3be11b8592bd09bea208d27a8a6ea19f
SHA512 bd2c3b4548cafedd227315269e76fa8804a377fb60c2123b5e554ba6b88e3b416d71d8b8d9b721d333fd720ad3aa8fed64e9001ede2cab3a17d6cd303da9ea22
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnxaB0zj0yjoB2:e3q6HjBvB2Yyjl
TLSH
T10DD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 e9efd08e73a911398283a293af78ceebb3e53a6396c1c18da6da0d1cbd673e78
MD5 8ee8a1cd2546f070936931829d501d8e
SHA1 4667e5b4cce9103d1bf48b537c20096e3593c4f1
SHA512 516c7eb44002626c25e3a8719d9c68d03a1407eb322d9e82e51afcd71e795f75272d7ac253b1b9317032b08447e2f3ef045929238c9c896768ee9745f89eac24
SSDEEP 49152:btcTaB0zj0yjoB25Rg1QkSYqzrxIWDIg:bnB2YyjlfP/2
TLSH
T101B5122977D445F9DC675238CAD1C416EA33786087B0E79B03E89A265F332D81E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 755e36d2fff6b0ab9769735c32a8d8528705e8e053e61ddb046f8cc5877d9ca5
MD5 7325a1b3f22d7fa7d7d7b0636f032f73
SHA1 a2616c9ed44f183c21feb27335e83999a1ae698c
SHA512 4d9b1d5e970d4799600a3aec58ea4d31cbfeb92b469b0da43a0809758e081f828b36631189db40930ac15e9a786ea8dec9e2db6220bec6c1340062b65006704d
SSDEEP 24576:cXYfDtczAsatr0zAiX90z/F0jsFB3SQky:btcTaB0zj0yjoB2
TLSH
T12365022977D504F9DC67823CC9A18506EA73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.5MB
SHA256 820c4091975a8d281df0cb78295811c0e135a0acbfe349efa5093461736320f4
MD5 00692ac90b45a36cdb5418899399997a
SHA1 3b5a224ca9d5fbd332075c0a89cb2710e2a4ac1e
SHA512 91228d85b974d78c0ded152cc825f497963dc4feedf4a5c69e3c90455208ec929356ecebf3aa1d20344cd265129c6d4380150723803e88fde17f82ec26e0cf59
SSDEEP 49152:mPji0AcqaB0zj0yjoB2WRg1QkSYqzrxIWDIg:cjo2B2YyjlsP/2
TLSH
T115C5E026F5748371D073C0B9C5D2A69EED7230825B308ACB4286D77C7E676E68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.2MB
SHA256 8cfc0675897ade4cfbf0f6ef1608513c7ddb4c2cc7a98ab491a3f3273fe5ca67
MD5 575465ca543abb5efd61993fdccbea7e
SHA1 7dd6dc204b8508fa53e94f3e5be728c36e8a7f23
SHA512 552de8ce28b1981fa0dfbb158ee5b8878b629e75e24548626f19817e244058a809667231acefdd1da2fc7061578375cdd789a277264f05422c0f3c6b59bbad83
SSDEEP 49152:T/ezSC6vUzPvxHjymaB0zj0yjoB26Rg1QkSYqzrxIWDIg:DezSC6v2XxH4B2YyjlYP/2
TLSH
T181B5AF15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.0MB
SHA256 4b65c2a6050889425de9d8905c20895f4c951558e9eb7ff9e44e658dede21696
MD5 c11ef1062c44c7a57ff8c00adbc6db56
SHA1 5c2950cd75a23c14b9681b0e27152450ff41860b
SHA512 ae0bac6567500ad230a2e106e2e728ce8d37973be5e22806299726b4ed4e16182148b661c65f999b0c68a1c41f3ad5ac80291eb5b711c7568938466cf235d9b5
SSDEEP 49152:zVO88hXl+laB0zj0yjoB2uRg1QkSYqzrxIWDIg:Q/h1+UB2YyjlEP/2
TLSH
T1B2A5D066F5B48331D073C0BAC5D2AA9AEE3234415B318ACB024AD76C3E676D6D736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b944a83fe860f54ff0d69023acb16ba1f2e9a808beec24bc7fb0492a4c3bf4ae
MD5 23b3261a11df287dc2e0022b3441ed20
SHA1 f435e9faa2cbb29eccd7523d384c23e3eafd9d53
SHA512 5b5e3b8a88b718a2a4e38bbdc070237fbd84c45ba9925dea53964e30b953edca7f5a1d221a06fcb591b738d73a16bfd6fd5147973b0474ccea9cce12c56148d5
SSDEEP 12288:3R9UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8m:3R9atr0zAiX90z/F0jsFB3SQkV
TLSH
T1B345230B340E80F2CDC31B3566989C4B1AB99EB065E2AF45E2D13F4F9D3C1C695666C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4ab9553b8fe5833feab974e27c5011f28767d81706f9a460f32b7049ad431c81
MD5 a82f8dff7724f5cd12de45e4beadbb55
SHA1 da0ed25540723966a13e07e14970cd068c042ece
SHA512 61afb0263e6b048da5281894cd9d4bf306de70bb8b82d684b75eb410feabbc95d301d99aaa5d389acbb0bb11508dc72ec354c261df8fd9e729dcb89ccf155b5d
SSDEEP 12288:6eBNUbTVO86UoUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:6JIUoatr0zAiX90z/F0jsFB3SQk2
TLSH
T13465CF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5ab8c26b6316e574f300258fedfc34eff81fafeba77aca3ca385100332a520c6
MD5 706bc0e7173a92abfb498b349865788b
SHA1 5dfbffe5a652cc7c95c06a1b4579a7000117a8ad
SHA512 35244fb88c7ffa0ab8b3fe33176fb0a84e419ee0ee8a8aaf937ed1899c76f7d924cdd6e655afab594512245df4900d870e959de8917462a8f84747a09fe518fb
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:gQvGAdlCEL8c/yRNw5C+B2Yyjl
TLSH
T1E4267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 486e49f0fd907fa408e58d9be2fd4110cc48d12bd2538714d4947ddaa8ad45fd
MD5 da1840068803a072e83223ef0fca4900
SHA1 c49dd2f39149ca8d0ee1957334124db827146fd3
SHA512 58789f7da210107a46fe9b1c8db58332e3d071e5c2a92e917eb67317d7853b7f21e793fcacb64aa4b82e2bb786afdafd2d81b8f03673b5935457aa22064d5e0c
SSDEEP 12288:rAwSfxL/2Dc34DLLmt0LDQewsAj6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHv:UdewsAj6atr0zAiX90z/F0jsFB3SQkH
TLSH
T19A75E031FE75D032C6BB0DB61B25C706147D7A604BA21AC3E3E86E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6b5bb084d88fd2b8d7afc2b2f008d1f0d6016c80a4d0fa12573672fd8a696bca
MD5 e3574015b5c85f91b2e7bb53f3289302
SHA1 faf45185aba868cdc7bcba2fb42e37b6791ebf9c
SHA512 b514b13e0a8a3c99faef7077391f6b3723e0eaa3dffdf347d650c3ba5ee606bef9d1ad32a8163fd19d7a1c4d9fdaf03cc739732c9fa2e8fe7284f757c5288e58
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVZ:1UEtQevvqc2W1cpV2EI32P
TLSH
T1E2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9c476ca5d847d9607478d9c42c4a8997eae5fa27221dcf4c8cd403003b3e8a51
MD5 142630e8a03d3d08676c605addc9e5b9
SHA1 91226a7d7ababb9d8e5ce0281e1a99dbf4cb8a8c
SHA512 499cb53703ee8e9fae43ff5c7b77175ed46ba5d008f07f214c62c0045b7cd4b978fd596c4c812d477fa0a9b825f39bae9d5023c81c106a350076ab04456947e1
SSDEEP 49152:ECbRquA/m2yL5zQfFiV+XenmE3/zaaB0zj0yjoB2:NoqtVjnmSB2Yyjl
TLSH
T16CD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e86d6226abe697fd3400abd4074a70024e11f1b3dbd60b0e5b2988a29d1061d4
MD5 e5197342add9371aad85a97c6707f151
SHA1 cc0e0749a29c62260eeac6d6207580aaba8ef748
SHA512 9f810ad40706e6526a2ee88256750b48b4561ef6520073692f8026e86c33a6a3a5b413a4d908efcbecdc4adfad3466f8f5bb3369697da05eccc02bb999c995ca
SSDEEP 24576:JAhGLJIFoiwtA5l7S53/atr0zAiX90z/F0jsFB3SQku:JAMyFoiq5vaB0zj0yjoB2
TLSH
T1FB359D81E7F955D4F5F3AA7899B68571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8dd2707ef04457f3450cc0fe121d251c45afc6292da80bb8a5a55ba92dffff9c
MD5 6df2cae19257be93ea77186372e51a54
SHA1 5b291d16be9faba5799df6a7b1696f340bd0632b
SHA512 c0194f788f82877ac0675cb9aa1dd2bda69109ea890780cfe59b09a3e51e9312c941c2f6bf82850af78eab2f60ac7e757c8094d0dde4dc76bd9e125b35074c27
SSDEEP 12288:7mw5HEjsChNVBFgl0WDm+CDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:awuoOWGatr0zAiX90z/F0jsFB3SQk1
TLSH
T1F065F14A32A90CF9E9A342388657C536F7F2BC112A61DB1F1360CB5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 73605f4b762c3f78f430db3a857cefb6935bf5af55dff272512565ba84d65093
MD5 778868d659ecfe8a6ecaf14b2fcd31e4
SHA1 de98dd9612e7cfa9c92b3a08ac141ac30699804a
SHA512 ef8699436cd2bf436d3cb935b312ead0d82a80f3f6de8a3f0f420fc7b0ea43fd59624c7271248f8d29269c2d1eeff8bcea74f4603e538746f692eda85d6a1b8c
SSDEEP 12288:vBZ1IyKUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8i:5ZuBatr0zAiX90z/F0jsFB3SQkf
TLSH
T1E655124B32A960F6D5D3523CC9E48906D7B2786123B283CF12607B5F5F36AC25E39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2671407d60fc1566a57e35f45da60beeca1139a334b958b295f6b13fe957d697
MD5 b889824a9d2e25ef22d753a471853e46
SHA1 26c7e32556e51bee03bebc5bdcb8b9db8e880d05
SHA512 4353b82acb1d41026b2e9822aef4945db2ec5cd2419a6ecf5cc6f64ae96636dc8f26dd29cd9755925e4e4d096d68bb904e2ef22dfa080076a8c3f3b17432428f
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:YQRQyi36YOcPQLvw2gAf+PN3LB2Yyjl
TLSH
T1F3667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ab6e65e1d2ecac9f5722c46e509c6a8a729cbc0feba62d574cddce38eb24180b
MD5 d97d4e20a7be7a310b2427d41f275159
SHA1 24cbb96d645c96a0fb8511e57988c6cba4f82752
SHA512 f645da437227eb36f6a5681bbd3251db5d0d74e2d7436512c4ef08890943790ed10b0ee41d049742d39c62e67be493df79a15dbcc6d18e7210ea2e14379dc5ac
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:7QRQyi36YOcPQLvw2gAf+PN3LB2Yyjl
TLSH
T19F667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 673c0a8b33c1cc3f038e04798f3fcaed33f8cf30b97f166213bd2c8841262094
MD5 83aa79c5dd77352ee5cf799be6cdb293
SHA1 17fde0b6b2c163a84868f2b6a80a4d2c41a0d389
SHA512 79308213bf43073dd664601611dfb941935f77565da5026051290aaf47ce2b7bb1146a4e0b2486acbb1cd79304cd1df3f7e85f25b0441e8a59490e32811b273a
SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0xatr0zAiX90z/Fs:t68Qg55nhheWu7PNU3/qaB0zj0yjoB2
TLSH
T135B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8e7667e884efd0dc5c7028179bd6d0dd593cfdda888a32db6fb1e44890d67fae
MD5 5874b1dcef5f51d036db0e3f37d17de4
SHA1 c97a74117942929369de4a0fae46893c027ce73c
SHA512 ee51bdcef26677227de777a7580a5d9909e489855a2d9fceb306a8d2206773a3edc005557bb178bbfebd072eb6037c18efd4e8faf7e433e2a8b6e8cc50ad00a8
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99k:5y5112gYy5azzVvL69nLKnhZsB2Yyjl
TLSH
T1F7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cf269b54923a3c1ff19056d10934b9333dcdd76938c493045e0e9e4bd05dc15a
MD5 d1b253dec3c7dafe0c377c5b56601438
SHA1 d949ba3ef6029bad2f0b3d1519c2aa917c1667bf
SHA512 1b256bd09f73314db451d64960b165dfddf8baaf7970f9b996fb5b26c7d6b0136e108870e0af477c23651978ce1791e1658d3afeb72caa5179ee431c6067abde
SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glWaB0zj0yjoB2:Ju6JmVxd2dhB2Yyjl
TLSH
T1C8D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9002a0f8aa027a022902fda5ff5eb2aaeb2137396c3418be5da5baea26e1b038
MD5 3df64b1552e9c415c2cc0da019361fea
SHA1 73cc68e4797169481ee72cf69cbb85195597cc4d
SHA512 1dfdf15bb65333a45998334c577a30ca3cf7fc6d189f29f16364ee5ab0c23d75520e99b87015dc17e113417e5ff1bb66af36d269ee45f7dfb03bc3ffd2e5abc5
SSDEEP 49152:Y1hpsNoJpF1A6UU44CwH7R4xIaB0zj0yjoB2:YmifPbRSB2Yyjl
TLSH
T108B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 30d6a385d9a9f73751a93eb239d2357ee2b1a4bc8e20e5d9e833bec373c79866
MD5 4e3ca043b212cd72ca7380292b6bc95c
SHA1 7cdab84c6ef3fa0347b207cd36ad4a4cb9aac986
SHA512 ff6b3e9b7af74736491cec6c3669a500d2b2c647a794058285599745bcf78767eb5651232b5081c24602a78eb30c309dabb4e8ae68f63ae251c5419476760c4b
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHqBaB0zj0yjoB2:45dKTi61oB2Yyjl
TLSH
T10EC5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b287efbda451a2d5f25f72488504518135c6707416a00bfcb56dab749cb7baa6
MD5 1da042f8043579c6705a8a0bd4ced1a2
SHA1 8b6d33568b38d0c1fbc43a8646330364c8c4e905
SHA512 9a8bae409fb7b520c5eb1b36527040aed95ed7eff6bf963228798dbedfb6e85104fcbb9c374a43293041488c737272cf1388951dfd32852d3ce8fa0134476d7b
SSDEEP 49152:AhtSn8EApI0figngiDn0AP5wsaB0zj0yjoB2:RX2iyphWB2Yyjl
TLSH
T1D995BE13F2D900E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9f772fa0055c7dd073cae5293fbce74a564ea8bd05e44d0f4eac324452318511
MD5 e761ab20baf709a2656b57910cfe3767
SHA1 79adecb859a1162d15b43400f7db9d9be0a3da2c
SHA512 8b9ed81051778b11e58bf3eee9d0877caf907fd5b1da64580389763aa5bfabd0658beb40f90925859f1f4d60d84d3a2834a984e8038836f27cb6c1bad68e584d
SSDEEP 12288:tlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:tlatr0zAiX90z/F0jsFB3SQkZ
TLSH
T12445230B341F80F3C8C31B355284984B5AB95EB4B6E36B85B2D53F0FDE382C616656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 28a7431246cd9b72034cfff4e2eccf8851b975de6f6409e1fd496c2c8f5d3a18
MD5 b8435729e4fade7258714501d398071a
SHA1 051ff06342afe2416d3d9d922e2f6286998994c9
SHA512 fcfae8e48dba306f669daf9497ba9e8f080f43dcace9868ab2643f6cd2432f3cc837c923b7d7aa7b6503f01c32559cd750142bef33c906156438437a7c26afdf
SSDEEP 12288:h+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik88:h+atr0zAiX90z/F0jsFB3SQkl
TLSH
T11745230B341F40F3C8831B355284988B1A795FB472E36B86B2D17F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 788937a2d6bbf102c5436d82c9d47a03af80f734613dfa092e26a57be3abc823
MD5 5039f17d17fd445480d8c353f91889fc
SHA1 54d4a3c670b2f32a1d0db4775fc83afa0fd1b5e5
SHA512 6146e74fd40363652334931fd8c6a14d7bf1454a8d4a65e4cba430f6891df9c876060657b7e603443c77df4406f9e1d4865a6ddc6a4feba0ce0010772fe97522
SSDEEP 12288:LQUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik88:LQatr0zAiX90z/F0jsFB3SQkl
TLSH
T17045230B341F80F3C8C31B355244988B5AB95EB476E36B86F2D53E0FDE382C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 17ead19a52342ad1d3f39b504d9c388b4ff3b4f63ef58064b5afb5efa555ee32
MD5 767a5a82bc120d731957702a8ec82c88
SHA1 6165620e24e5d967129e11b6e7a35d9c7f1c1e69
SHA512 6cfa6e8220686ed4b6760cb181172d273b2160642948dcc3123dfc4f8b4f7e5f2b0d8e19323b65b93832b782d470f309d14329edf91640b7aac2f3403db9a915
SSDEEP 12288:NVfUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:Xatr0zAiX90z/F0jsFB3SQk4
TLSH
T13645230B351F40F2C89397358654884A96B5BDB0A7F3AB9FA2813E0F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 479a90be554b469b8483a37bcb95fe9c77b6b99628dcf2ee2f153bc8d4c793e1
MD5 0c64f0f4085456675de1564a25c27b46
SHA1 99d17ae9b0a84f3e7a7fb4318856b06f43522959
SHA512 f9def9007362b7a5d7c1f5f02752a0049c070054279e06924941c5b0a43f0211ae6aafc1ab141d7689e4563d981af47e0cd40c280a419461e3b328acb29c8e77
SSDEEP 12288:XXUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:XXatr0zAiX90z/F0jsFB3SQk3
TLSH
T1AD45230B341F80F3C8831B355244988B1AB95EB4B6E36B8AF2D53F0F9E3C2C616655D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a716b440b5576709e188ea05938f1fbd54e3f0b7612973e78873d7bc86c6e714
MD5 21160e3efd063e1c899d8c8b09ac98f2
SHA1 f4f6d75c1ba4539fa85d8fd518b16ded1c5993f1
SHA512 0a63ad9812797243612a3226d34cdaaf694d69cfc7b61b0490b7261dc02f3bec68541470f81bd669a389a4f36baf3e229c2f2547c2d5bac03c73e73742f700ae
SSDEEP 12288:HiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:Hiatr0zAiX90z/F0jsFB3SQkd
TLSH
T1A545230B341F80F3C8831B355684988B1A795FB476E36B86B2D17F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 48db265cfb9ab2c606cb8653e4cd4531db629bacbb7f1b4e275d578351c9e834
MD5 4bee58652abce06a232ca8c5bf757ab9
SHA1 9d139fa89dfc85dde44ab74a46d5411295ff8289
SHA512 e73756126a9439bb95ea853d8803645e5b0d4bf6154defd3148db98ae4ba52fea0eccb35410c5b72353d9f275ff85b7474589665afeeca4e3a4bf792df0854ba
SSDEEP 12288:G2UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:G2atr0zAiX90z/F0jsFB3SQkf
TLSH
T1DB45230B341F40F3C88317355244984B1AB95FB4B6E3AB86F2957F0FEE382C62565AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 842c5732676b8aa0f648ac0088c7a2e2b11a2e976f220432336832e96f2c31d2
MD5 b6c4c046f5f07c7c524ac63ad1bea75a
SHA1 a2eeeb98dad25dcca258fc9754d83dad2195324a
SHA512 b3b66e49d21cb8b9d7a5edb1aa3bc969be58d5d7d9b04336764f45fc2d6a6a5b766e8983d834ff6de6b8de935b950c8810706138b5e55afe82b3ac59efc270d3
SSDEEP 24576:CZMSzFVSOeatr0zAiX90z/F0jsFB3SQkd:CZMSzfyaB0zj0yjoB2
TLSH
T1FE65019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3a2cfabb8b38d0a91a40da6dbab550a4fa55def0bdd06c79caf93396dd167a37
MD5 03d15f67702e958bc34ac8baf9aaf18d
SHA1 c72c6af285a5a4942268d70955e7a08aab30f7a5
SHA512 5fff35983c5c6e48602c7c06e5b6a9e6fdb263d9f26b79f1d7d2d4a76f6ad750d3571d874635372af31d0826382be74699b77931234071aa25de54f08547aee6
SSDEEP 12288:yRUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:yRatr0zAiX90z/F0jsFB3SQkV
TLSH
T15B45230B341F80F3C8831B355244988B5AB95EB472E36B86F2D53F0FDE382C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 07ce4309affef07d5da708fafd2d58b9c5642d7a3116178a6e94d5b1c13ccdd2
MD5 32590765841e8f0ec8a0a21b989f730d
SHA1 06714a12ad335390962f436fdb37d5d129ebe45b
SHA512 56d31d6168abca79a10fd5b95b3f28a81e7de40ac00dac44a14ef54d2deb2cae625f3faa93258ca5b43b68af365065e6b7d6e80f4811cb05a070f041ba60a2ae
SSDEEP 12288:rNUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:rNatr0zAiX90z/F0jsFB3SQkV
TLSH
T10D45230B341F80F3C88317355244988B5A795FB4B2E3AB86F2957F0F9E382C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 8dc60c52b47492defe786206af2383ebbf3cac523d243c28b488bf4182e1ca01
MD5 b8056ca5e3341e9541411334fbbe98d2
SHA1 b70bd19eecb071d3f0754633a854ac9d47377327
SHA512 82a770e67230dc3d29dc664027bd882def4a84d6733bbfc45b4b1e327f7b54bdc88be72cc3219eba9c31c6faf93c8f8b51c8974bb160ec834a75bdac6859e876
SSDEEP 49152:ZP4m4IpOO67W8KzaB0zj0yjoB2sRg1QkSYqzrxIWDIg:PppOOHsB2YyjlmP/2
TLSH
T191B5D02DABDC0096D0BA913486558A4AFAB1742A1F3286CF1160933D7F77EE54F36F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6ad1304e723c1e3fb0d6143d551b87a772550dcb6d47096202c7cddcd48e4e50
MD5 709b7e44197dafae7d125464f5b87142
SHA1 13cdae4cc88da03712b8758836a2f9244b60c6ea
SHA512 702467b51b2255002d0315f1c223fcf178d49d3b92063378ff32a08e727dd6054393403912bce06e31757aad5715e6db819b388bb66e6876099f6a1f77258511
SSDEEP 12288:ZNsfBUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8l:eBatr0zAiX90z/F0jsFB3SQks
TLSH
T15D55F00AE25801E5C0AE6239C7544A41B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c7359cc452de840fb41eb5b8e40dbf887359d5daa04b0b5170301944dd8131fb
MD5 c2a47e3e526b067169d0ae7e0a4e08d4
SHA1 b6b30e34bfd164347e3e199b1e5949976a79eaa0
SHA512 4fa7dfe81d066dc1b69d307997c0a344f9a281a8510239ca131a83ac8737c6d69f9b03d266c5acc3cfbc2254d1760cb1ffb18b77520deba15e7364bee555a494
SSDEEP 12288:bhUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Y:bhatr0zAiX90z/F0jsFB3SQk7
TLSH
T10445230B351E81F3C8E36B301658C81A267E7A746BD29A8BF1813F4F9D385C659356CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4746cfd17f9befc52795bbd32f25885b9898d85d6e29591d11da3b308b19dcfe
MD5 500d51381d27a048bb2c0950bb965453
SHA1 f9618aef2c752344660f356c5a5be4b99c4e789b
SHA512 d9270680e23f626a9a693d92fe8c4f9c94d44d14bf5f19db3a7d6585a6c318b3c1cdde92bac24ec17df0628a22663d4f73b73380bc907e8c830c9f3f9ea936a8
SSDEEP 49152:Ra0h2GEkuAe73q3pp46zwwQXaB0zj0yjoB2:Ra0hNYG4JwVB2Yyjl
TLSH
T19985AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 5b438c4ebe2188c6ed6f0623e6537f1982863e41c31c7197576cfd2239d1e5e2
MD5 c6718cf94188c1bf48cd04e432948284
SHA1 cdebd1995ce2a06840e9055d86a12c41ee7127e4
SHA512 e14ea48b0f9d8406939c0a823d8f4f9f8d65c50a5c110fdccfb48eb57d813d4b07b4fe57d17fa898d0686c1757597eb90dfe5b7cfb5acf3a60aa40896df0a203
SSDEEP 24576:HhbHjPh6qZj+Osl1QkSYcPdzrxr8WcKIKB13Yatr0zAiX90z/F0jsFB3SQkO:HhbHjpRg1QkSYqzrxIWDIgeaB0zj0yjl
TLSH
T1E065237F299C21EAD47262785385841BE736BC315BA193EF13D9823B9F365D40E32B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 31768a488ea984ddfdcdc10fcd4e9024019555f004f05530849bf0853b8bd058
MD5 cef70de79f2fef9a2842e82cb4030ad9
SHA1 ff0dd2ec31b3148b78e0744961dd0382174b5d5f
SHA512 72588ef10947a4f917611a6c4ef016f59696491275da234d5d32bbd9c7b1e601ffdf044d169b6d3bf157b98201da54ac8162113bbfc22361e8b039f363d0eb6b
SSDEEP 12288:xdUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8e:xdatr0zAiX90z/F0jsFB3SQk3
TLSH
T18245230B340F80F2C8936B755688884B1A796B7063E36BD7B1917F0F9E386C766356C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 a9a8b4f2c6bc36ae2938ad56ea810e87fbbf7ced1282a13d80e80b8a8868ae82
MD5 1fb7a8e4dd454dfd5a9f2f93955e4765
SHA1 ee05835d794771d7fdc034d1db69551fc088da2b
SHA512 ef6a86529e6324fea15be23420d6a249a0276ecc2602e01db6aaac1af6b2e53b8dd9c4af6f0cd1fdb1fd2e726a3551362d0f432dd55ec3848ead8998f02aeafe
SSDEEP 12288:uOb9A4LWOsvAYFTsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:XpL3UTsatr0zAiX90z/F0jsFB3SQkc
TLSH
T1B5750105F69500F5D867923CC9A68917D272B86C03A0E7DF03A85F5A1F237E24E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 910defbed2c556562b8d83530f9f2611b28f15f16307d6f633d8832240a49bb6
MD5 765146e76c600152db9dbd02ad99609d
SHA1 20fa02677cc3e9bc5b0b4256076ace334ed28ed8
SHA512 0d2f87e92e0c0693aafdf7a0330b53b96b1b30c8a91bee01331f0e1dd96847feec497dd588412784fdde85b6513d801d1dce154a829c12415a912e061973c108
SSDEEP 12288:XpFtpOIUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8M:7OIatr0zAiX90z/F0jsFB3SQkR
TLSH
T1CC55121A369D10F1D473A23C8A81820ED371B871176257DF42D0A66F5F77BE86C3AB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0dd281b7d6e9465eae332a229cc57d1cd1d31599d899ad1575ffe51d6979286a
MD5 e5279eac72794da491504c422fdb5190
SHA1 a33c659e7c56a74e293fdeb82d0868c56d6fe805
SHA512 1928ef77a43bd3bef30432e93481f4b42da4c9fa2ef625a3ef08bd0b29a7f5ca3183a773e9d1a0e95bafda521c0b372e0f11222b9b7f2373bce4d1e926a6c3fe
SSDEEP 24576:47NM9YqZqmWMUkPjZM48Mv6bEhsRatr0zAiX90z/F0jsFB3SQko:47cBWMpPjN8DbEhOaB0zj0yjoB2
TLSH
T19365AE2E6BAC81E5D477D13DC9A28206F6F1B4611B318ACF5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1e768c727836abf923042374537c3948e644a0ab5d5d8e6cb633a031a2cd6045
MD5 7a8a1eff22114e18ea256fc90efe2353
SHA1 7053e4efa240c5bdf96bafef249093be6b9ee31e
SHA512 7620efd18a1459e4cb7182bc9486e14542c8cba3292cce7aca7ace25a6fb663984ef6293de8b9e0dc0381db4607932e647ef3ab6fbe9b9fc4996a2289b7722c3
SSDEEP 24576:YW6BApg2YuyuNDYTabvcdvNYf8km1batr0zAiX90z/F0jsFB3SQkZ:YF2YuHNETovAvNYf8kmxaB0zj0yjoB2
TLSH
T1A9857E2A27ED80E4E0BBD27D45B6D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 2.5MB
SHA256 f0349fca2338cbfa96409efa9fc37c99bc2427b0a782c75eb05254e3683b6079
MD5 ddba3f1752aab0520b06c4592721f82a
SHA1 dfcce07525b89dfeee7821c59689dc204c2eb3f8
SHA512 86b1985515fa15b30a8a81e56ba8576ac970a1c91424fc9315bf46a90d8cdbe3bca7a80e64e64c7a88f253d3ea7c21690cfc2e2ee35242c25039cbf4069670b4
SSDEEP 49152:YF2YuHNETovevNYf8kmxaB0zj0yjoB2qRg1QkSYqzrxIWDIg:d6jCf8kHB2YyjlIP/2
TLSH
T10EC5BF2A27ED80A4E0BBD27D45F6D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f8838896c9632eb8a95c2954304ad3bf1cb1ee705cb302c71b5f34600a85956e
MD5 0b82d2506847ae96c2b977d77bcae432
SHA1 0e8b26b0fa9361e68b4cef54f8689746a4210c06
SHA512 4ef3cba30c75327e2c2dbcb6e8c1db5aaaf7c9d6682c1e5aa35d06a35dec0f3cfcfd06230b4610b6e69f7662d81af3abcee341b4e559e1f882e19e0c13623c3b
SSDEEP 24576:MAFs06+Omlf3NXEbTo0atr0zAiX90z/F0jsFB3SQkT:hFs060lVXu3aB0zj0yjoB2
TLSH
T18565AF2F66AC00D5D07ED17D8A97C91AF7B1746307215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 a61f504f1ed4c1c40aaa795cb4e3b125eff856b1c5ffd0e6e32ce91dd2796606
MD5 19021891b5aba4de9eaa43b89d4385b9
SHA1 54e39e6d1c8f5bd0c9b437cb2fc4725a213fe9a6
SHA512 45b88277e078aa910008145008d095e2964bc69049591f725b4ac857048d14826dba6a4310444ca23f382d95cfb2ab72505371be0d1aca5a5e729a77c04ed184
SSDEEP 24576:fJnJ5D3WX3atr0zAiX90z/F0jsFB3SQkM:fJnJ5DGX3aB0zj0yjoB2
TLSH
T1AD75D02DD2A810F4D4B7C37482591B46BF72387D2B226AC724B4E5357F22EE09A79F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 983a61ee5f0be86a6ba6e93c02be411228a37f0e4d016081175e4c1d23739f6e
MD5 bf710d45f3e5040d3e469e7d0f7d1c29
SHA1 c2ded41b5d4bc7e263c15856145e932f1f03ec18
SHA512 44b63d3fe7ff4e7ee7ab515fbbfba1335ba20728e26de4f49221b9dbea77b148ac8cd46ef3e349d2512400d0627cb3fc570b86e5d20bc721c29057cd185f647e
SSDEEP 49152:Mg06DIKdwc+eQnSt65aVlaB0zj0yjoB2:9mB2Yyjl
TLSH
T17D956C06B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 6fd99f3f19b8637a275d34bc27494ea04ff98c8763981f524ac39db7da87c6cb
MD5 04bde828f9ba7880db15c2f955391960
SHA1 e64154d6fc18011d0c0ff6e29edaa393ed5b28df
SHA512 a17d6e4a6c93476ee3d79edc5eb552fbf463fe1ad97d9d92dd8bc260d6ea6a8ac6836a65da7471375d210ae7d8bbf17de16e4f4292be372576e323fa5f74b363
SSDEEP 24576:mZ126qZj+Osl1QkSYcPdzrxr8WcKIKB13Yatr0zAiX90z/F0jsFB3SQkO:mZ12Rg1QkSYqzrxIWDIgeaB0zj0yjoB2
TLSH
T17E65236F2A8CA1F6C426623453C0851AE777F4706BA263EF02D5923F9E365E51F36B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 854KB
SHA256 9da6411088e2ae7241d5aaf52495d65417a78050444bdf7f1f2a89794ddabefe
MD5 c6f8a14054e55bbdcc08af40b3f5dc79
SHA1 8d980c32e7a46b1469ad0eba893255dea61ab3c8
SHA512 d584a1c02aaa3ecb598d8870e3df7ba31472f327e4a8cdc0c373a86884a76c1010508f3bf5d58b3303e93f6a53d7f9723354d3d8ec2ad27119bb29249b29acb1
SSDEEP 24576:si126qZj+Osl1QkSYcPdzrxr8WcKIKB13:si12Rg1QkSYqzrxIWDIg
TLSH
T1D115126E2BDCB1EAD429617857C28129E777F0315B6653EF02A9C23A5E335E41F36B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 02fc0dd47e268b93ba1af7b77225eb81bb5ae109b67fc914f6a9b125027f38ea
MD5 976f17b4b29b2fe786f81133d66ad486
SHA1 0a5af8baf96dd2030989210d5e9c72e9baf9559d
SHA512 4437436d9b3b2d31eb55c34075eba9c72467e4395eaeca24362acc60c127c4bb45458ee0542ddfc7f69238f9fd75905963ed8dbc857b5c12d38055d82442327d
SSDEEP 12288:9jky+UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8S:9Iy+atr0zAiX90z/F0jsFB3SQkv
TLSH
T1BC55120A335950E1D9B306389AA181855B75BC306B6297DFA1C0FF2FAF357C16D34B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 01e578fcbb47360c8701c6f3ee64bd27c14f4f30fda4309b9e2a32541dcc9cd4
MD5 c9e2b4d82ecf9eee5aa62fd20eda4500
SHA1 20b450c6890d34601cbab4d2d64b8478b72a8d31
SHA512 32487671f8631c4f4dc098286a9645d09fd9706aeaea7ecea54aeed9e438ceb6640a9f11b57a6b83da5f45f4ca6868b7a87838a8899bbb4f9c26ba15e7254ea4
SSDEEP 12288:uyYUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8t:XYatr0zAiX90z/F0jsFB3SQko
TLSH
T1E145230F301B50F2CC9317395258894A16757A7027E26AEBB1D1BF2FDF382C62576AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 00304525cb3bc080af56f9cd6b1a1baaac1ff9d4ffa539df3ded30c5799878f0
MD5 cedb1a353320f980e1dd8d5ad0375dd7
SHA1 f60ff7534cae0c7973085416020f718a0163d41f
SHA512 16700a74623d4438be793bdaa3a4ee1cb527f23d6e21b026799043d1abd664cb0c68126672754c895586ae81aa4fbee3d0071e4339a56b4a984eea9e8c442efe
SSDEEP 24576:wQ9MxZKdcz9dw3Zatr0zAiX90z/F0jsFB3SQkY:wVKZZaB0zj0yjoB2
TLSH
T1B9558C2DABE905DAE173D23995A250C3A673B4301B31D6CF2448D13D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 0bf76abe987e14f3f4870e8a2065949cec79e4c1c836e3fbfa72cdf6e503cbd9
MD5 3a1430b2897076f75cb32816f9ee178c
SHA1 961d4f7af5b41c0cbfea24f8e12904c9539ebdb6
SHA512 6f1211a97c3974cb8388f97d1ad7e09aed8328bf523959dec67c08be329d89de1ebd0b219483824bc1d039bfc521a7c29ec3b9ca536f2afea47b5992ff5c8b49
SSDEEP 12288:6yoKo2JRple9p6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Y:6yocDAp6atr0zAiX90z/F0jsFB3SQk9
TLSH
T13965E01F7B6E40E2D063923C89848645E773B0705BA257CB6191C73E8F27AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b68f8a25a520876c137daa4249cd9cc42760e3ca040529a0d4d12ab13d0d2df2
MD5 94c3ff93cb2514f00de61ca51b312f5c
SHA1 8e7175d7a3ccf1ba536d5b3b8baab69238114016
SHA512 b1739d62354a0a73ad43c73d574237fc9a5f0e7611379d169d508dfc0cd1a5981b652f76db3074b10d40a7f81437a18eff460a56567734ad36519ea0e25e8a27
SSDEEP 49152:RWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK6aB0zj0yjoB2:J0zuNIjB2Yyjl
TLSH
T179A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 a9eca8c0f5bebcae56f690cb317ef306bd4eccb2f76049bdedf30e3f3c07c432
MD5 e7c4891232f8b279d091f808cf57ed3b
SHA1 6c5ff10fd5219be5cd76a87861fdf0bb2c8ac296
SHA512 96ef186b5147309cc172867c42a5cd12d0b095918125b76e05ea452689f457071c5317d51f79253e72da73af39da09f881dd5e34a374903bbc096503b753ad50
SSDEEP 49152:Ra0h2GEkuAe73q3ppj6zwwQXaB0zj0yjoB2rRg1QkSYqzrxIWDIg:Ra0hNYGjJwVB2YyjldP/2
TLSH
T1BAC5D01E67DC82B5D0BAD278C9A6814BE6B2B4220B3157CF1151853E7F37DE44E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 268255de325981cff1757384d13a12463494433c9b5e895fde9b8a7f82a115e8
MD5 50d5eb93295762f391ab683d8707ef4e
SHA1 8f9f8dc3b98e53d99919d9fc3816b29c3d80ee88
SHA512 667c52f41ebb4cc0caeefa672dda473d5b83c140d0fc4a2bdf2a1fa1066393552883714731452663b27b8787acb2b6b25ae0c47e56d171cc930315af5d6ad55d
SSDEEP 49152:UTDxR+N5YzTZjMwRg1QkSYqzrxIWDIgeaB0zj0yjoB2:Iu5yP/2KB2Yyjl
TLSH
T17DA5E12E67F855E9D1BE86789B23C516FA727821033193CB42A0C17E1E3B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 35529970c83a92b6671557841c8c58c982429655f2f5593ad64135b883fc7b3e
MD5 d05176ee236f7e688ac77839a74c207e
SHA1 0f9b20ae4cf9639666c10514dbf7317a2989ecba
SHA512 65930752f69a30de63ab2e5fa686f7fd427a045f74d153c3234a20249b21f9b74aebf7ba1a03fb4a378585558805479c3872146ea8903ee302d4013790ae0354
SSDEEP 24576:i1QT7EcpfxR+N5AWAz3ooiYhjMqbf6qZj+Osl1QkSYcPdzrxr8WcKIKB13:/TDxR+N5YzTTjMwRg1QkSYqzrxIWDIg
TLSH
T15675C02EA7F815E9D17E86789B23C516FA727821073193CF42A0C17E1E2B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 853KB
SHA256 1816b381687a9e4053ca6ab9e65ffeea1f7317f8b35029cdf07e076db730d363
MD5 1ed97e1d6d4c7f1d5ebd0829e36f92e9
SHA1 6adf8d9e8147f0818e5e7d6ac2ba66f884c83a2e
SHA512 7572937c730b9f2479abf55e3a0ed3716ea185beba67a2ee649cfdfafd155a12030afd72544f121c2d988354410352763df57f0d1219d4acbbab0c3a2bb991ae
SSDEEP 24576:yhbHjPh6qZj+Osl1QkSYcPdzrxr8WcKIKB13:yhbHjpRg1QkSYqzrxIWDIg
TLSH
T1B505127E1ADC22A9E434A27857C6951BE732B8315B2593EF03D9813A5F379E40E32F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 2.2MB
SHA256 aad776f2c5870e56d131fd2599dfe571d1c97fd05e52a89595e8eabac0ad7ef6
MD5 e2d142301f821215bf48142d831c16b5
SHA1 9b91ee38b521f869b45722e0b9bd1bf1f9403828
SHA512 ec026add212e3d6e2ab5645031d37d0e9918e592b3a7c2c57bc2c154402ba100e7ea7b666669bfce40a5d0260f050b7831d8fa19c430fe1550d029c16c0ff743
SSDEEP 49152:w0K+imSLfaB0zj0yjoB2DRg1QkSYqzrxIWDIg:WCB2YyjlVP/2
TLSH
T187B5023E679D14F5D47AD27C9743890AEA7334710362A6DB0290C17A7F67EE43A3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

180d4e589b11239b.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\180d4e589b11239b.bin
Size 12KB
SHA256 38946b2468f7ee03422106daec6d9545ef49eae3b1e7dc914c6f854d9516f6aa
MD5 01a08a9df2ca1742ed700f2595ffec0d
SHA1 067fb0a2a996f6612c6ec825bf06df074727235c
SHA512 051a2a6394bc4a1ff6d71594467d85373bdf6206256e84fabf4c56a9412dc29855b022a5b7dce45c388bfecf39223643c581818652f7f8a37b09d6acb56ab46b
SSDEEP 192:Wjdid3AEV6+yyiTJVnNe8WYgsrDJecIauyZdy66QoYDz9DQovNRQdsqY3kUJ06St:WjAxV6+yyU5WXcoYDh0ANNZ/JjE
TLSH
T12142CF689773CE523444DC7410EBA8B7DD636332E41853E33913561AC29EE96E6F11D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 3ea4c443d40784bede54eab5c660367b5adc014f2431ed69a20227be20882ff5
MD5 c320b01c6a4b46d05e00efab395adabd
SHA1 a0c8b2e33176c3ebce4b6b6475629396fac7d3bb
SHA512 86c9c933f41e66e55f5e53cfd62bd6498b7b11c31b0c7b8faffb4400e71d11da5c0f1fee4fb61d58f05cfc35e69289ef5d2f2f72dab2522f1b82678d5e45a2f1
SSDEEP 24576:o3YgnJcRTk4yti+R5dBR/latr0zAiX90z/F0jsFB3SQkI:oIgnaTk46pBR/laB0zj0yjoB2
TLSH
T17F45BF2EF2B910F9C8A6D236450147B5BB71782D1F209ACB0170C639AF1AED85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 2.0MB
SHA256 6459466b2a48a7d19e202ff1f8b58fdb09e05343c907321f82771d8c8f1ae2e9
MD5 9cbf299f443c02021d64cb2c15fe6794
SHA1 86436dae53c5e9f98846010cb337436e45ae466e
SHA512 dcdfe1c9a254e1e0f976e2389f344b183f2eab45d55eb642ea6eff5bc19a71354c6556261e5a30ef00a2dcc79444f721de5fe8206583fa930b74baad0949a7d2
SSDEEP 24576:6satr0zAiX90z/F0jsFB3SQklR6qZj+Osl1QkSYcPdzrxr8WcKIKB13:6saB0zj0yjoB2DRg1QkSYqzrxIWDIg
TLSH
T16CA5231B2AD871F6C86223305789902E6A36BC3157B557FF22D8DA3B9F351D41B32B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1000-86-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1044-110-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/1044-255-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1044-115-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/1124-282-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1124-386-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2352-8-0x0000000140000000-0x0000000140F34000-memory.dmp

Download

memory/2352-0-0x0000000000720000-0x00000000007A4000-memory.dmp

Download

memory/2352-6-0x0000000000720000-0x00000000007A4000-memory.dmp

Download

memory/2352-13-0x0000000002B30000-0x0000000002B90000-memory.dmp

Download

memory/2352-21-0x0000000002B30000-0x0000000002B90000-memory.dmp

Download

memory/2352-34-0x0000000002B30000-0x0000000002B90000-memory.dmp

Download

memory/2352-33-0x0000000000720000-0x00000000007A4000-memory.dmp

Download

memory/2352-53-0x0000000140000000-0x0000000140F34000-memory.dmp

Download

memory/2392-378-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-384-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-380-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-379-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-382-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-377-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-376-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-375-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-374-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-373-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-372-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-371-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-370-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-369-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-381-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-406-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-383-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-390-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-391-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-392-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-394-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-395-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-393-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-397-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-398-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-399-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-402-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-405-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-404-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-403-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-401-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-400-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-396-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-413-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-412-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-411-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-410-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-409-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-408-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2392-407-0x00000243220E0000-0x00000243220F0000-memory.dmp

Download

memory/2424-93-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2424-385-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2424-87-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2424-254-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2476-365-0x000000000BA30000-0x000000000BA38000-memory.dmp

Download

memory/2476-169-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2476-201-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2476-185-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2476-387-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2476-283-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2520-150-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2768-64-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2768-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2768-367-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2768-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2924-126-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2924-263-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2924-132-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3208-48-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3208-47-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3208-39-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3208-290-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3308-270-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3520-81-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3520-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3520-79-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3520-76-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3520-74-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3616-271-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4032-554-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4032-487-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4044-510-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4088-274-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4300-281-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4492-256-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4544-262-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4912-258-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4912-368-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5024-289-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5024-97-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/5024-103-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/5048-137-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/5048-143-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/5048-264-0x0000000140000000-0x0000000140241000-memory.dmp

Download