0ac482d59d87b2e168156f6b632e5c83c5e7503abd87a3d652de9cfdedb3a33a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/10/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
Size 2.1MB
Sample261015-3fca2sef84
SHA256 0ac482d59d87b2e168156f6b632e5c83c5e7503abd87a3d652de9cfdedb3a33a
MD5 f133a51b6840f0db7a6d0bc16f175b5e
SHA1 7b878322d463145e430c85e833b33737c588ac15
SHA512 6f3af00336b811df6c1b62fd82650e1c5a74f738fe646cf4d8471640c759c0396d24bbc252c3027ae666910bd27242c908c0f857e0f0e8ef84daab3e2a700216
SSDEEP 49152:rlYAQ/Gg4tSmCS8sIyNjWX6HT1i2vUo3DqqldPx:GDG3/ZDDqIP
TLSH
T163A57C12AA8988F9C159C4749646C7B2DD613C8A0727B5EF06D63E273E3BAE01F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
636	alg.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
4784	fxssvc.exe
4300	elevation_service.exe
976	elevation_service.exe
2108	maintenanceservice.exe
1808	msdtc.exe
3052	OSE.EXE
4760	PerceptionSimulationService.exe
3380	perfhost.exe
1368	locator.exe
3400	SensorDataService.exe
384	snmptrap.exe
3940	spectrum.exe
3308	ssh-agent.exe
2368	TieringEngineService.exe
3356	AgentService.exe
3492	vds.exe
1676	vssvc.exe
4796	wbengine.exe
4624	WmiApSrv.exe
952	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ec3cc7db288da564.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097cff9bafc5cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050eef5b9fc5cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cac50dbafc5cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005db5dbb9fc5cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094c16abafc5cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f31fcbafc5cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000969a63bafc5cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a78fb5b9fc5cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4368	DiagnosticsHub.StandardCollector.Service.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
4300	elevation_service.exe
4300	elevation_service.exe
4300	elevation_service.exe
4300	elevation_service.exe
4300	elevation_service.exe
4300	elevation_service.exe
4300	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4676	2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
Token: SeAuditPrivilege	4784	fxssvc.exe
Token: SeRestorePrivilege	2368	TieringEngineService.exe
Token: SeManageVolumePrivilege	2368	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3356	AgentService.exe
Token: SeBackupPrivilege	1676	vssvc.exe
Token: SeRestorePrivilege	1676	vssvc.exe
Token: SeAuditPrivilege	1676	vssvc.exe
Token: SeBackupPrivilege	4796	wbengine.exe
Token: SeRestorePrivilege	4796	wbengine.exe
Token: SeSecurityPrivilege	4796	wbengine.exe
Token: 33	952	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	952	SearchIndexer.exe
Token: SeDebugPrivilege	4368	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4300	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 3660	952	SearchIndexer.exe	113
PID 952 wrote to memory of 4692	952	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_f133a51b6840f0db7a6d0bc16f175b5e_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4676

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:636

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2212

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:976

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2108

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1808

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3052

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4760

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3380

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1368

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3400

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:384

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3940

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1068

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3356

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4624

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3660
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bace25903122354d7e90f80930ded429c3b20e8b91db20d3a0797e8ad7894839
MD5 0ea57c00784f73fe0d119b782346d4ae
SHA1 d8ef5729cbf70a3865d849a2c2802e083b035788
SHA512 02e4119c535753d13fa9fc4345623d35d2d9431b89a425a4ba4f193deec2600770cd489dcbf7fcca3df8be1738ffa1c46b6ae5c66d5c7307ac385d23f2f20764
SSDEEP 49152:yb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnk3DqqldPx:U3q6mjBBDqIP
TLSH
T174D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 56b1e875517f2316e28aa9d4f1b673ad4ca062fc363657945eb62e0b52ed22d3
MD5 02bbc76994bf1432b652a1cf1e172ef5
SHA1 36cdedc99d07378bc3c0406b086bce81be25573b
SHA512 f7e1f95a388583ea0f6ee50b3e3c256a60267c557345c4e50b38101305628357c7d8228cf3df284ad00df6cfe5a18cc769007734d0e7c7f45c61e6ded6d325b7
SSDEEP 24576:6XYfDtczA5GEDqHKliE9JdpTCePo9L9QIE:htce3DqqldPx
TLSH
T1EB65F12877D109FAED678238C9B28512EA33BC554764E7CB03E4A9254F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c1754ee616b6ae7dfdad1ce820af579f6984853fea88b7a2ad97f37c5095ebd8
MD5 6da27b1696e2ea0c574bd17ad71a061d
SHA1 85f2519f18cf8777dc0c2a9cd67679e3585bfb46
SHA512 b59a45c1c7220cefe21ab79abe1bec2bea1440a82845a3fc130fc56e43f0d35629477b6dc5abd24d7962e6277db96a1b0c8304c90bc4b7f733712154346b076c
SSDEEP 24576:U0Le5ji0hmxgrMcGEDqHKliE9JdpTCePo9L9QIE:UPji0Aq/3DqqldPx
TLSH
T162859E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C6F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7bb85a67d189c5a908c779841435deaa411f25fcaad2c7dc589f09f1d3eab34e
MD5 1c60c2ec8f0d8971ce09f1f655d41b83
SHA1 7dcfd34b4c866d34a44375ac126d46ee6b09d37c
SHA512 6ffa8c124da2e716c5d5c06b6533c1c90b2bae7e78cddc7b6c4a520f69e40904bbbfdd41d3878508ef807d94bb1f2b9dbce38e35d003bb142456112b06aa5a06
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWj6q8wyuuGEDqHKliE9JdpTCePo9L9QIE:N/ezSC6vUzPv+HjyL3DqqldPx
TLSH
T16B755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 91828e7e0bc3b9e0cfb2db94d173f241a550ae07315533479c47199f15ef8bdb
MD5 a59d612657ec1a9f9505e888f9af8e66
SHA1 1e4917399217095a1932d60f4806cce339352208
SHA512 7d4ac84fe2b99ce041e6fb9ec8694f40f0638df4bcc27d265e1c8152324bb81bfb72b97fda68ee21930063f346ed49e1ba363ab53eb1574b4bf6d489f2ae2325
SSDEEP 24576:oVbqPb88hv/l+BNGEDqHKliE9JdpTCePo9L9QIE:oVO88hXl+f3DqqldPx
TLSH
T1AB55AF66F5B48331D073C0BAC5D2A69AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 668a73c75b9a6afc6e361d45272bcb278026444c4ecb353525b9b85a1f83a5c5
MD5 934e07897a77af489a8a609067b32b13
SHA1 004674ec21cff07b47e63a6e302b1a269f83ad8b
SHA512 6cc365a7da84476302d791b16ccd97f9d0843332f8d63593e55e94df53c4596a4a1d74e36716b60b9f02037a3ea70098e699e73ea40eab246df8990ffc939010
SSDEEP 12288:84AhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:84AGEDqHKliE9JdpTCePo9L9QIE
TLSH
T11A55230DAEC64AC3FBB73A3057B86167FD25BD982C6E768A8B833D01C479479E45B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 43900bb09ddf89adf9f182a8f7cb645b89d95929209803e7aad86f03588f3eec
MD5 35e57b3f1732897f9ad36dc99b811405
SHA1 1f7be527a71ede263f6493e9d9c4f4ef1a38b8e6
SHA512 04c74769dd97881c539c703c8f46e1d3ea515bfcd676b856294135f0f61e97c96a102f4bc2f2f567e8bd9b779f05bbae9186c30dd1330fa797dbe0b69ce47c06
SSDEEP 12288:LeBNUbTVO86UlhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:LJIUlGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1A775C03BEE28FCD2C27A5D785B918200E77278704F62A3CBD165920ECE235E55D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3118a4f17616de5deed95e0bb217f1945e570ceb83c6933f5610b793bd35a8a9
MD5 2b7c69ce1890fbcbaeb368d1819d0be5
SHA1 62f10a59589a4ecdc05a8f6996839c6fd6259ecc
SHA512 76f22223696912f116248795b89af043930118da51ab3180435bd3be2ec7f9c8b2d03420e56dea643dd5ada6f23c371ee2bb0816df66d260571c4ada4f13c0f4
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THB:4QvGAdlCEL8c/WRNw5C6DqIP
TLSH
T156267C656BF880F5E0A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7cdbd5bd1da64bfa734e0a3b61c7d8a5401140804acd4c39740c24afa0ae053b
MD5 f4a72e1514cf536c7de0b94bb8305191
SHA1 e46cf1b871f6ebc6ec2c83af3bbe5f4903ded606
SHA512 0c3f0d53d21713b7639a49b4c43022e875d6b788fde783fc2dcea69a61fed943c1e3d8f703eded57f4845b3a15dbb42a00d30e97b3d2b23cb27bbeb3ab00a752
SSDEEP 24576:MUewsAjPGEDqHKliE9JdpTCePo9L9QIE:VljP3DqqldPx
TLSH
T17075E031FE75D432C7BB0DB21B35D716682DB9204F622AC3E3E86D8D89741D22376A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7321febc9e1c3d4be37b9f68702778c504fa6d5b826f8177576a94f96d3292e1
MD5 44c8a1e659170fcf0d476684bdac7c7f
SHA1 6330e1da25d49353927110b40040b805f673df06
SHA512 7c82c0dddc8713052eff6568fb82ad9f2fcb1efabbbb04e29f2660d84cb581e0954f514051e082e8d12ad19ae0cb7fbaede4c314ca6a89ae3d71c47973128602
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHHD:9UEtQevvqc2W1cpV20I32H
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 23c8007a684240630692542231b2585d0a9b95fb752474356a74691e47ec4bef
MD5 47e2c7f983e38270e3367dfcc7d35845
SHA1 5834acb957faad50981b8adadd1ee1dd524a7cfb
SHA512 8bac99199816481dec8ea433dae277c58297b23f99fe7a24332a4cd03273e59e68b831bbf6dac272c588ad91c8a6a74b93cf1f2e8e0e0bfcab27c279fe3eb967
SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/zv3DqqldPx:HoqtVjnm+DqIP
TLSH
T152D58E0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2eaf16696e8fb1155bdbd9e8315946c03fae304ebf5d3a497439255b626b849f
MD5 3feaa229ccd1787caa96f0fd88b9b735
SHA1 735c4c6fc45b833092287cf945eda41fb6dbddc7
SHA512 f976ab0671f528a31f0e92957abe305baabc882d1aaa9f6593b7b69ff083167016da0c2c773128ac96c53ff4b4260ab93589d0850b0ba45bc2cfa58e31cec605
SSDEEP 24576:0AhGL6IFoiwtA5l7S53qGEDqHKliE9JdpTCePo9L9QIE:0AM5Foiq5a3DqqldPx
TLSH
T12835AD80EBF945D4F5B3AA7899B69171EA76BCAA5E31D20F2150D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 17ee9c80f63fc6a9c1b6ba2f2ce30ba031e4552738f56ece2117880f38922101
MD5 10264923ef816602b2fec76027fd4712
SHA1 08f7fcdca0ab4973f6366c3802231217ebca42dc
SHA512 aac92e641a7473401699e77703a7b2c9c0a47d3d82b07c4d4d74f204b9cd248c40e741dcd943600c08076e36e055cc86d0fe67afeb76418f63cac8cdf0313317
SSDEEP 12288:wmw5HEjsChNlBFgl0WDm+COhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5It:twuEOWrGEDqHKliE9JdpTCePo9L9QIE
TLSH
T15065F14976E50CF9E9A752388697C136F7B2BC012A25D71F0760D64B9F37221BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9c38b1f49f55b89347bc0b688956d1f31fd8008c52c8295794567f1d3488a6dd
MD5 1811bccafc4efeb2586b72b44cbed152
SHA1 6aa54a81bdbc9b6d775954b386749c396c0d3e2e
SHA512 0f7ea7a5ff4e5f12d03a070df92fa96cb48d84cb8a73c61e59c022728d027765d886ff3f11bf51b5eeca6113e0933625d5182ce6b61d1fc16f0781e13a03a614
SSDEEP 12288:OUZ1IyfhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:ZZu0GEDqHKliE9JdpTCePo9L9QIE
TLSH
T14055124D36D521F6E2A36238CAF05206FB727C56273A53CF06523A468F339E56D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2e15b9556b37f8c619027f2cdef25047c8260b27df294026b53b7e66e43b031b
MD5 da3f8bcbab372174b5d1bc9c572bd05f
SHA1 15a7719e976722cc4f12a6342fe9dc9ef733cfcb
SHA512 f5e05da2484f3368861bc170029bbef688dac3e0bf7c6083131f5030f2b2863ad883e800adc731fb663d98ce1f95e3209e14e425996e685a90e6f67a694eb965
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U9:VQRQyi36YOcPDLvw2gAf+PN39DqIP
TLSH
T19E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 651fd05c2f52b20c7b24038734b7827115e17bea144149732046ecb6e9405329
MD5 8cb553c733425f7bdef9329f040f3a59
SHA1 6331d656d7ce4e4914cf14cc1165d86b397b6a6d
SHA512 9fca4865bed6ce18a4d9abd8be299bc083b0404b7b66f37811a0b523dd437d2c61b7cd65d38f6aa1d36054da01c9e71e8ef9ebf0423285d8233db9864e2d620b
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U9:DQRQyi36YOcPDLvw2gAf+PN39DqIP
TLSH
T1FD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f9949f9091326d5c1ac9d8201981276f80ba9f79a99a714d04a564c856b29af4
MD5 bb27252583b1a2d891e8971875122a3d
SHA1 b709e9aae23231b3d9a9445ef1a995a1f544b54b
SHA512 622b6990278ad19fcd4d81e5b3aa1ebf76fc7c8f686d4a3b24ca7d678cd090d4197c75d0788badcca9ba722e0f56ee3e69e9759a475b87fd36514749d2497faf
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0kGEDqHKliE9Jdpl:r68Qg55nhkeWu7PNU3//3DqqldPx
TLSH
T1A4B55933B2F20099C44DE1769F4A873196E27C758FE1E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8f7422fbb5b3662b7f4bf29de8db2fc8e0cb980e14ab7b2e682176325f9756f5
MD5 fe830a8a62ddbde5ac5a7f38bd686be5
SHA1 9396663bc57b25cc8cdd10ba7f9c6d6c31d80e55
SHA512 62d3d98af76e8598f4c320394f18b8d67073f91edd00a8a3fc3d240e3075c3e3fac0d80ec3a998538fe486a1290898074de105db3cf8769d4bc772005cc934ae
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99/:Jy5112gYy5azzVvU69nLKnhZIDqIP
TLSH
T1F6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ba9f373b984e156b42749d44f8adae7e50337dff336a2cf133a056dd76a1f99a
MD5 f76db33f3f1e5c5bc64ec248c19c9bbd
SHA1 9041b8e946d80d19aff170d4cb130e8c223657a1
SHA512 d602640a77fb51dfd6d37471ff06238b9166049b0e1c2a89f8d17837d7a8c40e9e25593a5c7bd4924b8e071eee41a2447084c9e06cc05ea79be1d455e253d2dd
SSDEEP 49152:qB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glp3DqqldPx:4u6JmIxd2d1DqIP
TLSH
T101D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 81e1326330cf9e9c69879e5a6649391fa7b4801e8645b8c287fbec3e657ac8bc
MD5 4339f0ad1291e51e70398c9a21d8ca93
SHA1 2102860d1f5624d8bb386279efa16ace1deb5113
SHA512 f0f191d4b7a0b87f93c188b5159efac38af2e5c3bc68c59d962e7fa7a07f41cb29530f10c07f957ce4dc116b60b3077a9da657496854697f1e66856a5f41412c
SSDEEP 49152:G1hpsNoJpF1A67U44CwH7R4xF3DqqldPx:GmifPqR+DqIP
TLSH
T19AB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 74e4bd16ff7dd9a9a005a48267ee29be112fd898f766d540024f43f2bb3deb05
MD5 0b24e63ea6dd291e66ef7490317822b3
SHA1 aac7c35465a68ecc27c6e5a20f6b1472d6752ba0
SHA512 d2c9ba487287b3241b0c04ef3be8ba22932cb46f683f7aaac5172563c927bf4aba5cb3ef60f565f94da7e2cd7160950c4b48a33dd9460a83e7ba5aab5795c0f1
SSDEEP 49152:xSuZQIY0Be2KkRVtOnks6NMHq03DqqldPx:f5dKqi610DqIP
TLSH
T1C4C5BE03F2E941E8E0BEE67487769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 643dcad75c3435aa6bd3b89502d4ebfa3c7c492f197e504e677a3c9db5c391eb
MD5 892f30cdec7ba52aea80ebd9f4eca493
SHA1 72eab30a33fbc35be474f82b3844cd5ec89574f5
SHA512 2618579b23c4f6c7338578f4fb105fb0043cedb76c3c7378df403250acf29c982c62e511b3d6c2354ba6970a7b4124eb2f378cf63cd1b001fc6ecf3a63f5120b
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5w53DqqldPx:FX2iWphCDqIP
TLSH
T17195BE13F2D900E8D06ED174C7568632E962BC160B39BAEF0A9076561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bf370d2f822ab8d4b826a7d2515ed0e67851527f82ec457d2b5457079ac03ca5
MD5 80ac33879c7863f1c6fae49aa59e81d7
SHA1 a08e175b3ca2c5ccd5b68566bb2b26c97b32d264
SHA512 afeeeceae52ea04157fd4f286a09fcd3f20ef3d78f4fb5648c619392057efe1d48f8866b4731f51df8a4f79e13be15745ad0130146ded79aa45a6769cea6bc71
SSDEEP 12288:U4hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:U4GEDqHKliE9JdpTCePo9L9QIE
TLSH
T1A455230CACC70BC3F6632A7187B42257FD29BE8A7D6F328B57873801CA7A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7439fc754df518d1cb29b73523522d6a993cf0c05c0e2cf43d185ee9c3e86357
MD5 ae6a73d1eca915e4502e707833e6f626
SHA1 269ba166ff6cf6b8a3f6361801a61bf2be1dc650
SHA512 7721af14dfb7a41bcb7146f6b9ebdcadf17bc7a851badfa88632a4f0341a2f50921f92b27120a0808ecdca62a249431e6347b0985910449bd5285122ea22125e
SSDEEP 12288:wzhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:wzGEDqHKliE9JdpTCePo9L9QIE
TLSH
T19C55230CADC70AC3F6632A7147B42257FD29BE9A3D6F328B5B873C01CA7A479644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e24f8fd006775bf0d38d42ee7bc22d9ffeb4dd0faa412734041fef95d5fbff3d
MD5 37071e6a3246dbbeed28f16865f13dc4
SHA1 f88c4055d2047b43c1bba5da6143f8b744497be9
SHA512 4f91a77c88e847977f337a2c46991e1484e27a761516f30b0a12140973c8fb7cb020472b16d092f87981323901b251f99508f54215a688d465a1ced0c7a7231b
SSDEEP 12288:z9hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:z9GEDqHKliE9JdpTCePo9L9QIE
TLSH
T1A055230CADC70AC3F6632A7147B41267FD29BE8A3D6F328B9B873C01C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 bb8fb796bdea7deca48a7b4d7a85b7f346e637ba43465a37771c480331fff7ae
MD5 2ee48eff74aae3a263f006417f244562
SHA1 009848e9fdba5f0f3637f2dd32b59a7174269e13
SHA512 dc89c5acffaee8e444a585ead85538f66be2e689c1ada130cbdbb67a6e355a4f83347456070e77d13c6004f3dbb0663b408d4a94e9dc77cb0a88a8eb887c10f3
SSDEEP 12288:dVKhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:iGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1F655230D6ED706C3F973A670C7B55152FA75BD997A3B63CF8B423C01CE720A4682AA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 720a58ed4b28d82ca0ee41ad0d5fdcd99bbadf069c887fd15754a79bceccf9f7
MD5 4650493d052f519ecdd5155ad4d7962e
SHA1 6998405d6647479398db629389cfec254823ece2
SHA512 b5008c99e08e707d95bab69a9de36b74806cd03f7ff6b59effb4652981fffb0e6dc966ff0cf476372cb609717aaa61bfe77f0cff175b2bc014adf63fcdba72fb
SSDEEP 12288:gShoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:gSGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1F555230CADC74AC3F6632A7147B41267FC29BE9A3D6F32CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8ce3f1ce34ea17e206ac29453649d2eafa6ad42831cd61e390867b1344d5304f
MD5 71070b925c8aa811aafbb6d902b484ff
SHA1 cc596391a026e7f2b5d78dc34cee40ec90dfe65f
SHA512 6df28f492607e2d0305c1817533f6f1a1c2f64e5bdc8a9a31c30d2d6bf780fbf9e504c6594aa2299ecc393dd4d807ee902932177d0a5d89300e1e28f4294e935
SSDEEP 12288:xnhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:xnGEDqHKliE9JdpTCePo9L9QIE
TLSH
T12055230CADC70AC3F6633A7147B42257FD29BE9A3D6F328B5B873801C67A479644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 365afeac3487819172280579b675fe6553c5417e61b94f782af4a6daf755d85b
MD5 4e39f856818b4575f19bc75329fed6ce
SHA1 07b2abee841e53498ce307ec16f576ff68e83e55
SHA512 cc635ae5eec21701052b27e75c5f4269a3f1c3465c30280ab97acfdccc384af46de517984de2a854b3c2e3df3faf8c1e75d7e8d6330c8c27359980f34d0c8bdb
SSDEEP 12288:wbhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:wbGEDqHKliE9JdpTCePo9L9QIE
TLSH
T13A55230CADC70BC3F6632A7047742266FD29BE9A7D6F728B9B873C01C67A479644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5e87870095fb14b781bef5a3bb8307c7773241160d37153184ca602fe2be7691
MD5 68900a4ee534973d0df5236e627d204b
SHA1 bbaf9d06f5624c776b63e361ed0f1b3fa49ffc7d
SHA512 68bb346812c842e39eb7d321252f0cf5b09eefc01492c48ba6eacf2e4fa1c7a6a6dc95c91532dee729506681e88de19e2100aa2ba91cf5283cbd49ff3ede65d4
SSDEEP 24576:ZZM4zFVSOTGEDqHKliE9JdpTCePo9L9QIE:ZZM4zf33DqqldPx
TLSH
T1C3750199B39018F5EC67823EC9658916E6B27C5A1B70C64F03E436179F333A11C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6d017b84818249945c4e407d36c7f572a6f2aa8627ead02837f8726512af78f6
MD5 9c8e31c4a1a15abe1ea77b656be7f880
SHA1 0b088440ae975133f5c2309deaf39e686d49f015
SHA512 95d3135dbab2ee4cc075cbeb8ce797853a545fbd33816aa4015ad17b4cd532a643d4624248ff8f108f63523946b78e7fe7f31645094233d59acc22d72b527003
SSDEEP 12288:3EhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:3EGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1EF55230DADC70AC3F6632A7147B41267FD29BE8A3D6F32CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2fb1a906adabf879f3e8323176d9bd9af281b1004ac047ad702afb6b86753e24
MD5 1928f0eafeda2a6e1e57f64707c2fe50
SHA1 c042f53968c1134870f3b0a238b51f59bc55c2ff
SHA512 fc6b06f81fb830fa08df993881a502721b63111475fe77c455ff974eeca8eaf6df1eaab6ebf43cb5402d87a8563f6394e7359c0084b3e69586ce8fbe2bed4aa0
SSDEEP 12288:qQhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:qQGEDqHKliE9JdpTCePo9L9QIE
TLSH
T19355230D6DC70AC3F6632A7147B41266FD28BE9A7D6F328B9B873C01C67A479644B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 dd89414e6d7fdde9eb447fe39f965f663e745414879bd1d205afa9c84fa8db33
MD5 9faa58fcf3a19899ef900381b17de21d
SHA1 0040d0e234f426bc6ba047ff2c226d99c549f70f
SHA512 7f0979f962aca21c02f584daacf2747bad79ac92a14005e24022f1559fbe1d7075dce5996ea06c6f811c94ef46379402eafcb58d685bb6cbcc38a0b8ec8308dd
SSDEEP 12288:ZyPz5L8fhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:YzyfGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1EF65120B77A221FAE1775234C9A11602F772BC361B259B9F179026369F375A09D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d64f3f93918c3a55652a9f1ba7ede37cb9c1ceb68a0d6c00bc2d7f66442c5cc5
MD5 ccd7e7f556a0bd544f8af5a16b47d706
SHA1 3423513d14e9bcd3ee0cf0101f46d7ccddfd5321
SHA512 84166d6978b121bbd24ab37cf694a77145b67476f28d391d7958a26d87bf56a8a1482d122b8c428bef86f4eec4a80456888f24bc1153665824e732cce52dbb5a
SSDEEP 12288:aEhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:aEGEDqHKliE9JdpTCePo9L9QIE
TLSH
T11F55230DADC70AC3F6632A7147741267FD29BE8A3D6F32CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 493675115ce17e6b364e902b52b95f1ecc0fb4717903114046a75355c639e1f0
MD5 df28a4d4806ce68eb090fb1451e92361
SHA1 5edf39a9aed90c6043aa7a6561d0d499a9c1553a
SHA512 b42d5b9b80b062c37026db24604bae661533e12916e3ffd9e38023c4592b26dee9a9ffc9e6425b8a772d710ea435e9f64c30849895b7d289458052cba4c1d423
SSDEEP 12288:XEhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:XEGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1D055230DACC70AC3F6632A7147742267FD29BE9A3D6F32CB9B873801C97A479645B450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a49f80a0eb2b84cc535216b35cd98a80b994c7ad718dc3c8f8b5cd1d8f3b6570
MD5 7277a7e82751046c13901a599f787aff
SHA1 60690a0fb871d07aa4ba8cb2ab8220e6f5a7e643
SHA512 1e663f3099887f0ab5dfc204f7c26d379c8a7248051a1ac2236085db6559e293c2a19d19018ea7337c93659a6f05313dc33d69b020fa25de0151efd5d4625012
SSDEEP 12288:zyPz5L8fhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:+zyfGEDqHKliE9JdpTCePo9L9QIE
TLSH
T19D65120B77A221FAE177523489A11602F772BC361B259B9F179026369F375A09D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f1c7f5c1125c75e1ff02ab90a6bf5f88932a39e6c286100bece41dd3a482e4b2
MD5 2361034ab608d433664a7e52cec7084a
SHA1 0f57f79bf40383f68a27186bde847951f3fc83ef
SHA512 8fa3f4ef6d023821ddaca98bc2192e7e972a6a7a8020032548db07af4366d717d7d4669a72a07817f0c19ca40ed58ce96f94511d8733008824465c0dc0fda0ee
SSDEEP 24576:hcP4mcvIjkGOxhKP2l71nNKbrh/8KBMGEDqHKliE9JdpTCePo9L9QIE:2P4m4IpOO67W8K+3DqqldPx
TLSH
T12165AE2DABDC0096D0BB917485658A4AFAB1742A1F3286CF1160A33C7F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e567f1e91c4078531ef1e1337de5e28118a8bfe8ba0ffc319fcc12f0c87a2974
MD5 3e29a29dc14171bad748b799261d3815
SHA1 deb3f7c5e50ca62d519b62607a3b64499e2db1fc
SHA512 ea361f4e9e538b29a3607504cc145819f9c8adcb621a8c3e846123789f671958e40c5ba25cfb0ea4a322fb82b83556336998f65e054d9887b178c063858600cc
SSDEEP 12288:lmsf0hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:f0GEDqHKliE9JdpTCePo9L9QIE
TLSH
T19465F009D29802D9D06E6235C7654642F7337C6597E2E3CB53C1F83E4F7A5A0ADEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cc4955ea7cb7f8de430fb8848668fc0cb8b6fdd2c406274676a247d0fa933439
MD5 f37c638addea5c506de72f154c188aee
SHA1 c6259755ad9b3857d00c1fddf4aa22254191cad4
SHA512 907b2988f013bdc9dfc3ffe3907bb91e4b4f5b8e40972d28eab1504ee17854b5fb96d0ab8d31b857e445aaf5c6638ad43d2b0fd067fdd3001613b87098917797
SSDEEP 12288:9UhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:9UGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1B155230DAECA4A83F6B73B3007745136F92EBE692E6E62CF97433901C575875AC2B510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6cbd9e4d7425e8f6d18f023a97e51d63237e80598767040e37ce176a894d07f1
MD5 0a8fad94ec17bb9941b035254ce5822b
SHA1 d33077d9cfa3e956de406c3cf1dd6f3f04acc5c7
SHA512 ca132b94055232d24c99b8d48db46f84d98a661cf9f05f416cdcd7cf4b5a17a089aa6ca7c031d99b4e6e6eae85e1c5208272efdb118538ba27d5a8eb6ce364e9
SSDEEP 49152:9a0h2GEkuAe73q3pp46zwwQS3DqqldPx:9a0hNYG4JwHDqIP
TLSH
T15A85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 8e35bf455631801107874fc93bd3c44c659d438f448db367f42e1657f0da8182
MD5 b6823bd3c07185f3cc453801395f797a
SHA1 eb7ded04c2443ac58863e73cbdc9da1071e62ef5
SHA512 54d3a932db57debce40ebb838ec4194d5db334f1b8804388dbe2c9531154f9957291acdc08b3dc3a3113aae98ecc0b01e03b2bd37b5b1fe3619b680f38d225d5
SSDEEP 12288:OhbHjfXjhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:OhbHjPjGEDqHKliE9JdpTCePo9L9QIE
TLSH
T10455126D2AED11C6F572A27886A54107E731BC252B26A3DF13C261398F3BDE45C3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b4356668be3c59c9bec134cf263874602318c5301a157d5a684cb5007ee39d8d
MD5 220feee7fdbb0ebabc0710550438b065
SHA1 cd4af1cec0f48afc4ffc2cacef7e8583740bd520
SHA512 b36870e4bfc3847ad2e9fa8b0176d322addf45dc67826d9d6a7469ecb8b7dc9ea8d9db1c9cdc49f61e4ee4f30920de4c0c7a35a6466c5be698977da923c1c347
SSDEEP 24576:Z3YgnJcRTk4yti+R5dBR/rGEDqHKliE9JdpTCePo9L9QIE:ZIgnaTk46pBR/r3DqqldPx
TLSH
T16B45BF2DF2F910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 46a8ff13b2ba696ab2260b2c0d807a5a53d3b95f75f87e400e69a44e91cc34cb
MD5 05474b15bf4cbc6d8c49133f01d169c3
SHA1 ecae43df6fa8e1400477748d0348f274b2c3d870
SHA512 80988b18b87b6f03d03ed702387653dbb424ba0a190de1d5caa4edbb21246807491e70086f84d7b500c13df403f4c6d673376629a975d89b421cf673a5f143c2
SSDEEP 12288:IghoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:IgGEDqHKliE9JdpTCePo9L9QIE
TLSH
T13E55230CADC74AC3FA733A7047B45226F924BE592B7F23CB56873801CA7A4F9647A550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 ae966b872ccd361625155d21e0827e301ac1accc82cf4ec0ed18419ca5783ce0
MD5 2a76841d76d59ddb392515859a81e43e
SHA1 238d028577e7762a1ad03fc93ed244859f4010b8
SHA512 885539f6699910a06a41d8afc6198baa33cc57bd5a2956837799b2e5713178c5c5c8c3547ba01808236bcee759c45fa11f796cad56e74fbf826baf4945f2546a
SSDEEP 12288:wObLA4LWOsvAYFT5hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:t/L3UT5GEDqHKliE9JdpTCePo9L9QIE
TLSH
T148750118FBD500F9E97B913CC9B28616E672B89D0764E7DF03A81A550F236E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 4380570ea4fdbaab4ba8165a8d29726ce6be2db2f64a0e47b55a913fa0870cd6
MD5 f7678e2010dcd5310aab921480a2aed2
SHA1 b9d2a89794cfb93c588c33674b36d700adbf69ed
SHA512 cfae7b6cbc65238217563e99f4495d8fd716e9548fe4fa5ac9cbe8b8c64b42f0798436f0ec92b58331336347a7ca1d3c1e4e29c6fd46bbd6024bb3760e6be261
SSDEEP 12288:rpFtqOFhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:oOFGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1F355121D36DD10D6E576613C8AA2430EE771BC661B2263DF02D0616E8F77EF86C3AA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7d6e7b5fcb87e68da3761ac3af0276f4f4b848f9c4104d3c584732f7a4ad6f7d
MD5 39fa20374d65b3b0b6a121d5277fc929
SHA1 6c1343822fdc131d04f81a279322562357d91f5f
SHA512 18391650250375bc72d625afb61eeeae74301ef2d46656761446ccd86ded41177a88fcc67ffe0372bfd407a346bc1320c06e1ede530c625448aa49fe070c788f
SSDEEP 24576:Q7NM9YqZqmWMUkPjZM48Mv6bEhsEGEDqHKliE9JdpTCePo9L9QIE:Q7cBWMpPjN8DbEhD3DqqldPx
TLSH
T12B659E2E6BEC81D5D577D13DC9A28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f9700cbc70bdd677863d00215e72d98c23dec155b58262d3fa7ef23ad8d8e6fb
MD5 f489b11cad6d43c9e60a64d36d193f16
SHA1 3b8bb07f95318525c9582d4811d37eb26ca0934c
SHA512 007de2a64772b9f827a4506d6ce48861ddfc12e7dd818da7dac95b118ba14026d4eccd53c4089f9e3ae55fe91999c9c967694204e2fd90178e87c666a19ce98d
SSDEEP 24576:bW6BApg2YuyuNDYTabvcdvNYf8km12GEDqHKliE9JdpTCePo9L9QIE:bF2YuHNETovAvNYf8kmk3DqqldPx
TLSH
T121858E2927ED80A4E0BBD27D45B6D246FAB2B8551B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 440b4a20aea2d81d0835f99bd26bafd0c591d620401535e2c75f950e5a829ff1
MD5 9f81c8e04758711f51dc6a9585c99426
SHA1 c42040b02cc47aef601d8f6d7febe3a9bf0620bf
SHA512 b2a1376d28cf5a84580e72b345a7146e73ebea468b71b068ecc9e955d9b9758d0d71c4f19ab7486a5299b5907a040d7d859fe5b1dcd4b55ae925ddfa33c7db32
SSDEEP 24576:SAFs06+Omlf8NXEbToxGEDqHKliE9JdpTCePo9L9QIE:LFs060loXuy3DqqldPx
TLSH
T13C65AF2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 c1870c6511dc9ac37d0af54385dea898b356ab409fd4cc406a5b4e476c9a15ab
MD5 7a0f66c1ecfb6333c8c6dd66cb608f32
SHA1 5f2b14e160b6f3d9b8fca00ade8bc688242386d3
SHA512 61646c590c22cf59ab959a47a0f51aea1739e7881de9edec8a56379addfaac7c6909b2dee0665ebc5f1a9f4f314aa19c0b590d7f398603b9a964ce153bc1fb9f
SSDEEP 24576:LJnJ5D3WayGEDqHKliE9JdpTCePo9L9QIE:LJnJ5DGay3DqqldPx
TLSH
T1D475E02DD2A810E5E4B7C274825A1756FF72383D2F226AC718B4E5357F22EE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a9fcee3d0f3cbe32fc40f0f9d77d7aabf174612d92dc0190e342075d77a63cd0
MD5 b2405772636b03c5243191d00d3e5d09
SHA1 a3e40c265453768a050b2ca520a3c05cbf488a69
SHA512 c9aa2db8139a0d0768e34f8b61c19e0f07fb36310567b048aa87663a5ec9a8b989068a15603a87e6184b8b4a2b262c6075060d4cd55a9fa8ee1e22c24e627f2f
SSDEEP 24576:yEPghm6/7IIXdwcXrif7qQncjlP65i3VurGEDqHKliE9JdpTCePo9L9QIE:Fg06DIKdwc+eQnSt65aV43DqqldPx
TLSH
T135956C15BBEA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 b075c4c3298a99921f50f7f7d59dafdb070c861ce65d60b0844b082c98fb42fc
MD5 7761fe9eab8818c2cbf1ea21588a48a6
SHA1 da8567a2dc05a6ff41090b4dad705938a6350cb8
SHA512 9170d5490a7b09d10307dca9381e2fcc429283e91750fb1c302430d5d0af9d1c5036e3dde4b9c9596d0cb1edae64a50e9a02d5bde106c17809ce1ec9b4c073d9
SSDEEP 12288:yEP3RSOhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:xSOGEDqHKliE9JdpTCePo9L9QIE
TLSH
T14E55125D2BDD60D6E137A13986A08206E772F4742B6627DF06D2A13DCE778F92D3DA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 e55364cb2921647a520757baa6bd41297b457fd7ae501e0ec02739a2c4e634d8
MD5 9b4597aef256e3a933c31e2a8c27acae
SHA1 894777263163e26b1b6fb618b5e2094372168779
SHA512 d2f1dc31c4e0d66278d076278932a18db3266e981fe4ca623e7a7b7983ccda04649202461d9292b1a6ed315292c0f2ed838132e11bac22cf4b0f6e89782dd301
SSDEEP 12288:PjkyzhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:PIyzGEDqHKliE9JdpTCePo9L9QIE
TLSH
T1A265130C67D455C6F6B616348A7242A5EE35BC202F2663CF51C1BA2EDF37AE4AC35B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 f98b062659acceb80ce16b7fa2ace555c50a5dcaae64513deaf4751fe1e337ab
MD5 60f3d704efed0768c93e9e60e748d33f
SHA1 f28e7860f0642470bc5c44dc03e1c532d4bbd93a
SHA512 f4377eccc37c061cdd1e7827ded26cde05ff5c45a07c26310db6430523f8398710956bade0c8f8efb9f73011ee1e3e72ecf3d333b62bc6146fe8542df3b21ea0
SSDEEP 12288:00VhoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:fVGEDqHKliE9JdpTCePo9L9QIE
TLSH
T18955230C6AD71AC3FA732A7047741262F935BD693F2A32CF56C23821CA7A4F5647B840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 fd0c787642748ac04b0f060d36258dd09319ce296f6c67d6d38e0bebba5012ad
MD5 a8a328a25021b267d5e25f3c7c251bd4
SHA1 1b99a5d2baf8455d41a7770c225f18052035e958
SHA512 ab1b60a901883668ea86dd413467d298237c62ab5736991137ba4696ce3130b4c234aed7bc3785b5f576c28dc568e46b60a1c6998caa8607e24381ffc8982be5
SSDEEP 24576:1Q9MxZKdcz9dw38GEDqHKliE9JdpTCePo9L9QIE:1VKZ83DqqldPx
TLSH
T1D7558C2DABE9058AE177D23595A250C3A633B4311B35D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 91c690c9c18f369f8480a6a142af01eb636a4fdf5607734ec62346db6d4a4375
MD5 14b6d9ddd64142861aafe2681b26e853
SHA1 72b27d8a4ba3e7333f0495db25752581936055fe
SHA512 c58a5362ee694aea090257142e3fc3ddb9e8f278f44b89707a76785bc87ac1f427f104368107ebb3916717ceabfdb91eaa60f24aa849f1e78b6025629e2cf95f
SSDEEP 24576:HyocSApPGEDqHKliE9JdpTCePo9L9QIE:SocSApP3DqqldPx
TLSH
T1E265E01FBBAA40D2E176913C89858345F773B4301B6263CB5682873D8E379E9BD39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b2fbb695e32b48b18cae0e2e685e7f08c51d0a1f29e3c2ba70c513beef729fff
MD5 5c3450826d941eeb0e7817b8db845b4d
SHA1 a9ee8bd06889a357b4c1ecc337c1899d9df3e496
SHA512 8ff060717dc8d3ecde901b07d92b9f21c19d1323a0700306cf3eda9c2ab5482e6595a5f53981c93fbfa1a5eeb96e444a2f9ce693e02e7f3e74723cef267b5f13
SSDEEP 49152:DWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKP3DqqldPx:D0zuNIlDqIP
TLSH
T1A6A57C3DA2F800A9D8AAC375C54513A6EA71742E3F2065DB01B0C57CBF2ADF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8c5039f65ea0206893cd5ed435dfaed20b6bbd7133bc15e6db91f0c2155e1e51
MD5 12b1f5b07977e752e7af8e749c9f77b8
SHA1 cfa969b1317105d635d0a961d750d987b78a16b7
SHA512 b18bcbb79c4d37453f1a7b55e27c353d96a5bcc934fc091a74807996bf8123eb3dbc5b435df18285c073d16100ba164cdd5efccedc114df736d1b3675023a964
SSDEEP 24576:t1QT7EcpfxR+N5AWAz3ooiYzjMqbOGEDqHKliE9JdpTCePo9L9QIE:YTDxR+N5YzTBjMl3DqqldPx
TLSH
T18455B02EA7F915E9D1BE85799B23C512FA727821033193CB42A0C17E0E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 c172a4b80d727e54d3d8f34ffa6d60d4ee60e54c1fe538a79b799eb0dde32274
MD5 3b669264f5c8a3c9d6dc8691ab39d2a0
SHA1 30d7ab5daca2d3c3a2dbfa2461d18ae0ca786d77
SHA512 c248c19bbc08548230fd7e68c1b8a94f9625a7aa7bb7e51839d03bae7b10f1dc98cecdf81766099ec741d40aae7c06a5cf73a85729db4fff4fdc506c37428b88
SSDEEP 24576:4TMdOz0FFS+ZmSLKGEDqHKliE9JdpTCePo9L9QIE:Q0K+ZmSLK3DqqldPx
TLSH
T19E75F13EA7AD14E5E47BC27C96538906F6723865032276CB06D0D0796F6BEE4393EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 b2f2ef4e890cc016ea472d44a3bb7243139a8b2320f27b0f098bc058bf1c12fb
MD5 5022cca8024da054f176a57be8e0bf31
SHA1 2ddb5b21839c688027f589802d0a1f2969f3a98a
SHA512 d3f67aa106b5b7b6364730e0de7cbc66a7c7b634c0849fc9b85bca624d65aef0ac5a3a77ba03b4b03b670f7c83ea7e8e0730cdd0bd5da7c2409d59ba23e7ba93
SSDEEP 12288:44T5hoJcVMiqHKtriE9KIdpuoCUuYzNPofgWrU89cj5IEGf:/5GEDqHKliE9JdpTCePo9L9QIE
TLSH
T1AE55120C67D924C2F57366348B750256E630BC76273A26EF26D1B93ACF378E49839B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/384-289-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/636-353-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/636-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/952-297-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/952-418-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/952-246-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/952-165-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/952-181-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/952-351-0x000000000CD70000-0x000000000CD78000-memory.dmp

Download

memory/976-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/976-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/976-299-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1368-287-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1676-294-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1808-298-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2108-60-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2108-66-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2108-64-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2108-54-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/2368-292-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3052-72-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3052-78-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3052-284-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3308-291-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3308-122-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3308-128-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3356-135-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3380-286-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3380-100-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/3380-95-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/3400-354-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3400-288-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3492-293-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3940-290-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3940-111-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3940-117-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4300-400-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4300-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4300-33-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4300-39-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4368-24-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4368-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4368-23-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4368-375-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4368-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4624-296-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4624-417-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4676-8-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/4676-9-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4676-333-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/4676-355-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4676-360-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/4676-0-0x0000000001F90000-0x0000000001FF0000-memory.dmp

Download

memory/4692-414-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-433-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-435-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-436-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-416-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-415-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-437-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-413-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-412-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-411-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-410-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-409-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-408-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-407-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-406-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-405-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-404-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-403-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-402-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-401-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-438-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-439-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-434-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-440-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-432-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-431-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-430-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-429-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-428-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-427-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-426-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-425-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-424-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-423-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-422-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-421-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-420-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-419-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4692-441-0x0000026380580000-0x0000026380590000-memory.dmp

Download

memory/4760-88-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4760-285-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4760-82-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4784-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4784-67-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4796-295-0x0000000140000000-0x0000000140216000-memory.dmp

Download