d5f9b8a951acf311269fccb4f2ed6e4674449a3e304815ed6257e320dedbeb37

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 12.7MB
Sample261017-s2bljaff76
SHA256 d5f9b8a951acf311269fccb4f2ed6e4674449a3e304815ed6257e320dedbeb37
MD5 6889b65b52994c296031e4d35c3ca1c6
SHA1 1b99513b7d648e929150a682de5b8058c82e4be1
SHA512 f67e07b07abffc2741e5998df06ab815f3d4d0d8161897e3bb05a44c35bfcaccfa858b6ed8cea421bcd992521aef5bebdbd331ce9e98570e08ac9ecaa6c59183
SSDEEP 98304:oKMoMLZcpZE/Pn3NGNHoPy3beqBnZlmOj6EGRGNNK/zFEYDBvIdj:oN9p/P3NGNiyaq1ZspEUMoaIp8
TLSH
T19FD65A57EC6545E9D0EAD1308A769253BBB17C494B3023DB6B60F3242F72BE09EB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4972	alg.exe
628	DiagnosticsHub.StandardCollector.Service.exe
2344	fxssvc.exe
5104	elevation_service.exe
2592	elevation_service.exe
3796	maintenanceservice.exe
968	msdtc.exe
3996	OSE.EXE
5200	PerceptionSimulationService.exe
4276	perfhost.exe
3924	locator.exe
4300	SensorDataService.exe
4564	snmptrap.exe
3376	spectrum.exe
64	ssh-agent.exe
4960	TieringEngineService.exe
4584	AgentService.exe
3224	vds.exe
2628	vssvc.exe
208	wbengine.exe
1588	WmiApSrv.exe
5600	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1716f0714bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004738a86d4d5edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009efd1694d5edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000459a046c4d5edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066ab906a4d5edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4ebd46b4d5edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002d5c46d4d5edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1724	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1724	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1724	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1724	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
628	DiagnosticsHub.StandardCollector.Service.exe
628	DiagnosticsHub.StandardCollector.Service.exe
628	DiagnosticsHub.StandardCollector.Service.exe
628	DiagnosticsHub.StandardCollector.Service.exe
628	DiagnosticsHub.StandardCollector.Service.exe
628	DiagnosticsHub.StandardCollector.Service.exe
628	DiagnosticsHub.StandardCollector.Service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1724	2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Token: SeAuditPrivilege	2344	fxssvc.exe
Token: SeRestorePrivilege	4960	TieringEngineService.exe
Token: SeManageVolumePrivilege	4960	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4584	AgentService.exe
Token: SeBackupPrivilege	2628	vssvc.exe
Token: SeRestorePrivilege	2628	vssvc.exe
Token: SeAuditPrivilege	2628	vssvc.exe
Token: SeBackupPrivilege	208	wbengine.exe
Token: SeRestorePrivilege	208	wbengine.exe
Token: SeSecurityPrivilege	208	wbengine.exe
Token: 33	5600	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5600	SearchIndexer.exe
Token: SeDebugPrivilege	628	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	5104	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5600 wrote to memory of 1016	5600	SearchIndexer.exe	115
PID 5600 wrote to memory of 1616	5600	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_6889b65b52994c296031e4d35c3ca1c6_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4972

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5876

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3796

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:968

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3996

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5200

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4276

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3924

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4300

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4564

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3376

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:64

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4416

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3224

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:208

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1588

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5600
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1016
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 42457e857570372edc07ecd10387615d6e7f5e02361005198d23f4497661af5d
MD5 59959cf9c378b694bc834bcc713d11ec
SHA1 ae264c9d6dd63c37b3c0fff1709ea2820c98b6cc
SHA512 037a30435a40154fd9ee81f2590e64288b8a6846cbf11bf6deb7f2f3e4c4ee5ded6fd239eb94e2418faf1602882149121e5e8ff63ceed28d514bcbc010b1f455
SSDEEP 49152:Nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnelWI7f2Fdj:T3q6HjBBvIdj
TLSH
T135D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 aa7f1303f447605bd832ba8c2a98ad957a3bcbc8fdca9ee79e83cc6ac0c6fce3
MD5 56290392e626f9ce07253a1b49de09cb
SHA1 1303d367142a399de97873d2fdc08b50618ad65b
SHA512 f94c206450ce5b098e25ad3f7a114f3c4d685e9508bc14f6522c372c9404ad76c5675b8ca5c56f7f3348f33a6af07adf3500d9fba47a8e3b9e69f925fc8668c6
SSDEEP 12288:z1XLsswWkxy2lRq2czAvAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:pXYfDtczAv/KSWITnbD2sKJdj
TLSH
T11465F12967E508F9ED67827CC8A2C512EB7378914760E78B03F49A261F336C85D3DB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d580e251cee0e3cc1cae03c374bb92538c9d9f5fead8660084918de5f4b5f5a7
MD5 5f618daa2783782fc728903f86a005bd
SHA1 f380a16f1974433f725ac90e11eddb083c4433ca
SHA512 a1827055b6b4e2e8cc7609702a3d3eb7bc5db8ee21f51c13b9ca7bce6e6fd1890eaf96f91e787f706a27d6de38268aaec33d764d7009a94e4f272ab13737cffc
SSDEEP 12288:JXZNYVLeyUji0h90ZD0wxpGZIVuFrHsoAgi85bpRaTbqGLIIcdJViyD2EHFrOHWR:f0Le5ji0hmxirMo/KSWITnbD2sKJdj
TLSH
T1F5859E16F6748735D073C0B9C5D2A69EEA7130821B308ACB4296D77C3F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 adbf8ec66b989afbde3fb7d9e047a5f99c1464bbf0fc05d43657cc716685dc98
MD5 d9bfc56da8ff7b6e2b649a7ae0c2f6b8
SHA1 2c90c4edbe81b1845dc1ce35b78d33888aa43eff
SHA512 cd07dfdd5d73ce48696dc8ca04b7a925275adf017ac889fe8c3a530dfb983405af3da9db5b4c578fedb8758c26dc0c72ab3973d87d0ed2e7e3dabb9053558def
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWE6q8wyuW/KSWITnbD2sKJdj:B/ezSC6vUzPvxHjyZlWI7f2Fdj
TLSH
T12B755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 91474f0d6b221fb2f7ecd49beeb98b478374594cbaa6a7fa15735ec36371f9cb
MD5 59bc683246dc546a6799c9f6d26071f1
SHA1 e655249c9df94437e238b98e570463d2a691cb7f
SHA512 2ae880588451eb468ae7cab474792ef96859200e2c6db2b43abe2dfd65d4564734a0dd7bb54e643d9b38e4eacf15fc5535efaa0ac5510065ff8f4b9b09383b2e
SSDEEP 12288:eVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98rAgi85bpRaTbqGLIIcdJViyD2Ej:eVbqPb88hv/l+6r/KSWITnbD2sKJdj
TLSH
T10E559E66F6748331D073C0BAC5D29A9AEE7234425B318ACB0246D72C3E67BD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c5569c163c4887999cd9f568649917534cab4328121e06355ae06bdb7d0f5ecc
MD5 7fdc12faee7640f588a99c1edf206d2b
SHA1 9c58a668363b08b915b6b2acf6d525f60748b143
SHA512 78aa7127dde8b68d12223fce8f7b2e034997daee42aa4f544f9703adaa0c2d91c43e0b0c7f6a99520dca74164cd27ed5587db27765cb7ac9bf9417a57355bf5b
SSDEEP 12288:yRkAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:yRk/KSWITnbD2sKJdj
TLSH
T1D04523064B5A58ABE67B0EF565DAC0D747E97ED03F606E0C82723F1B1178C84E46C7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b810487e182f2bf0f2a7d92422faf34f6473b180b3d7a4d483f6da9b666560dc
MD5 2a5fe6b5355eb8bfd9c269d8a48f8991
SHA1 32a281dc3b8d4b5ee7a9db044d45e64a2be7bb94
SHA512 07448d7c7fe5e8ebee863b50c7016cf97b79a1be7b81b8511eeebbb826bac7e5254e2d8f9d4dfabec10e6b818fda99c346abcaab6fa148b7f3f4db010a0847fc
SSDEEP 12288:yeBNUbTVO86UTAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:yJIUT/KSWITnbD2sKJdj
TLSH
T13065CF3BAE28FCE2C27A4DB85A91C240D7B278704F61A3CBD175830E9E235D45E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 333115b5e63e4e991c70219b1379ca455f216848fe3c5a67d445a4f7725461f6
MD5 c7342913ca71e78531192b81cef71548
SHA1 8707ee01826b03503949c998a212ce4b100a5de5
SHA512 20616606cdbfc6ae34fa21df3059145c0b460c25ff46670319c195c1672513a61c0c09cbf63aa9d23625254fdf546b4aedf5036abc3f45467c2bca03dfad55a3
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:xQvGAdlCEL8c/yRNw5CYvIdj
TLSH
T1CA266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 54c2d6439ca4e1d8f5c58730d496b018adffc25e804d328db13e446582eefc48
MD5 f5c1504fc3beae6549280b39af0e1406
SHA1 0eee62b08e9e212f9b315db650e8cdd6b6d93bd3
SHA512 4906ed4840012e58f4c485ba5e637024cdf9fab6a0f9e3c6b0de1f5c7f2e64f7e52fa24800b2027eb93555e63b16596fd50b6692ade1592258445805bf858b5f
SSDEEP 12288:cAwSfxL/2Dc34DLLmt0LDQewsAjpAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJy:BdewsAjp/KSWITnbD2sKJdj
TLSH
T15F75E031EF75E436C27B0DB21B26C716156D7A600F611AC3E3B85E9E59306C2237AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4ababa262bb309a8194914f656632128cbacc56d0d159f71a0a8c4c1de3737de
MD5 b83b244b81048083606db1ec08eb883d
SHA1 89145b495637dfc661477a85b837952f3026c069
SHA512 9e06a427521ec22a7fea1f6a5fb4a39bbc23787468b75902a62a48d7bc3bf63105025cdd4f059c17585fd34fb3534a2e52f664c2a1e397e33052e8354758bbe9
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHr8:+UEtQevvqc2W1cpV2EI32r8
TLSH
T1B0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1bfe0ae73680dca017092221554f52a19ca52a3d23ca81568094cf2ba91b7e64
MD5 bffcfa6689f343bc3a793312b1cbd31b
SHA1 c0cfa7c3d407ce6b7c94d28691d0beaaf1136704
SHA512 8accaff5f45d123dec1f33d17f96138843061212bd17474ef49b2f6835d86f70fa1494c5b092f6b2aad3e30b5a58b3a707e701144a8eae7f75b22151921ab609
SSDEEP 49152:/CbRquA/m2yL5zQfFiV+XenmE3/ztlWI7f2Fdj:YoqtVjnmsvIdj
TLSH
T16ED58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ca10274ffa96f3aed743f74673ea61e6709059beca2530eb64155a5b2c586daf
MD5 db74932f5e750e10a0d73e67b8616c4e
SHA1 c99ac0f0845be639cb470c4c58c733fd2deb0590
SHA512 30c9c1e42a14fa9a611808c06a729d2a167e8d65f2ed56f0751646f270dbfb9e28f2ae8171b7e7da68fe79f60c1bf7c4c8b4552dbf5616c2bc8ec0c9d34d331a
SSDEEP 24576:zAhGLJIFoiwtA5l7S536/KSWITnbD2sKJdj:zAMyFoiq5MlWI7f2Fdj
TLSH
T18235AE81EBF955D4F5B3AAB899B68171EA76BCA55E30C20F1160D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 cce197ae3c5c24a677663d0435eb11107812415b4337b64cd7234ff114312fe5
MD5 2a7fd9f3c35da2fcdc60e8fb3a7c63dc
SHA1 96cbe98de28af54e83b2aab672525df92b842196
SHA512 4e12b36dca684b7b5be04e80385235f96eaea36beb2da05369da919568d37e1f721b2bdcdb8530e95c3602552575353d91c44227690e8708caec125e2ea91f52
SSDEEP 12288:pmw5HEjsChNVBFgl0WDm+C2Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq60:kwuoOW9/KSWITnbD2sKJdj
TLSH
T19B65F14627A90CFAE96746798597C136E7F2BC422A20DB1F0360C71B6F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ff1da5e2156a886ba9e60e423fb0c14274518c90da2cb70366ce1adc5f3c256f
MD5 13ba802d42e35d6b1cf2fc01559b2230
SHA1 5775d0deb2fbb5dd977517aba995f9b353b3c712
SHA512 eb0f8297a0ae0ddab9c9dcdd3680afe3ef0d12ae6de1387517fdfd437d40b5a3cb310f8ec4aff832b93c6cbfc3bd04e8434e8aba4e41a7c81986a43ad74c1083
SSDEEP 12288:2BZ1IyZAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:AZuQ/KSWITnbD2sKJdj
TLSH
T18C55124A17A920FAE17706B8D9E58586D7B678922B3053CF0271172B2F32EC56D3C772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5a7b118c3bee73cf8408df443745fbf983e2a6b0681644b2cdb696672e7d64d9
MD5 cbf8962ae1761d6a64871749ba435e6a
SHA1 28cc7e520b2a7af2dd8d569f1eaec38b4d4352af
SHA512 1a2245ee987d777be591113f7aface7166b5ddb8cfb84217301dc83154e26612df945a85b677b6e6f28562ee884cc610f66282eb770eb402c20a6c196239c26b
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:xQRQyi36YOcPQLvw2gAf+PN39vIdj
TLSH
T1B5667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 588cb5e6ea8a9118cc65efb8206279ac90b16c0ed8b773d7fd4193e9f1eae5bd
MD5 ca1af23cfff5d57ad467d08a8988a938
SHA1 d8cb923ade71178bcd34e20f296c0799d2cdf51f
SHA512 3087df50f0fc05782bb58b73c4c09f541c99c0243dc756da09bcc73087b1b6d0fd99882f4edf9e366fdf222bf73e210e0647660feee40f3fc7f0a64204761371
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UW:XQRQyi36YOcPQLvw2gAf+PN39vIdj
TLSH
T1B1667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 36ddfd784064e516b48fee1bde14b3710d05b152153bf9af9161371d5ce3fe36
MD5 adce03683c4fb1b14be065569b5dd5af
SHA1 dbe4bec9503bfc7c5c389e7f9d946d4486446d27
SHA512 6f39b35c210fa87d3665e3e1bad831b81df5bb64ce91ecd293397ae8e6ded6181a9161c353ecee5e118d627c75328b9a7925a4fc92b56e789269d75117838bd3
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0g/KSWITnbD2sKJR:s68Qg55nhheWu7PNU3/dlWI7f2Fdj
TLSH
T14DB54933B2F600A9C45DE1769F4A872196D27C718FE0E3DB851173161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 25d428d6b7f6566dc31b00612fd9a70c92a40dcc2f49d72543d6e2cf7d34c3c8
MD5 52e8907cb5c23778db600f0cf118cdcd
SHA1 736a84ec198a04794e0fea5350e6380249549311
SHA512 909f22ec1a68ff83c0c393801590741179782b5636781e999f0729ed55a5544db0a00bcd2d97c23a105d5e08a49024a445b4666ae5e98e4d0400608cba8fc7a1
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:Py5112gYy5azzVvL69nLKnhZqvIdj
TLSH
T1BC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3d8765efd278c0f333df58526bf57750b3217368e505777483ac2eaa2556de5b
MD5 10892f902ba846a3a82840e91a132b24
SHA1 829ed0910ef97b3a2da3afa1fafa4cea1c3a9a1c
SHA512 dd1ebe3be838ce63efa19da71afa32ed6723c2d95e208b4f96d6c8709fa9bf2e3e5a7ae6f256592418a0c26478812659b0baf28d9968250dc0733751f6cede57
SSDEEP 49152:0B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glHlWI7f2Fdj:uu6JmVxd2dFvIdj
TLSH
T144D59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c633995ebb161c9dc42df94911a7ab40e500a19653e208418fb45ce145019d9e
MD5 e2fa4441d12b16a7e5b3dd80b5e364ed
SHA1 6a39e08d712521dbf264f850bf5aa13884a43137
SHA512 fff7e6eeffbd0bbc699048e14eba2c0b9a8cf31d6b4e622dff6e8708048a3760a2a7431930839a63fb7d562d5ceb7c42b0b66906df540d56254ee808ff328914
SSDEEP 49152:V1hpsNoJpF1A6UU44CwH7R4xTlWI7f2Fdj:VmifPbRsvIdj
TLSH
T107B5AE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c96bfea47c8bb03689daa719592028eab1bae46fa806be18ca0c0c261e4d0437
MD5 b5a674db9f6137df10f1528b5439cd64
SHA1 bb5dc98457a4f083afff771417fea66a7fed522a
SHA512 7b8a3d5213ccfbfb4dff183a48a44f3bc30fcf479e38f5d586c6a86b3a7ff324ca1881abc51cb58c320362f42bad9db35974f8426b30fa0f160ae926c299f4c3
SSDEEP 49152:8SuZQIY0Be2KRRVtOnks6NMHqOlWI7f2Fdj:+5dKTi61mvIdj
TLSH
T1A7C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ca4f599dfa854b1006556f18ead50c35eb6f33cab5cb5e0d2b8840605ea56e75
MD5 b64509172e4acc1833577339c7cb2919
SHA1 2703ece30b268a250621e6067f9549cb91fe4aa8
SHA512 54e1cabfb46c10d467bbfaaf4cf37d444063cef1a7a0e08bb4ec79d1f4cb8749b320e4ccb35a9986dce55399a1966c0ce05dfdb8318b0fd03c8e8208ca71726a
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5w3lWI7f2Fdj:PX2iyphQvIdj
TLSH
T1D095BE13F2D900E8D06ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2be1aa8e44b9bb1909c10b95b185d36d648313c2397cb2b6a9833061590c0818
MD5 55ca23f4572988780d2c5df45daf4113
SHA1 83d5051f5a386ad2f1ef43a8808271c9bd7d752d
SHA512 8ea596744f2b4d9e69a19ba27d99d89c28cc38fe54d26c3f33a0f7a7fd3252fbd61a1249b7562d82c1a4fb1f7c9901d3789f5c30d45a8b4660e96093fa40db55
SSDEEP 12288:2sAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:2s/KSWITnbD2sKJdj
TLSH
T11E4523064B5B48ABE5360AF195DAC0DB87DD7ED23F606A5C43733B1B2278D84642CAE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9fb94a2596221ec0ac1cfa8f8597fbe89ad7b0a889d9f72a61e516e261dba6ce
MD5 8c6869b2cb942e00a0549d487808a943
SHA1 adacf23681949eeb7b2207602fda4851aceb5289
SHA512 6b00736f6725bb5d12f6cf69731cd1c509ddf3928abf887712a891ca2283fabcebe55e5bac6ca5e5ef6ecffe68e8efeef17f3e25a175bbddcd966af4745e70da
SSDEEP 12288:iVAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:iV/KSWITnbD2sKJdj
TLSH
T1844523064F5B08ABE5360AF195DAC0DB87DD7E923F606A5D43733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0240f70f64c36c068a4f993fb6a26eb258e187e90ab659a25f39c87408fd8e51
MD5 6be7b10c2b8511a12e92489d0f172b58
SHA1 086dbd97a9ffb028608efe7bb3e13cbeb7ea7c37
SHA512 c23d82230784a51287285b1543f2f68f4066ff639065d561a8ee7eb8943000bb6cae3879b748806012b17b591233382b0c40125717a4930216ea9994b284f1db
SSDEEP 12288:77Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:77/KSWITnbD2sKJdj
TLSH
T1704523064B5B48ABE5360EF195DAC0D787ED7ED23F60695D83733B1B2274D88642CAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 adb7349b318e8ce37e18f861fce8f0459d75ced1a7c3c2a5418640fcd14b8b72
MD5 fde2eab43d679833bf447fe53381fd94
SHA1 6b1706838db6e4284b083323495e96194ce73cbb
SHA512 7ace44c571572dfe2c9c733591ddce498ac00019e6d6c8f050e65cc7f3fff19fbc2a1e3cf175a27dbdf39f01dee0fe415b65868d146cc09ffa5e045e7668cc56
SSDEEP 12288:2VaAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:B/KSWITnbD2sKJdj
TLSH
T1AA4523060B6B04DBE4774AF4D9E6C096D7F97DD13B30669F83622B1B1670AC4683CBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 691f624061ad668eb4df781ab78139771f0b1802d2180eea6cd6c2c46065df84
MD5 56e59205d3be5839dc082c3de4455713
SHA1 ae98d3139c1f480618fec4fc0f835954a2c13c8d
SHA512 12195a437ebb4a72fb28d4e810ea0715e25188957d751901ba47d06b0d7943982563019b8050943d67f4051f01e5204db57d402b2d581476d7dc0693776530d9
SSDEEP 12288:DSAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:DS/KSWITnbD2sKJdj
TLSH
T1434523064B5B48ABE5360AF195DAC0D787ED7ED23F60695D83633B1B2278D84642CAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d573a0474c6ef24eb4f69fad91f6c035f69fd3dd504dc7945911f06a89c59921
MD5 71de88412ca60e90c53a90b80edfe21d
SHA1 a7eb3724b6ff963788273b9328fdc36eb6d8cc79
SHA512 d7654b5904b9e396f4ab0d1594f948b7201456c2bf2f38481a0f4a59e22f62f8ff5a0b4191dcca73bbcdbe3da793042f88d15dd0d60cc988e21d7c8dff95dc70
SSDEEP 12288:HRAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:HR/KSWITnbD2sKJdj
TLSH
T14F4523064F6B08ABE5360AF195DAC0DB87ED7E923F60665D43733B1B2274D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3d510863affddc621bf404a94e27a0c6569e571845378f8c747238b5d4cfd98d
MD5 98092b86c64c06163c5ca5f20fc4d1c8
SHA1 7e624a92c28aa67a375ea8dd6160f4eb3db0b9c3
SHA512 7f126bb8f6f46b4d2bec5cb431ae94cb942481f659e60a9be00900d4fd75a1ddfe896499211e1a4b5c9beef5c1ee53ab34b3fa15dc6087188831c1275fbcf40e
SSDEEP 12288:MNAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:MN/KSWITnbD2sKJdj
TLSH
T1094523064F5B08ABE5360AF195D9C0DA87DD7ED23F606A5D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7ae72d303ade666d2be210b9cee0470f9c25ecff353fc02210799f576dddd03f
MD5 ab3e579de6696a1bed7cb479ae9f8224
SHA1 318bde59e914ff0a5b7c7ca7a8669d4e0d0158b7
SHA512 cc031682efc386189fb3afd15a8c04d38313e02babe098d4fac3dfe39d9e1d679536a4b76ba330cd121ec7b0d10030904fba80d09e4e1cb6fc9a5aa790d5b0d5
SSDEEP 12288:PiZwb6zzFEoS2cPvy1Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:qZMSzFVSO1/KSWITnbD2sKJdj
TLSH
T19F65F195B3A018F9EC67867EC9658846D6B27C561B60CA1F03B4372B1F337901C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 440a0ee67fc86d5d0e8de404263d726a23081065d62533ced7334eff7fb87912
MD5 56f2685d52fddb38b47acd6ffb2a7716
SHA1 4242556d4628c85bcad94ae31d09a120a78f4634
SHA512 c307b5e3969fd21ed714f798bc1625085da0e9abcf8577f3817520827946c06cf5a1507c604d6af87e576891368b6a5456e574a608a647abc000d7bb11353d9f
SSDEEP 12288:2AAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:2A/KSWITnbD2sKJdj
TLSH
T1DD4523064B5B08ABE5360AF595DAC0D787DD7ED23F606A4D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 324a370b177a3ab13a204dae952e885ac5bbf18b1ca648a7dd6a9d9f4c86eb6d
MD5 1ad7a0b5c319c4f04a673278b4bd518f
SHA1 988a16e0ca0e3137a244321bf9f8b042fe4af713
SHA512 5301bb4bfb9cda4c0fdc9287713b5f2b879b5675a0e45dd6c3a5081e72822115e3b3e2fcfa74826aa292071e6aca1ede34d8124119d3661fef4f699d69ba9ee8
SSDEEP 12288:TUAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:TU/KSWITnbD2sKJdj
TLSH
T1964523064B5B08ABE5360AF555DAC0DB87ED7ED23F60664D83733B1B2278D84642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c68e8824238b3b1d50cc80b493489891ef6e22046056d21e9b74fe9922b10a6f
MD5 6f341cc4d082f25fb1342acfe684f390
SHA1 428f27155f4fd4fec89926b36540975063a65f36
SHA512 01c6baab271d87dc8b5900eea8e637060e5a4f046d7fa2f7e5c95cbdebcb39154345c4498a546c98cc874b5b4c4dbbc376ffb3163b325bd23e2dae00b04a4101
SSDEEP 12288:FyPz5L8ZAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:MzyZ/KSWITnbD2sKJdj
TLSH
T1C755020767A630FAD1374675C8A64546E7B678721B209AAF43A0173B2F376C0AD3DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4e14cff8f8d8af915a7fa17035029a07c108c5c3f7c1b53cf4ecdd3550ad871a
MD5 d4b28feceac7d8aa5b92df291b9b68a4
SHA1 decd8673a364dda08dafaed158748adf129b4845
SHA512 c4ea7d1fe5b2c1ceeab192bd8ae272326f6bd26e654064ef8e943625f766e50454cb71b0932448fc37698557551ef5abe4370ff7aa737e814527c2912bfba3cb
SSDEEP 12288:vAAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:vA/KSWITnbD2sKJdj
TLSH
T1C14523064B5B08ABE5360AF595DAC0D787DD7ED23F606A4D83733B1B2274D88642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e63f33c5d3ac486ef220e22eb148e813ba21f530645006b834819c9ac5374ab5
MD5 14a27110c4938dc65bfe01d2b9c5d10b
SHA1 57913ce919d2a7db5dad48755664cdca68394dfd
SHA512 13ce75af50e544126f51bdf97f458f3d94ee5a344093493b58cea7eabe431bf4398d5aa2bfac2ced821c230c791bfdc839a7fcd7df409029fbfff11fd62e06e8
SSDEEP 12288:iAAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:iA/KSWITnbD2sKJdj
TLSH
T1D14523064B5B08ABE5360AF555DAC0DB87DD7ED23F606A4D83733B1B2274D88642CAF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a9e8a9887a31f2c402ff60cf3cc53e48938b04c99c6c6e67e250da9deef80733
MD5 52dd305b95848a02c75999f28e4bfecd
SHA1 80c6fede097cc485a719faf252f52ad3d0a9a114
SHA512 7f6ff16bdecbd84179803112af27beb525f11808c0c17af114681c7be29b3d654305a33c2c3fc1263fabedfc25183b493776c993ebda109a882060bfe7361c3e
SSDEEP 12288:DyPz5L8ZAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:uzyZ/KSWITnbD2sKJdj
TLSH
T1C555020767A630FAD1374678C8A64546E7B678721B209AAF43A017372F376C0AD3DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ff94a3fa2b7f89831a9f498af6381ff86698db4f99ee457c23458157f818953b
MD5 e3f84daed1d19c232dcf4a2c240a0bc9
SHA1 b8a348a0a682156558124726fea04ef182de8747
SHA512 b8678833385765219a22ae049ece0798cce6c36642be15d8456a6156948375bca3727acf84912acebaefe30e54a3de68ae564110fbd4bf738f5627cfe6ceb9d6
SSDEEP 12288:GCd9eWYoaLHF3z0z04PDvhLAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq60:HTHaLl3z0zDL/KSWITnbD2sKJdj
TLSH
T1C765F195B39018F9EC67867EC9668946D6B27C560B60CA1F03B4372B1F337901C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 14dbc78e53b671395a21d37c16c1aa89d991cfb23fb5bcb5db3bcd34a56c48c8
MD5 e3735376613d66917cd5a19fafe83a9a
SHA1 837d5c1abaf82f3fdd005d771ab0672c9e432af9
SHA512 8356e30f65db587551d22d7266bf1e8b1b9e92011f3818ab684a18f3e18a66dd6a9769a7dc54854520b7c900e4cde75f7c63118e1a8887b7d2027146de773562
SSDEEP 24576:7cP4mcvIjkGOxhKP2l71nNKbrh/8KB4/KSWITnbD2sKJdj:wP4m4IpOO67W8KAlWI7f2Fdj
TLSH
T14B65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CF1160933D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 204d7df50b070e286f12a7cb76d0a76e34660b45b337fcd45c042a5152f48f68
MD5 6d15980e68eaf283966a8e0db53c2404
SHA1 871f4b7e6f11848decf65bb2a7089a028c4c5964
SHA512 cdfdc59b5e3c556a3e7e6dbf968fc181bd5002992beb0d495280919c9025d8f9429c713bfc73c9ab86d6849b69afc73cf7c8549a81c7d41c3c6670850e5a19dc
SSDEEP 12288:QNsfQAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:xQ/KSWITnbD2sKJdj
TLSH
T1E855F00AC39801E9C06E12B5C7968682B3777C6157E093CB53D1FA3E1F75A80ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d809a35ebf6d6cb0f713e52621f7686d2075e36debf03671c3ac3ca8a7959fde
MD5 8c969b79fd2b2e9c39afb7849292befd
SHA1 479f4d3e15b5750c9417047babac10f9f7915477
SHA512 e3988d57463c113a153e7a35bcaf36d0b132f81b3a81606fcd291a4318eeae4832138011410248619b059ce8955ad35f7a6fd488b913881c7746914434e44816
SSDEEP 12288:DwAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Dw/KSWITnbD2sKJdj
TLSH
T1354523064B5E585BF5770FF0559AC0A657AE7FA13F20994F92223B2B1174CC4AC3CBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 45114c45e1e82e88c8dc4e430973cf60dfb6c56e270c409b6a46a00eedd151b9
MD5 1e85b44b9d37745933f7ee148df12578
SHA1 eb3baacce3b676cb94a4bdc27ee326fc7e208462
SHA512 85e36c1fc72b890a7f1ed67c671c2b171d26ea439c50845973574ffab34d15fe074724a1d2fb35d19b0c4746450a0bdacd3f7f145668906ef5d9567707862cac
SSDEEP 49152:ya0h2GEkuAe73q3pp46zwwQElWI7f2Fdj:ya0hNYG4JwrvIdj
TLSH
T1CC859E1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853E3F37DE84D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 75e86c213fd41d2374cc6f901682f3af81695aac11b361a3c93d11a4390b25d6
MD5 4c536ea1668531cdc3e4fdf3cf950f48
SHA1 2bccc94b6dca3c493248f1b6575c0e7975e38781
SHA512 f071169173fb27d15b9b27f8ac301085df16290972bfcc437dc504044b132f81cc64883819469752a66797eb35e03d1a2244ee8d0a8afb76346947db096ce31e
SSDEEP 12288:LhbHjfXlAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:LhbHjPl/KSWITnbD2sKJdj
TLSH
T1D955026E07AD10DAE17296BD95968146C771BC612B20A7EF13A2523E0F3BEC45C38F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e6ce0331c7e8c8856401036804dede0d5af0a95203c039806a8a16d00a93978b
MD5 b0dbde54ebcc18bea1711721bad02f91
SHA1 8207ce7cc95e3b77da26c05004942d7909a07288
SHA512 e14ec42c6a97bfb768eeed00d9ea8a70dd9ebf6c4df30ee0006e87e6e5c4b677a88f77fcaf98aeac2d909b6580628039e7833ca7f403cd724461911664025f27
SSDEEP 24576:x3YgnJcRTk4yti+R5dBR/9/KSWITnbD2sKJdj:xIgnaTk46pBR/5lWI7f2Fdj
TLSH
T13C45B02EF3B910B9D8A6D236450143B5FB71782D1F209ACB0170C639AF1AED85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 37bb0676c9f5063efbda9dc4ac383eabb7e1a9c4f8aceeeebfdadca516365000
MD5 39fc45b9b1f2ffe7d9c354f45478affa
SHA1 6ee6e627bf65482374eec02f964d2309adade377
SHA512 ac2d7bd7e4be52cbb3715fe3de75f1f594941ee09028aab34edfff53b4396d61231c36b1238391df6763f73c6af55ff6ef93eaab489a17e781bd41bea16fa97b
SSDEEP 12288:YEAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:YE/KSWITnbD2sKJdj
TLSH
T1534523060B5B58ABD5360EF555DAC0DB47997E913F202ADB42723B2B2278DC8643CBE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 5d97674ed83d523b72a738d3e3f43c0f6446aff404ae209e43bbc830f7ce0766
MD5 d05d12f38bc6f7e810ddbf08d64e2cf4
SHA1 b2a632c82e0027d3986938ab5f21b2bb67c865e6
SHA512 35fd47d40a118f77cc9aac10aa06cd3791e44100652a4b92bdbe653f9f43dd3204869a077dd93adb132767a1da4c5cdebf6019302ccfc059e48a8e136ab8cf3f
SSDEEP 12288:8Ob9A4LWOsvAYFTvAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:hpL3UTv/KSWITnbD2sKJdj
TLSH
T19875F115E7A500F9E97B813CC9A68517D3B2B8991760E7DF03A84B261F237E14E3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 245ff701fef73d0418dee9e86223d92e6f9e6b5150f0f31cc1cd6a7c41456aee
MD5 5b20475f9a23610f02c86c72c11252c7
SHA1 5221005a10a73a2dd1208936a2d68319a2999e6c
SHA512 32a0fdd685c2881c24f428ec5d29d5b60534c08c44ce573276d1616832c2b6bf03d1ade353ccaa9263fc3cdb1bd79dabaaab4f090a12cb286b12efdb2cddfe80
SSDEEP 12288:vpFtpOzAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:DOz/KSWITnbD2sKJdj
TLSH
T10555121A27ED10E6E136567C8996824EC3B1B8A11B2157DF02E0523F1F77ED86C3DBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1d00c4687e5b4654b68dfa0e322beb5b464fd4b91eaf0db8e1efa72642125060
MD5 af40defd897cae8f81c8286e497d3846
SHA1 73290ab18a7ed76e103415eeed4ef385f7fd3589
SHA512 4686643b7ca834b721569523da7d3aed116651b4263e6cd8be36196a91b6d31b45e203957bf36338b88f6340685eadfc06209814faf871e3d0c24b8937451a38
SSDEEP 24576:B7NM9YqZqmWMUkPjZM48Mv6bEhsA/KSWITnbD2sKJdj:B7cBWMpPjN8DbEhxlWI7f2Fdj
TLSH
T154659E2E5BAC81E5D477D13DC9A28246F6F1B4611B318ACF1162833E6F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a3ec1050eb1755e418ca45675254120cf95fd46c15fbdccf2fc4319f78948432
MD5 cdf0b5e06852c9ca227206d03251a68a
SHA1 f99b024efb06b77f0f35fafbaaf4c0d5f3287bcf
SHA512 2ed17be900ffa04aaf09fe1dc6b3b6c91df5e853f3f38f77437ed28dca36bd732c66c3022a76b944fb2feaffec222d168359ef9a01ee4a45f88827cb48c68e77
SSDEEP 24576:yW6BApg2YuyuNDYTabvcdvNYf8km1O/KSWITnbD2sKJdj:yF2YuHNETovAvNYf8kmelWI7f2Fdj
TLSH
T131857E2927ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 6dd3dad9aeef32c7e1559c7a266b3b8e75bd7d4e8f9681908a9e007da5b78769
MD5 f7a81ca76aa2653658d32a0292303fca
SHA1 32fdbf7b2e1ccd05c022c84512b3224de5d033f4
SHA512 5a3b21cbf37667f2e4ede734c9fd37dbd5ff21d151882417bb817203f20059547cfec5b00329b5823e5b37e45b136891bd93bf76f8add5592526caf5e032fa9a
SSDEEP 24576:vAFs06+Omlf3NXEbToX/KSWITnbD2sKJdj:4Fs060lVXuklWI7f2Fdj
TLSH
T10165AE2F66AC00D5D07ED17D8A97C91AF7B1746307215ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 0848aef6432a31956ed013da808453cc099e18050f1331dbca9a96b399c4b489
MD5 494be4d6352c67d019d9fb6b1d1274e8
SHA1 e5b36d22f75939482154ff15dd77bd7b02787127
SHA512 a8c76902993106c1a84a108a216287e830c0bb6c3e51f91954f73dbecedcd0d8ce62ecb3b5a7efa09874c118a8516a861aa62ed45d068c875d9821282246f9d3
SSDEEP 12288:ZCJnJ5D3VkrDzxgAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:wJnJ5D3WXy/KSWITnbD2sKJdj
TLSH
T19275D02DC2A810E9D4B7C2B4819A5696FF72387D2F226ACB14B4D5353F22ED0997CF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9dcf2feee7a236427dd951564db9b413bb4371806f7fe057fcd50a6eb9299241
MD5 39ce5913364552a99da373ec1883c293
SHA1 65511fb92f39ce3b37e72207eef0865dd741bafb
SHA512 2836ba2197b740283ac374d0a63ae68a0a69a392fbb7d4a23b789e53689d8f5cd82c00b6814e36498a72693c76d8894510956ee6f260f3a4392bc465b2a9da38
SSDEEP 24576:SEPghm6/7IIXdwcXrif7qQncjlP65i3Vu9/KSWITnbD2sKJdj:lg06DIKdwc+eQnSt65aVClWI7f2Fdj
TLSH
T1F9955C16B7EA5295E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 fa9ad8a630d0073a4e00691a19c7fe243546615ba9ffaf54fdb991d5bb81fc9e
MD5 831d0163ba78f03aae90f808c5e8b124
SHA1 54846fe7c02cc9d49cd4e520b7966de1f0640e85
SHA512 13a1895ce81d8674e9c545cf4daa6e379cff87290c1cb5ba8cea9fcd871a2066fbf9ed50476ff7d6b1bc6a4bc044b54d3ca3e0eb5d1c55d01b528587402074f9
SSDEEP 12288:tEP3Rn2Agi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:On2/KSWITnbD2sKJdj
TLSH
T1D755022E1BAD60EAD136557D8591C186C3B6F4B12B6127EF42A2933E0E37DD82D3CB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 8a7ce91d389ee05f2f4ee2f1657621cc4bc51af70c3e3732d94ef03ddb1134aa
MD5 682e65bd9da7547546b52be0b2b9a5fc
SHA1 c06f017113ae0ce818b6080f03dc280a63acbf7c
SHA512 dc10b8154793fdfcfe15f11a81f386ed2cd377bcbe3b579dff5e8941c86463f3b4ed7329bfbdd3e4660e4bca9c33bcb54762eb9805cec6cec60a1cfc650d174e
SSDEEP 12288:ejkyVAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:eIyV/KSWITnbD2sKJdj
TLSH
T14B551205039954DAE5760A7899A7C0D58BB9BC602F2057DF41A1BB3F2F36FC4AC38B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 ee0346de4d612bcdf126f8de563d51714aaa1f99cbff7587d41edcad030dbecb
MD5 b807668d8434bfe01eaee3d855974e79
SHA1 34c1b2806588f4534f4fdd7298ae89b0c1f8407b
SHA512 b687d47e1f67297d229a6887eab9ffd3e6fbaedb15634962801c6bfbae8bf52a48a2198debfdadf1ac6c75b22c5078ff9e56082e8cdd3c4f03c090bc5b6e804e
SSDEEP 12288:pyjAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:Yj/KSWITnbD2sKJdj
TLSH
T1944523090B6B68ABE5370AF45599C0D647A97AA13F2029EF41B27B3B1374DC4643CEE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9d03f79514a3e4a86ac0acb555405f83a0613d05cfadcb62ae28b38b921d01d1
MD5 dd3ef0d58593e73628ab75b73066821b
SHA1 3001cb46c80dcfd42e302e7dcf982ff20a16ef3d
SHA512 285fe2a5c0b7efbfb0cd2b7392f6ffbea958ff36e17954f29d66aab4025192ea940e2664a4b3bfc50c6bd5656117cf337b55ca72b9842bd3305730c79364e3b2
SSDEEP 12288:tLQZb3C97GYnZMv5zBcKY9dMD3IAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZU:9Q9MxZKdcz9dw3I/KSWITnbD2sKJdj
TLSH
T11B558D2DABE9059AE177D27594A240C3A673B4301B31D6CF2448D13D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 42da42eef1b9606a5c7d3f3be350096f0f24db0012c18016dcb60c03bde381c5
MD5 2539054d0f31325d88618afec6ad4bdc
SHA1 2519cb5695ed75142a2492aa21516085da05f511
SHA512 05423b8d1dad5d6982fd9aebc906f910f6e58510cc97623fb51bb51fc3224e1f86e58fd260e43bf263dc60962bb17e6fbd2638d2b29680686d3aef1c26ec0bbd
SSDEEP 12288:pyoKo2JRple9ppAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:pyocDApp/KSWITnbD2sKJdj
TLSH
T18F65E01FBB6E40A2E176813C89858245E7B3B4702B6257CB5291C73E4F379E8BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ddfa641eb07af2f71df423d2b761231172579494205d69d0c65cb93ad24b6404
MD5 d91d8f80f5d1011cdc7388522a3a60f7
SHA1 9779e5db58252408e0ae1d42c3b1a14a6c45b27d
SHA512 de9949bf93357d22f190460da8b3cb488bd9158eab02c4c5510022f4a09f40ae3c6ec05555e278ad0b326df22d8ceb94f34e088860d31e0bc507a06c3fd8a927
SSDEEP 49152:9WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKNlWI7f2Fdj:d0zuNI1vIdj
TLSH
T16AA57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0a9ba7a28ca8416bb696a5804420adb5f2fdc7d4c3375b3859c8313d99b4ff02
MD5 55d6909b40a26629b5191e255a5c2375
SHA1 88e7395c412db9d20061c53dbbf927c3096e5559
SHA512 b27993b512dfb77bb100eceba31bc29b6ec6c10b09bbc2215203ed71018352fca05db82c49fb3db5dc78e1f68ffdf3579a979a9471e3c483dd271a4f54efb67b
SSDEEP 24576:d1QT7EcpfxR+N5AWAz3ooiYtjMqb2/KSWITnbD2sKJdj:oTDxR+N5YzTfjMzlWI7f2Fdj
TLSH
T17D55B02EA7F915E9D17E85799A23C512FB727821033193CB42A0C13E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 0577f5d7de48629c6b72aaab6500c9f6ae534b6656c04079b9864fdb0c3bcaf9
MD5 2e347260628e2c31dfc81b9f0b0b09ab
SHA1 c5ac077e7e1c3cc2492dfa1c40a647e0a418b373
SHA512 1e6e6579abf90cc82e461da2101bb4e2be1b4a6f35fa865a25da32b45fdbc654953e51e732beb08902f7f7671690a902e17b936f6dfe9b974d0518e8cbbb737f
SSDEEP 12288:4/5T+RdOzMbFFTG+eEYNmSL+VAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mE:ETMdOz0FFS+imSLa/KSWITnbD2sKJdj
TLSH
T1C375E13E576D14E5E47BC2BC9643C906E6B2386203216ADB06A0C17A3F6BED4793DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 517507de533a05b0e32dc55e8c643ee2552f0da88ac01ee429df7a04f2900995
MD5 7ae7f5630634a038756fbac846e453ea
SHA1 429bd82daa40e2b099ece8f95636a5b3dead1e16
SHA512 cfb7b4cdcc2ace2aa1ebb76c12251f4d3127cc9c1c427d683453914f6c13f50f103a9e2abbbd73fd0ed7c41423c5703af6857c8b276a39b9389b8e47344f65e8
SSDEEP 12288:k4KvAgi85bpRaTbqGLIIcdJViyD2EHFrOHWKJhJZ0mq6iIA:iv/KSWITnbD2sKJdj
TLSH
T10D55120D07ED24DAE43356B49A66819687B4BC7127206AFF21E1EB3F1B36DC4943CB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/64-122-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/64-128-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/64-273-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/208-282-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/628-391-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/628-23-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/628-25-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/628-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/968-285-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1588-283-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1588-394-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1616-436-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-439-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-416-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-426-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-425-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-408-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-407-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-432-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-424-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-415-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-413-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-405-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-406-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-423-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-427-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-414-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-433-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-418-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-422-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-434-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-435-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-428-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-403-0x0000014E480E0000-0x0000014E49FB7000-memory.dmp

Download

memory/1616-437-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-438-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-409-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-417-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-412-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-411-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-410-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-442-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-419-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-441-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-420-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-431-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-430-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-429-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-440-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1616-421-0x0000014E4A810000-0x0000014E4A820000-memory.dmp

Download

memory/1724-1-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1724-9-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1724-281-0x0000000140000000-0x0000000140D0D000-memory.dmp

Download

memory/1724-268-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1724-0-0x0000000140000000-0x0000000140D0D000-memory.dmp

Download

memory/2344-41-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2344-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2592-67-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2592-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2592-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2592-393-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2628-277-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3224-276-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3376-117-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3376-272-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3376-111-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3796-54-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3796-63-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3796-65-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3796-60-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3924-266-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/3996-262-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3996-78-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3996-72-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4276-100-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/4276-95-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/4276-265-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4300-267-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4300-309-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4564-271-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4584-134-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4960-274-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4972-14-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4972-377-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5104-392-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5104-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5104-38-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5104-32-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5200-85-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5200-91-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5200-264-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5600-167-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/5600-185-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/5600-151-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/5600-395-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5600-399-0x000000000CF70000-0x000000000CF78000-memory.dmp

Download

memory/5600-284-0x0000000140000000-0x0000000140179000-memory.dmp

Download