9c4cb1e1fd5cc1d343ace6b626cb7277553e96b2dfa1b82a0dfbf1912ee4abee

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Size 5.4MB
Sample261020-wpswtstsbz
SHA256 9c4cb1e1fd5cc1d343ace6b626cb7277553e96b2dfa1b82a0dfbf1912ee4abee
MD5 66847c8294c4d4456399ef7be28124c9
SHA1 b0569ba8a7f13987995c025b241eda950cbaae08
SHA512 d7b6388266d182580f4bdb17637f0ccdf2cc2c80ac8123dfb6ba591906c5c17e2b7c1d97694da72673bb737d5c7905927b3bdc11ab50a8453d47e99b7db3515c
SSDEEP 49152:jSql2zlYvdmlQN6WRbQpUyDdCB3hAm1oQ2K0oTJMufn/OVp6I5hDDS4XYe4kOe4V:viam+bHAi07Ccpr5/dRlTJT0U023W
TLSH
T12646AE13F1DA11D8C01DD1B9874A9232EA61BC494B25B6DF0B9077522F7AEE4AF3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
764	alg.exe
1892	DiagnosticsHub.StandardCollector.Service.exe
4704	fxssvc.exe
4848	elevation_service.exe
4868	elevation_service.exe
2804	maintenanceservice.exe
4676	msdtc.exe
2868	OSE.EXE
3184	PerceptionSimulationService.exe
4168	perfhost.exe
4484	locator.exe
4468	SensorDataService.exe
2744	snmptrap.exe
3936	spectrum.exe
2144	ssh-agent.exe
2584	TieringEngineService.exe
4736	AgentService.exe
892	vds.exe
4968	vssvc.exe
692	wbengine.exe
1900	WmiApSrv.exe
972	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f05b75235ef7726b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fab95c0bd60dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c591fbfbd60dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052eed6bfbd60dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000320ad6c0bd60dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093d37dc0bd60dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000126eb9c0bd60dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5fbdebebd60dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001721e6bebd60dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1892	DiagnosticsHub.StandardCollector.Service.exe
1892	DiagnosticsHub.StandardCollector.Service.exe
1892	DiagnosticsHub.StandardCollector.Service.exe
1892	DiagnosticsHub.StandardCollector.Service.exe
1892	DiagnosticsHub.StandardCollector.Service.exe
1892	DiagnosticsHub.StandardCollector.Service.exe
1892	DiagnosticsHub.StandardCollector.Service.exe
4848	elevation_service.exe
4848	elevation_service.exe
4848	elevation_service.exe
4848	elevation_service.exe
4848	elevation_service.exe
4848	elevation_service.exe
4848	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	644	2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	4704	fxssvc.exe
Token: SeRestorePrivilege	2584	TieringEngineService.exe
Token: SeManageVolumePrivilege	2584	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4736	AgentService.exe
Token: SeBackupPrivilege	4968	vssvc.exe
Token: SeRestorePrivilege	4968	vssvc.exe
Token: SeAuditPrivilege	4968	vssvc.exe
Token: SeBackupPrivilege	692	wbengine.exe
Token: SeRestorePrivilege	692	wbengine.exe
Token: SeSecurityPrivilege	692	wbengine.exe
Token: 33	972	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	972	SearchIndexer.exe
Token: SeDebugPrivilege	1892	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4848	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 4408	972	SearchIndexer.exe	108
PID 972 wrote to memory of 2776	972	SearchIndexer.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_66847c8294c4d4456399ef7be28124c9_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:764

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4000

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4868

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2804

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4676

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2868

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3184

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4168

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4468

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2744

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3936

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2608

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1900

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4408
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7f2e27940d6af5cb123d795d3ad7bb6b988491c6767633a38aed8c42c28e5f9e
MD5 5fabde3635950494f69d0f8976594ea5
SHA1 9df52de9ee3be14c3c0c1de87ee0bc87c6a3228c
SHA512 66c9938ce03bf7dabcf090653fcc2876a05d112acce4086cbdf6cbb0a32f8f460d289f2282d9710e4713f20f554a265600f136a839d3af548966320a381f65b9
SSDEEP 49152:bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5e30jaNf1TWbdz:p3q6HjB8U023W
TLSH
T1FFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 31e34b474ad574909d116dd95d9286a1acaecc76b6da20b7bf217aa831982b21
MD5 1ccccb94d35feb518faa46b90a55805c
SHA1 73d13b3d2f28003d694d8ac43b7caad398c85113
SHA512 cb1685a02e353ec90ae329d678f22bb2f55f2e38a3fba6abac9ff05d2a311371055d7be6c33ec9824db03f008e99f402424bab338bb510edc5c6f1ffdec87f48
SSDEEP 24576:xXYfDtczA9gXe4i7ojhsP5Lgrk1TWb4AN5:Utcbe30jaNf1TWbdz
TLSH
T17B75F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 19a53b45074ac6a5385487de345083c25abcb3d4c630a802d7b638f2c54faa6a
MD5 f5f2ec77ed96dd277973df89f3d3d761
SHA1 54b0f4f428df37cb381bd4874dddf5e20cf68d66
SHA512 cd9a69dd030fd0f9ee50cff9ac9d78fa5d5c5f4a06302e8e3cda81d563056dd025bc4c7b7ede9ba142737bc4fea0aaacbc8c2eee50f66ea2e02ba69ce10a7566
SSDEEP 24576:+0Le5ji0hmxmrMegXe4i7ojhsP5Lgrk1TWb4AN5:+Pji0Aoee30jaNf1TWbdz
TLSH
T17095AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bfb1312527e894a3ef3080bd79ec54dcb59aa7674a9446c0f623045f7b6c4522
MD5 d42f44d57cb402888a9cd614b51e7785
SHA1 52ed54c4ba71c7c0161d0217fb18aa59548e3c31
SHA512 9cfa75bb5c00fc77103eb13d8ea1181a3d4544e2699b93d0a6e7549168c2ddff600b9349be33043b41e634ce3cd3eb954c9fd91cdc4f1e6c85b803806a51302b
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyuEgXe4i7ojhsP5Lgrk1TWb4AN5:G/ezSC6vUzPvxHjyqe30jaNf1TWbdz
TLSH
T1CB756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 826f0ba89ca9eae951bc5d84c4b4c12df2e68f384d29d89086e08b1a7e644863
MD5 69b915a2fc41fcf81669232311aea815
SHA1 7c09b2c2d200f6c6e780b41234d8310916b35931
SHA512 060295e8d3501f6c687fc46032947a948da330ba5c0e9c6a842719ab5259e9424cf4a4d3e06f2ba52c534ce85a0bccdb902209e328fdafdb4003ef5ee5fff32f
SSDEEP 24576:hVbqPb88hv/l+6xgXe4i7ojhsP5Lgrk1TWb4AN5:hVO88hXl+Ne30jaNf1TWbdz
TLSH
T16D559E66F5748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 766e6c618a9bfebf245ac809c3761e8050deac1ed7e629d2d8ea6e33ff3cc59f
MD5 1bebd84251a1888c393bc4d675362610
SHA1 ffa4510e7e86b77bbe3e3c3e15c971c4e884b3ca
SHA512 9095f2ff5e2a2e78e4be07b7cee9e8bfdb5511fa102988151990a3397065b914ffbea387d781108344e55e1ddcf6b00dadcf5ba92762548e728a80caffea23ed
SSDEEP 12288:qAV0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:qAigXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A55523A19F5409C6F38FC3F4A0F7CBD1E9E11EC061448D6B47E0BA9358BC899DAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 56a68341543be4042cf5166c12668e85c43c87cd6ef9b2629ecdacf4e6375873
MD5 1b5338c2401304e486cf0d68b6575235
SHA1 2069a84b411ff5fa98c935ccdb99786cee05f5d0
SHA512 4645601399bd81f79adc030d77ffbfa5a2ad54503f37846b1127c0b8139f0fc3c6ef0e2debf63b653caa7b2d6ce7531c8cfd6e355ec0500547669e6beba8e5b9
SSDEEP 12288:ReBNUbTVO86U40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:RJIU5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CE75CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ccc47008a889c142b39c998c77f6f1bd7e9d9d6e30b64001f9c15897f3016625
MD5 f2e37f5626cd675ba86f9b539ef39a2d
SHA1 2b34bc4c63a752bf89e691914f708fa3a3680107
SHA512 14dc144de24dd58cc173e7a94b786951f247b077f9374851917928c5239f98852c59f3fa1642a0dc123824826c12573f2634707195c42a8228843b8e04002c91
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THw:oQvGAdlCEL8c/yRNw5C7U023W
TLSH
T194267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 df1cc734b1461813804dd1ee8a2f622ff41ae625d2f12216677735b45ca14a3d
MD5 d657ce3b88c1ab2a311757ad48d06a91
SHA1 c99de5f32ce817cb7cd6f84946ed969c6545d9f7
SHA512 e73a6f28624af16c8fba1e87999887a5bd88b7be4658fbcab0a09f92e79465a122db1c125c8357be34660d4f65b4b2d9ad2faf5d07258660567fa0bf9d113a19
SSDEEP 24576:r5ewsAjHgXe4i7ojhsP5Lgrk1TWb4AN5:dljue30jaNf1TWbdz
TLSH
T12385E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d994b78918c0806c2a488e4e71ef7fa50e5d3dcaf367b66960099daf4c38d1ac
MD5 e42a85f2a4a812400aae9441b1bf71e1
SHA1 c51c42758b4fba4d93acba65bdb40e510fa0c139
SHA512 014988174d6a73b9926b9ac29587815e5b2f78caa1e6aa7dffbd4b8d4c367711fdb34de3de92a542288dcb7e52ddd3e7f678239dad055d8b993ce3c22e293e86
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHWp4W:/UEtQevvqc2W1cpV2EI32e4W
TLSH
T153474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2e2ca2228550c44ddfa914d72d79fdd3c73d8db01e8ff93fe08ff56bf770ca1c
MD5 e751c28777f7cd5d712492d92a7db3c9
SHA1 34b3ba57c42156f42675816109a62a76b7168561
SHA512 31198e0dd163b8ab9959fb0f3be7fd6bba90bf1bdbe66519fab0c20669e93aece7148c5f2fda6042ad5636c45e2661befb2c0fd26f95f50fa6d77221ef6c2d37
SSDEEP 49152:ECbRquA/m2yL5zQfFiV+XenmE3/zOe30jaNf1TWbdz:NoqtVjnmHU023W
TLSH
T1C2D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3cd78c6b4ef7268e6af87d1e6c864a6d5fddc6a2e2041d874f51eee18cb5ebe5
MD5 d2e99782ecb9d95414765671ff49a436
SHA1 5cbaf715159a47d2981025caec533a683816cc69
SHA512 326e559cb9a7c32a0a3f6ac9451b12bcadbfe73e8b3fa312a91a90581c44d169fb01a69233c44d841d8e8a28faf76c330311f2417dbd3774ae2076932cadca4a
SSDEEP 24576:QAhGLJIFoiwtA5l7S53ggXe4i7ojhsP5Lgrk1TWb4AN5:QAMyFoiq5Xe30jaNf1TWbdz
TLSH
T1FF359E81EBF945D4F5B3AAB899B68571EA76BCA65E31C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b08d88bbe76900f645b570317307424f656eab3ef3aae40f49e08939239f83c8
MD5 b904c85a7b8161141adf980eb3848b93
SHA1 e97b0fe8945899543c4339597ff51757f2994e47
SHA512 f3805ffafc9c437fc24402ad0134e62fff49f18eeacad38dd45da02d45bb80fa32eb3343b93a6ba9e8b28f02391238a5709eeb3e64a227df183cf1b306a1b255
SSDEEP 12288:emw5HEjsChNJBFgl0WDm+C30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:3wukOWzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13975E14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 115b011997306aa62749f4096f4b33889235edc2026525b91e9d9a8abafbff41
MD5 b6b4d9935d10801cf7a2fe2572b4fcae
SHA1 b62d433e869caaa8efb482e8ea2aa575d14ecd47
SHA512 d434192a6d24bb5fe1bd55125eb7c8d987f18c8a19049acbca661517523dc4b904aeca621bb851bacf2d7149c14329541bc366f94832128771f76ef857dd4dd6
SSDEEP 12288:F1Z1Iy+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3ZuGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16365129637E420F9E2978278D4F68741E7B23892233147CF02A096A71F76DD65E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8e415f12818cd0e515e2b7206b2a34abaa3d63843eb58066cdc5c058b85c4b7f
MD5 1dcdb261fb744d4ed72d6d5480346c5c
SHA1 e008aa86d49f19e128cfe4e9ce17954847f537e8
SHA512 399ce371d2d891036c7788b22d1a6f8f627928c5b4a5b6e4abf40567a6a7f722c5be5267e644175cd0a5e997407273de65b7ade669967aeb2ef32c5ae8d55ae7
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:GQRQyi36YOcPQLvw2gAf+PN3QU023W
TLSH
T100667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6db7e3535ee415f84398c941368a766a63ad4ae7364d9def5cd7f1e0c53ff14c
MD5 64b71bc6b326ad4ad728ea8bb6dcc75d
SHA1 79f1c5bb5f9059be797dff2b70cccae2aa5af88f
SHA512 d6a8e60154b3136e269835a01ad753d284d5ca9d98427e6e7e2d0f83310435015cf0d5dd11c59f4de5b1b657a074f478af633c277bcd3bd191da9eeb78b625b3
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:qQRQyi36YOcPQLvw2gAf+PN3QU023W
TLSH
T127667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3240d6a15853d09ceec9c288441c8be8ea06e39a43c8dbf89a1bacf595e27bc9
MD5 78c9e2e32e3927a2b38039c31faf852a
SHA1 c88c41fb2f25509227e85dd0fc155c5ff72d4453
SHA512 d747ac332c2ce925534a89807e0eb8cffd1a3f8ff9ca19bf29f078907d55dab3190305ab5a5a71cdfb930a81eed1e0af498aecab3e771ccd56b17bf88b0cc4db
SSDEEP 49152:K68Qg55nhheWu7PNU3/ee30jaNf1TWbdz:4thWRc/eU023W
TLSH
T18BB55933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4a95555e174a1238726fa27e5cd15fa48fa5a2617aa8d880eeb30a2cb2f41c9f
MD5 15bc3b6b4eff3d97981f39a2cd24b37d
SHA1 5bb2fc738c4cc5c6759fe25a2b8a4ba74cd4145c
SHA512 40a8da0715e9b2572f9780784c8971be8e315e4bf33728e03e257c6ea7b2b96d57525e3c734605ad6d054072dc868e095e0dff8032a0cd8513aea9d90d30ecd3
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99q:Py5112gYy5azzVvL69nLKnhZ1U023W
TLSH
T158167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f129540acdfb288e89148831d66e25f49c372906686a53a7e336897a7f8177a6
MD5 10c0e750207f5731cb9ab6ae1cf44d0c
SHA1 ce0b56c55f5ce6e8c6856262ed5564b34cf7663d
SHA512 eb3ab40ffeb8cda01e152d72db329e0c1f11f708ab4a3bf6022654e2be2c2f02ac76a93d800e3b085faf536494724c247262b13fb0cc3602b288d5fab8e54110
SSDEEP 49152:PB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glIe30jaNf1TWbdz:xu6JmVxd2dIU023W
TLSH
T1F7D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c89e6d6542d9931ec9b489b1fb2d49be0df2afa6582f3732eefb3cefdfafa892
MD5 1fdaf63e8ea77f878de00ef159a05251
SHA1 32d018328de10a105cda8222ab9a92f712963d59
SHA512 c78ceae307998b9220e5675f7117f9095d017eaeb78d187135b762982373a7ca17327652d3681dd8fd372cc5c9823dcac061f5b8e6eaca6a0690d96954baac2c
SSDEEP 49152:21hpsNoJpF1A6UU44CwH7R4xke30jaNf1TWbdz:2mifPbRHU023W
TLSH
T1C0B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f02c93fea5115026b48a17cc2f91aa07a51bd315936ed7af592e6ae1862800ad
MD5 cd7a3144dce77ff5ec4c7de3fb089794
SHA1 fbfbb53bdc0718ef3eb9b2d559b461a00247e58d
SHA512 ab874bf82f45570d228d7985fc7f6a23d78aca6e95d09442a1c56c1236e1835593f720ec10085185d92ce4e64fe55fd7939b8b95d8faa1247d04d63512578153
SSDEEP 49152:TSuZQIY0Be2KRRVtOnks6NMHqJe30jaNf1TWbdz:R5dKTi61JU023W
TLSH
T12AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9e32f6d5f2865d1eb1e985aedf790a4f59e55b2e3e2598bd410082c64ad6276c
MD5 c3eb9a1c00a4506de131ef0fdc7e8796
SHA1 97e4ef5bf52fd20dc103315dd3678dd4e9161b76
SHA512 8b59db17122970b86480aa82070498c5f5d8accc9c2a20eaec1a1833392ad5299584f7216f7532c14b0622e961786c41de915d7c17b2afb8ab58ddf544b7adb2
SSDEEP 49152:UhtSn8EApI0figngiDn0AP5wYe30jaNf1TWbdz:1X2iyphDU023W
TLSH
T15195BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 312d60207277a33568c0db73a4e8034fe7f526109ce5ebee9c52adac42df6e72
MD5 03bdec7529fada5486359cc42969a77a
SHA1 c47d97d2aca114a2971793886d8ac8dc9765a331
SHA512 3f74114261b0adbd6363a7aa44ddd8637b948eb2fa2e3bc9a79c38d2d6c2eff060e281d5b529a63472f66fb44f1fdb406ced0d14e05f131d9113cb6c58614621
SSDEEP 12288:o90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:oqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1765523919E5509CAE34BC3F0D0F787C1E9E11EC272444E6B57E0B6531ABCCDA6AD84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 d7e30efd6a2efc4a7edb182c3b4162615dc8c8a2006ed5ebace48924e554b62f
MD5 3b836670081ab69d575cee36faeb75ae
SHA1 9bcd5904c52148b2c4c81733ce420c94a6837b77
SHA512 d3abd231e434edeeb765eefb3a2604770b77e8dbd9827c910d4a7e854c60b0b9dbcfc6c3ed804e014ca2021c94e071c9a62eef9c0a48641fa0130a0b8dbd8bb9
SSDEEP 12288:Py0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:PrgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1105523A1AE5509C6E34BC3F0D0F7C7C1E9E01FC272414E6B57E0F95319BCC9A6A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 c09003574bbb807266c40ceccd03db78117b9e228f93ef9a576f1734cdd24609
MD5 3db15534c07a418a56dc36ded5d541cb
SHA1 3f007fe4c1e5ab6e23ce20231a91b3535bcc00a1
SHA512 3238df14cd71081e93b178bbf88e7477898ff80fa88ff2352d3326cc2c3b464c51c6d942576c0b28751a4e42dfe7bc289e78b5eba2cc66153705b4a88f22c8f4
SSDEEP 12288:BA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1205523A19E5509CAE34BC3F0D0F787D1E9E01EC272444E6B57E0B95319BCCD96AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a26478a9869169e3079ab06b58d41fcc84303db2e1793681d9750d6c9e47fe38
MD5 7a0d016024bda533bebfce17e4570854
SHA1 74d762f9ab209eb3b4e36ae856fee335a6c2dca0
SHA512 3b04dc050afe983a98f29bdef297beb3e8e32e184b28b1619d669c68c76527104e5706091122d325d417075e717aa445318d760127d9ca5d8be8f609901caf35
SSDEEP 12288:PVj0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1015523926F9905C6E18BC3F4C0F38791E6F13DC173118BAF47D069530EB4AD96EA4A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 dc73a8a17c35b31ca657f76f431bbc87f4fefc050cb999006d7633d49e3f634f
MD5 4ce643b30dd15fd25cb5f79480365303
SHA1 bf54b69dddd102adf867be9d158c375a9be27d75
SHA512 f47982ae9eeefe43246edcfb728ca9bd8020649390405886b43a7f4df48ca7abfc5b0a23faa0d1f8ba260539b0b5826b9e1c49d7951279edae06924d337071d2
SSDEEP 12288:f70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:f4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T121552391AE5509CAE34FC3F0D0F787D1E9E01EC272444E6B57E0B9631DBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 71ee132ed4c5d7483f349202a1350fa980801d82cecaa7691d8c06c53aa6175a
MD5 11f9ee025114028c79f06cdfef5ba744
SHA1 19473ba52303b0c5d582adcee57c03d1f716a7e5
SHA512 a9cc446c86d42038245b1e8e41400adc43380a5c823116f1f8a290373ae04a3c1a013618871a878bc9436947b24a1ded09eb5850a7c8b520a5c3fa72e8b3dffc
SSDEEP 12288:K20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:KvgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E95523A1AE5509CAE34BC3F0D0F787D1E9E01FC672414E6B17E0F95319BCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 cb326baa4e6f83ebc920ffdd1e8ec0286ff9324ff2f91af966fd0d7e0fe3de6d
MD5 a12b094af8b7ab5659207961207a9143
SHA1 663bf613e762e4edf6353e45d2e093ffae1f2547
SHA512 b6c20251b0622720088e8e0f08008640c85b35ede79cb75342e9344704dcd72af15961f18ec2114626571216786bdae8d56352685798508607ff14432c43519b
SSDEEP 12288:KK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:KDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12F5523A19E5509CAE34BC3F0D0F7C7D1E9E01FC672444E6B57E0F95329BCC996A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 e8103b01564d5a6d7399d652ba2a85c6ad1ae8ad9d515da217c58991ad949f8a
MD5 b7bf72b58734f4b2f44a9a9799e8fa95
SHA1 8601db611d01aeb457c2bd9eef2f621a2eb85093
SHA512 6cc8f978f5a7d05c33435f8a33bc1ec602d2093d1b6b008e179391c05bb2de0d8d43116b750e16ee07eec416f39616b3acf5a0f3e03e61c2113b042aee90553e
SSDEEP 24576:EZM2zFVSOLgXe4i7ojhsP5Lgrk1TWb4AN5:EZM2zf2e30jaNf1TWbdz
TLSH
T1EE750195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03E436671F773A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 a7544350547c7f534aff9456bc669935d6ca3d4aa4418207b9afc64accedbee0
MD5 32ccf2b78392665696fa376fabe7fe53
SHA1 81ae430e4d2974fea3b35315b3bf25a89fcd40df
SHA512 c55e4fdf1b3cbe3a04eebd79136894792640dcf28bf867cab75388f573a26a7ecdcb83a4f1124e323be1838356cbaf407c3690cf2dc0709b160e2b1df5b02445
SSDEEP 12288:Fp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:F2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T173552391AE5509CAE34BC3F4D0F7C7D1E9E01FC672404E6B57E0B95319BCC9A6AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 18bf696480ec19917dbd8bdc3af41271d07c0787c63417d84e8a617cf51b1ba3
MD5 b1c068c33c8fe30cf35182793a37db8b
SHA1 2d27891d81251162ff8a7621d26d3611752a6c65
SHA512 6206eb11cfafce2dbe6016a339d416f3c61a8b109d77c586ded4d8f70b9d461bb6603b112aa91ba7cc1d35add5c12bd4dd8afb7cb6197dbe940816ba7ed80fec
SSDEEP 12288:7l0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7SgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T130552391AE5509CAE34BC3F0D0E7C7D1E9E01FC672414E6B57E0FA5319BCC996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 af6c0bffbfe9f51af912dc2b6ba92a2100b325a89fb086741df9c24d99b444a7
MD5 196131c65a221349712f8352c6f5e7b6
SHA1 d5797775a2745190d816355832dd11409489adc8
SHA512 14cf5bdfc1e22f03678b9717772c2f848327ad147f8b75f08ccc4d38ba71c46ef90f6129aa9ea7c73fe3eef652c6467df1c6dfce629f72972cb6251f20b4d806
SSDEEP 12288:pyPz5L8+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Izy3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13865025777A120E9D16B8278C4E24B42F7B1787217208EAF13E057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 978f4ec7c41ae2ae45469d4d0f178549e48766575f4de1689f8e5dbd4ebcd874
MD5 8d456b84a283b2c548ea185c24c5b8db
SHA1 eecb1be26a0069ad55157f2087d62359be923b17
SHA512 49365e343a15d61d19ba95c0d9e6c2bd2aaba09df9465b1015fea2854f142aef96a5bbb3dd3a8decadeb4e993e5c99082e77cbafe2f9e2653b5a7599158e8486
SSDEEP 12288:Rp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:R2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D1552391AE5509CAE34BC3F0D0F7C7D1E9E01FC672404E6B57E0B95319BCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 9938485fb4dc7d51e1069c4c9db861523b8e717bb532bfeb1a1bf235c388c4a8
MD5 b07538a547f0dc80ba5fef8f402706a1
SHA1 2eb3c2174cab2301c8c48ee4383f3d76cef36ca3
SHA512 2ddb1b5ec642c46fabfc8aeee5fa91561249ea1d290259efde2f41aa03a06fee4665de63fe4de508c8eefbf1f75fbb1f9fb1ab64620370b03ac37e0c5a0c5daa
SSDEEP 12288:fp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:f2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F5552391AE5509CAE34FC3F0D0F787D1E9E01FC672404E6B57E0B9531DBCC9A6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 7a683705675c0a88a0dfad8968a5c01aef0cf67eb46b55c27780091be8b07852
MD5 c00e50cb721ee50dfbafed420408665a
SHA1 0aa9d27ef5f13754471d07027492167a2292e351
SHA512 2b2a01a4e6f7c22ce851de8619b8175acd79d0c79761bdb142e673827af3899c3d69ee353fb8125d83a4069efaf2afbb22e2b5cd20bb0870a6da4edf8eed10e5
SSDEEP 12288:XyPz5L8+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:azy3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B765025777A120E9D16B8278C4E24B42F7B1787217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 8adea93ad09cdec57bd635b4b66cee52554cd8fb24ed871079e34e8adf311418
MD5 ca59e8ca5ffc905a39eb0e75d1819c78
SHA1 65db8e19a4141155ab02b92efcec20eb8e3be37a
SHA512 a58f446b0286df35f862cdf84cf3682471b5cc820737cd49dc424a59e9ec44479190a3be54c241e71acb2092e5c267197f6cc5d70796c61b5de29eaae6324469
SSDEEP 24576:nTDaLl3z0zDRgXe4i7ojhsP5Lgrk1TWb4AN5:nTuLljre30jaNf1TWbdz
TLSH
T1967502A5B3500CF8ED67827EC8A68A42D6F27C560760CA1F03E436675F373A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 dd364a178b2e7d5b618351cbd0868a6e952dbb5fcc87253949ba20515ea1dda0
MD5 c616b04aa2e84092fa068fb711c639ba
SHA1 d964b182212f30d1e27df05d2cb9d8d0a92f3de2
SHA512 d3d3d22190e6f711dd94cf9ea6075ca0de278fbc3ea09bbc9bc140fd48dbe9aacd3a555fdb811e9f710cc8a4a031fd42e995e56ab0d177bf43a411af6e332c41
SSDEEP 24576:2cP4mcvIjkGOxhKP2l71nNKbrh/8KBugXe4i7ojhsP5Lgrk1TWb4AN5:RP4m4IpOO67W8K7e30jaNf1TWbdz
TLSH
T13B65AE2DABDC0096D0BB917485A58A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 26f0034d87f50398fb99f5a5ea26ae33e39c916f632470e7337cc2fde779c3ea
MD5 fee831b93f047dd749197d130856b8b8
SHA1 a9fb293f1852569483a75bc5ec564958cf1fa14d
SHA512 06117e427ce27283d44642a174dddc61f0a9d217fe5646a7ee2d03257f61ed420e5ff345942c2288a8aaf6642f18e6f51c82123fd6f0ef6dbb60a17469ffba6d
SSDEEP 12288:ORsfZ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C365F15AD29802D8C06E92B5C3968A81F3733C5193E1C7CB53D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 518f5f2cf067b5c3ab7646ee2d6300cd7da4339b01e1147ca688aafde0719d04
MD5 b887c14e282ac8b5293b847f4b47900e
SHA1 10d7e5e0b78da7d44a7b840bebfa6466a5bb7744
SHA512 d53773b2116dafaf2e525c1469adcda775e7de4f6f23aad61ff04351e4c06078dd858d4f6ca8284f730874c3072f75db3b54f9dbafa3c4c80f5bcd75a5932de1
SSDEEP 12288:u50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:umgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F95523629B9809C6F29FC3F090F7C7A0F5653FC06B00899B56D0B66319B8CD59EA452D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 daf2038ea36df0ada55263f39cf070fe08be063b3894372c98667b4be1199eee
MD5 4ebf3acc052996570d415509abefa08a
SHA1 e14fb6b35ae6225490afc516bd9046a701238fc4
SHA512 95cd850dddc4bd8e56d9e5cda05bac5eaadf030409e064c88d9d61ddab6f918d974f094a7025e733222d234b6ac2f1048859c936395c14d207919a706a1320b5
SSDEEP 49152:1a0h2GEkuAe73q3pp46zwwQPe30jaNf1TWbdz:1a0hNYG4JwWU023W
TLSH
T17F85AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 654732efddc2545c3754256038df9903f109b6c6decee3780007c77a7ceb75c5
MD5 4813dd41876bd5e42a1e8c2ad240ccf8
SHA1 756e782c69b0ba0a3879c59a928f9aba5f78a464
SHA512 cd4fdd03995864de0d18f6ec03c5129544a7ebb9c0116485a1619c891d6b7d9e0d87e260d220acf1aa9a9ce784aad6cc353f49ed01f4bfccf9f8905f1a66124c
SSDEEP 12288:FhbHjfXi0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FhbHjP7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CA6511BE2AAC10C9F276D2BC91E28642D371BC55271187EF13D1927A0F3ADE85D38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9583cdf358a2bc2b0dc779bfd25f6d55762afb9693e8c451c73d62fce05c2d6d
MD5 1c0c8895ea8f450cd46e5864206731eb
SHA1 82cd59b05d261a040041f114ff6f2d36195aa3ef
SHA512 4bf978e222cb66da53a872b7fe4f520536e8fc6fc09ad22ee4c8f6d39bf73fc28940f424b2dd95151a55ad93792ce5721222d86f017f602d7a35e7f335acb76e
SSDEEP 24576:N3YgnJcRTk4yti+R5dBR/zgXe4i7ojhsP5Lgrk1TWb4AN5:NIgnaTk46pBR/Ke30jaNf1TWbdz
TLSH
T1B445BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 a65cf5277e2283fa1dfa3dc28740c6ae115de960d22f965134da7ed3a923de31
MD5 ac9ab9fda1cf83b0bd83d7d6ae47c9d1
SHA1 a367a55fcc921662f946b89988e22404398703b5
SHA512 c8d51dcbe9315f6b874c913c316beadc2c5f64b4225007b3bd7119229a2445022e5f80bf7ec58664922ded213c2c0407433ef42e3e8209db2f6daaf5271903cd
SSDEEP 12288:t10DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:tCgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DD5523959E550DCAE24BC3F490E7C791E5A02FC133014EEB56E0F6631ABCCDA6EB4468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 a6e417bbb83514cb4980ed4027770055905d18de52e53ca1aa89b6319372d10d
MD5 bb1f7c7b6054888340ec1805afb8f3e5
SHA1 9681e398cf974b9c178ae797897274b141e3ba4c
SHA512 921a1f88de8565a3368d71cac63f8d57e3e2aa0b8cda61a2a2d0558cef5f11bb0a88d622580be2c2d524e0ce15f2de8c8738241dac22b693c344168bdfcc1f3a
SSDEEP 12288:9ObZA4LWOsvAYFT80DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:atL3UT9gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BA85F155F79400F9E96BC27CC4A28A12E2B2789D1364E7DF03A84B661F637E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e2de7a43715849028a74a74314bbbeff1c3d3ea81019c5fa8d94746cda1de4a7
MD5 98629c1c6818aa3d7b8da2fbc5d2b1de
SHA1 96b02503bc4a4edfe2cddc7896104634099489b4
SHA512 cb5ae23c0d0c52376b8e05228e57334acd2fa95a691a6b86cf349999e721502e99d30d466d9829b76af74872a847600c52e3892f71d627333e7dd65a6afc30e0
SSDEEP 12288:ppFtdOY0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:dOZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16E65026A37EC10D5E16AD27C85D38349E3B17892171147EF02E081BA1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3b81a71651a3eac57d0a98c4d94a04a103ea358b7a774ad7911f1650bb435107
MD5 10100ce09554e7f926d48d68990039a2
SHA1 538230a75a08c9dfdd843c2dea75bf2581f13d4e
SHA512 40587db3d2b7be2115ea5958009c7b3fc73e15dafb249b74a235d1fb11c059de16d7c7ef4d725bc7cf63fa3351a5f3f540b7d7aeeea3b3c09b1e472baf22a9d0
SSDEEP 24576:a7NM9YqZqmWMUkPjZM48Mv6bEhs2gXe4i7ojhsP5Lgrk1TWb4AN5:a7cBWMpPjN8DbEhCe30jaNf1TWbdz
TLSH
T11F659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ab8edf7441aefacd49986073f3077a66729afdf8f2cf01e48f150ef8e6489e92
MD5 e10a127e69c067abcd591060ade72541
SHA1 a530fc8eab1c30f65029fbc8e67bcfea98ad4f3a
SHA512 274059657c35b8c86c1092cacbc41cdede0d95759e33d5025f1d9440f9ee968bc64cadcf9a2a29247296493672e24d058a5fb0330a478036f1621561f8eb157a
SSDEEP 49152:8F2YuHNETovAvNYf8km5e30jaNf1TWbdz:Z6BCf8kkU023W
TLSH
T137857E6927ED80A4E0BBD27D45F6D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 87c2b6306ed1b3f2aea71b5639e93b8fa7216f7c5b95c83ddc1b6e07fcae0d65
MD5 0c14fb050bff53519a80844f9d5ed32b
SHA1 668e837082e4ee21d3fe2beaa434fb9123d76892
SHA512 92286bcd3f17a7e6b15b5aa5cd4fa1892322d8893949e11cbf6c601895eeba96ab10433689ba912c21dbe67a9123839d07ff9fe6446670d9d2872bbe183639be
SSDEEP 24576:qAFs06+Omlf3NXEbTolgXe4i7ojhsP5Lgrk1TWb4AN5:zFs060lVXuve30jaNf1TWbdz
TLSH
T16665BF2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 5ed9bda61eaf6fb0700aca162cb91a299e3eaded6a64bd4b85f64fd06782e82e
MD5 f0e6fd6c0d2d438eddc0062ae868ac36
SHA1 74fb31394f05d993bb23f54b703911e2aafd2db6
SHA512 aa51e183796c4fa07361c40eea4c957ad33372628846e0630b1669e97d1bf1db3053e394d4fd67def1555515a823852dcc2f6c89e50581824ce6522e4862bea0
SSDEEP 24576:BJnJ5D3WzYgXe4i7ojhsP5Lgrk1TWb4AN5:BJnJ5DGzve30jaNf1TWbdz
TLSH
T1F675D02DD2A810E8D0B7C3B4819A5795FE72386D2F226ECB14B4D5353F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 17ddac039e7881eb6071889c636d9c579b5b8df1227d2b0c3030809a077bb34d
MD5 91f1810bebaf1e8666ac9a7ae82d8b84
SHA1 031ecc13eb605ea74e67650c57ffa0080d142e2e
SHA512 10298cb8a17b1426d48a153de2335016b361f7d62a83e307816e0ad324a5f4962372c857472ce019d4b661c96710c9b3432d4deb7ccacb01300209d688bf911e
SSDEEP 49152:Jg06DIKdwc+eQnSt65aVNe30jaNf1TWbdz:yTU023W
TLSH
T1FF955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 268314ef672caebdb01c98af71fc9ee2690163a977d0d4e528e203415fac59df
MD5 f7d4fbf542dd96e3d9771480f1fbbf7c
SHA1 6612c8beff2027cb9074ab55c79fc58c3f4c717d
SHA512 de411f82c1c773751f64c7a9d7b22e884b673160416288eddd3bcf1beb96e192e7448049d06246df3438140d036cb3319fa240d50415e3e92b9d949b950401c9
SSDEEP 12288:vEP3Rj30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0jkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B265126D6B9C60D9D16BD17C90E28741D3B2F4A127421BEF06E0D27E4E779E92E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 67021ec73b537e083659445a5237807e5e08d89220ef4e3fa0b34e4bd864b48b
MD5 e3dee70192cc64e4ba5bf9c76aa36c59
SHA1 74ac3a50513e8270bd83700f0001f21e69b24c8d
SHA512 8a61b0c93f747da262474a0c8394b4c8a0c1a55e25df8236cf4c1f2b3bb71c6f575741319487d66e1e5385f9ea0ec7c9001f4c3a8919db584826ea3c7cbc250e
SSDEEP 12288:9jkyy0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9IyrgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C5651204679814C5E2AB8278D5F38390DA70BC606B1087EF51D0FA3F6F7AAD4AD74B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 66f6e365b8a7fc398a289dd87d0a69dc561c1d8cd49b453899582d3966e3196b
MD5 e06cea452de806413fec0039f6e03b3b
SHA1 328c393f71a17ea9c7bc720adfc9211002bb8a0b
SHA512 67b5836103557250d6e2d082993e7ca4db6c8543b4136ee65b9c1361a9d1a67752dd7fe1dd1dbb338e4c840f54c3e4094ce7e1be24c9b5fd6d7f17b5f592280e
SSDEEP 12288:Cno0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19F5523995A5519CAE24BC3F490F78B91E5B03ED137004DFF12E0F6734EB88DA6AB4858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4bcabd9c112bd07a4982bc100e32b9393a2c0f00a68efc9a27b5aec3fc4da23d
MD5 363275698a3911fe1eb2a6abdc7e70e9
SHA1 15bc4a3de2db886607094e8861323e30d8b77bb8
SHA512 50a96470d4cad7dd5c768769137705fd4e6374c43e3b5cc1e92626971376d263171c1b541d90139ae83dcf90b0963174f4380b3663c75272f18185b980b7029a
SSDEEP 24576:FQ9MxZKdcz9dw3+gXe4i7ojhsP5Lgrk1TWb4AN5:FVKZRe30jaNf1TWbdz
TLSH
T1B4557C2DABE909CAE177D27595A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 6c1d9fae960ccc14993035b729aab49736124a74fb4210b793579372f961acec
MD5 52f6845eef5b5f50cd23f8b675d9a57b
SHA1 26a4df6d05e2e2dc370e6f7622de4c47e1e6d357
SHA512 803d8d2744261b94daab1baa05c86502e7e81e5d0e66c942c4e27dacaadb1bdc7b36abcd91a54cc416e331574849ef007c19040160624ae05ec0fe2f60eb0198
SSDEEP 24576:byocHApHgXe4i7ojhsP5Lgrk1TWb4AN5:OocHApue30jaNf1TWbdz
TLSH
T10175E01FBB6900E2E166C23C88868741E7B3B4702B5257DB52D1C33E4E679E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4859dbd74f68c14325281ea5c70316c2f8fa73cfcf9ae991014de947e0b59a00
MD5 6645846fd1dfad62f5aad71a5c2cebac
SHA1 db05c9d7f1c4f9f27b3091f1a0dc922fb3885e5a
SHA512 97e0b0973d64da1b1171309b20036be69ccd927ff1fb548a4c421a5c98cea53a7be3b927a6b9dfa65c90b074fc1d5fadbd2bcf47f2fe5f11ddfc7342ba3e0647
SSDEEP 49152:FWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKue30jaNf1TWbdz:10zuNIYU023W
TLSH
T13AA57B3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 95429bb8afbe81fa2df573171a323d40bba04d12e425bfee40baaa821f6cbe56
MD5 90e512b7850f6947932d76a09699fe54
SHA1 c566d7de950a2fc1d1c9a47d7046daf6773164ad
SHA512 a58bd46081f8fa37a63d8a4e838257a1b2751f99cd93ecf82aab34aa7b92cebaf3639aea75ff64fda7acc70122eac8328f3064ce8c1f4697561126dc66faf803
SSDEEP 24576:N1QT7EcpfxR+N5AWAz3ooiYtjMqbkgXe4i7ojhsP5Lgrk1TWb4AN5:4TDxR+N5YzTfjMEe30jaNf1TWbdz
TLSH
T13A55B02EA7F815E9D1BEC5789A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 8c7345aa67aab0c283026a5206e33350ff04864edbe50a584b1a16bde2157fde
MD5 e59b7ed2c6b4cb04246298d0ba32e02a
SHA1 2ca5161a0097ab99360ed7cdb5c1bea319cb6350
SHA512 ff243ffbd233d525f86f7703039ded20b435edff03d3c406558627f67bcd8d67b28ffa879c1a7ac87cf35330d686ce2dbb115f691fb0abb064d35c4e9c8ff42c
SSDEEP 24576:ETMdOz0FFS+2mSLAgXe4i7ojhsP5Lgrk1TWb4AN5:s0K+2mSLHe30jaNf1TWbdz
TLSH
T13C75F17EA76D14E5E17BC27CD693CA06E672386103116ADB06D0C17A2F6BEE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 94c5d048b14712ef9a70ccf8f3d4720b38cc45aff2696d577f1654d44d4ef5a5
MD5 7f5e20ca113aace700e3b7ed8aefd8af
SHA1 2b3caea137cc475a04c180ac827752232858de9a
SHA512 10d292bc81be7040839c5e7c5da575f3e6f6a2cce3740383f238d1a1325e11f0edb9441d01ea0794d9c4391c0bf6e2aa30dfcfd94095381aa28116c08f928288
SSDEEP 12288:J4+80DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:h9gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C765125967E824C5F167C2B4C1F78381D6B07CA123104AFF26E0EA774F7A9D89978B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/644-0-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/644-19-0x0000000002A10000-0x0000000002A93000-memory.dmp

Download

memory/644-273-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/644-9-0x0000000140000000-0x0000000140590000-memory.dmp

Download

memory/644-274-0x0000000002A10000-0x0000000002A93000-memory.dmp

Download

memory/644-284-0x0000000140000000-0x0000000140590000-memory.dmp

Download

memory/644-12-0x0000000002A10000-0x0000000002A93000-memory.dmp

Download

memory/644-6-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/644-8-0x0000000002600000-0x00000000026D3000-memory.dmp

Download

memory/692-266-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/764-34-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/892-257-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/972-193-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/972-276-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/972-427-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/972-394-0x000000000CD20000-0x000000000CD28000-memory.dmp

Download

memory/972-177-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/972-161-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1892-31-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1892-58-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/1892-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1900-267-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/1900-426-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/2144-135-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2144-255-0x0000000140000000-0x00000001401BF000-memory.dmp

Download

memory/2144-129-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2584-256-0x0000000140000000-0x000000014019F000-memory.dmp

Download

memory/2744-253-0x0000000140000000-0x0000000140153000-memory.dmp

Download

memory/2776-410-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-429-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-447-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-446-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-445-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-444-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-435-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-437-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-438-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-441-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-442-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-443-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-440-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-439-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-436-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-434-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-432-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-430-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-431-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-433-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-428-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-417-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-420-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-422-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-423-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-425-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-424-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-421-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-411-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-412-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-415-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-414-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-413-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-416-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-418-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2776-419-0x0000029AE0B10000-0x0000029AE0B20000-memory.dmp

Download

memory/2804-67-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2804-61-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2804-73-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/2804-71-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2868-281-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/2868-85-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3184-283-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3184-97-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/3184-89-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/3936-118-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3936-124-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3936-254-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4168-107-0x0000000000560000-0x00000000005C7000-memory.dmp

Download

memory/4168-102-0x0000000000560000-0x00000000005C7000-memory.dmp

Download

memory/4168-247-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4468-344-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4468-252-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4484-248-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/4676-282-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4704-75-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4736-142-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4848-59-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4848-45-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4848-39-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4868-246-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4868-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4868-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4868-409-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4968-258-0x0000000140000000-0x00000001401FC000-memory.dmp

Download