f1c0d343c1a5d6c0ede0b87e4fa14c376318d6004dc1b3d3144eaaffe8e8332a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
Size 3.0MB
Sample261027-flft4ayt5j
SHA256 f1c0d343c1a5d6c0ede0b87e4fa14c376318d6004dc1b3d3144eaaffe8e8332a
MD5 dd8fb620413322311b4a45fd8e8707f6
SHA1 880ecea1c9572e4ecf9bd708e8617e5853729a85
SHA512 43118a36dc222ee146c045d7733bab0079ae809364e5ddcdb3bcae15e0a8a0e262827abc7266e0c4072cb47c0502e8ed721d061ff1196ee4f3263cca2e8d68bb
SSDEEP 49152:s8s3gt9LoHwjvTLXewnfZO3T/M+w0L6uRhTnZrCfQqNbME8osJHW1R:sOvLSwcbw0L64EfdbB8hW1
TLSH
T136E5F24773E6C0D8DFB781F6C9315222E671BC110B388AEB25A0962EDFB39905B36711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4744	elevation_service.exe
1020	elevation_service.exe
3708	maintenanceservice.exe
464	msdtc.exe
1212	OSE.EXE
3248	PerceptionSimulationService.exe
3292	perfhost.exe
5048	locator.exe
1204	SensorDataService.exe
3344	snmptrap.exe
4080	spectrum.exe
2532	ssh-agent.exe
1456	TieringEngineService.exe
3736	AgentService.exe
4056	vds.exe
1256	vssvc.exe
3740	wbengine.exe
2448	WmiApSrv.exe
4252	SearchIndexer.exe
2508	alg.exe
2336	DiagnosticsHub.StandardCollector.Service.exe
4760	fxssvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b719ecca862f6ed0.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4964-7-0x0000000140000000-0x0000000140307000-memory.dmp	upx
behavioral1/memory/4964-68-0x0000000140000000-0x0000000140307000-memory.dmp	upx
behavioral1/files/0x00010000000233fd-299.dat	upx
behavioral1/files/0x000100000000c53b-323.dat	upx
behavioral1/files/0x0001000000017032-385.dat	upx
behavioral1/files/0x0001000000017007-451.dat	upx
behavioral1/files/0x00010000000233fd-455.dat	upx
behavioral1/files/0x000100000001678e-461.dat	upx
behavioral1/files/0x000100000001780f-459.dat	upx
behavioral1/memory/4964-457-0x0000000140000000-0x0000000140307000-memory.dmp	upx
behavioral1/files/0x000100000001742a-454.dat	upx
behavioral1/files/0x0001000000017bcd-453.dat	upx
behavioral1/files/0x0001000000017046-452.dat	upx
behavioral1/memory/2508-544-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/2336-572-0x0000000140000000-0x0000000140166000-memory.dmp	upx
behavioral1/memory/4760-577-0x0000000140000000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/4760-592-0x0000000140000000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2508-594-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000499661c3cf65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f64072bbcf65dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034f182bbcf65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cd70abccf65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034a555bbcf65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008db687bbcf65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016c5f7bbcf65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4744	elevation_service.exe
4744	elevation_service.exe
4744	elevation_service.exe
4744	elevation_service.exe
4744	elevation_service.exe
4744	elevation_service.exe
4744	elevation_service.exe
1020	elevation_service.exe
1020	elevation_service.exe
1020	elevation_service.exe
1020	elevation_service.exe
1020	elevation_service.exe
1020	elevation_service.exe
1020	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4964	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
Token: SeRestorePrivilege	1456	TieringEngineService.exe
Token: SeManageVolumePrivilege	1456	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3736	AgentService.exe
Token: SeBackupPrivilege	1256	vssvc.exe
Token: SeRestorePrivilege	1256	vssvc.exe
Token: SeAuditPrivilege	1256	vssvc.exe
Token: SeBackupPrivilege	3740	wbengine.exe
Token: SeRestorePrivilege	3740	wbengine.exe
Token: SeSecurityPrivilege	3740	wbengine.exe
Token: 33	4252	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4252	SearchIndexer.exe
Token: SeDebugPrivilege	4744	elevation_service.exe
Token: SeAuditPrivilege	4760	fxssvc.exe
Token: SeDebugPrivilege	1020	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 1932	4252	SearchIndexer.exe	109
PID 4252 wrote to memory of 4228	4252	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3708

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1212

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3248

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3292

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5048

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1204

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3344

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4080

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2532

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4792

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4056

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2448

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1932
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4228

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2508

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3368

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9b3ac73925a514215b03305788cb9fbe1ea45751c49ddd43b6b45797ac50d8c7
MD5 8d2d3bc8fb324b0611cceb2fb724f79b
SHA1 b8ca7dc083183d60b3de878224205689b9f601af
SHA512 975d93ad61dff9d1a00a13a75d91ff6b5ef12de055bb5b9d8f0a9a978bbcece360d354c646fad7ca9ad001830b602b6f8445122c36e28f6143046b0eb98a9d7a
SSDEEP 49152:+b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn/T/M+w:A3q6HjBow
TLSH
T133D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 d2045f0fa53d85a4764617a967d22f2c5754d93ab7a5434a885e15d81e91b75e
MD5 21b729e105772090322e34d182fcbeac
SHA1 ae0927f7521bff25fba17c8b34fa8927b281c85b
SHA512 7fe896dd132c92282168eefd5e75928f3dcc9433672f0dc17abbb21a77041fddc502313b5b484f8f90729f12bc304cb5ef361cc2a937e3cf6a2fe642e2351f55
SSDEEP 24576:7XYIlsczAxoHjto1GFxlXutIs1WZX5ARFZbR6SG3WRNfaHIe4HZxKsrCZRQwR:Vsc5T/M+wLL6uRhTnZrCfQ
TLSH
T184C51224E7E108F9ED67827CCDA2D605EA33B4664764F69B03E099260F332945D3FB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 929573b4aebce8ec5e4318fd9d5922125b7691eab5bb77fb37dfd305190bd668
MD5 9ceed67ba3a118a118d18a7753e6e9cd
SHA1 f0863f7a093dc355ce843ccf78e7fbd858c44cfb
SHA512 f4faecfb42ea49f3ea095d2a20b32715cb507032575765ae37133ab5244440b1becfed36102b36e7b4c985e78c5ce3aaafe3f9b123db85ed1c668abd51d34e4f
SSDEEP 24576:7XYIlsczAxoHjto1GFxlXutIs1WZX5ARFZbR6SG3WRNfaHIe4HZxKsrCZRQwRTos:Vsc5T/M+wLL6uRhTnZrCfQVT/M+w
TLSH
T155E52325ABE108F6ED67827CCD939601E933B4564764F6AB03E0D9260F371A46D3FB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 697a59cc3b2b20ec09f16a76d583742cc6938053b26736104bba127e6133e59d
MD5 f1ce923a28e2a4fcb3dafad7a712e17c
SHA1 64075e87bff3e581d882cc8110cb409a4dc2f3c2
SHA512 e931f2fefed2fae628e23c2599be4f03f0a4559ca2bd5d7b15489315d4ef141324a68581033acee7276fbb09743c330b9edc79d3226e1a4783d107eaccabdef7
SSDEEP 24576:qXYfDtczAxoHjto1GFxlXutIs1WZX5AR:xtc5T/M+w
TLSH
T16885F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 28ca077a74e7358d0f1462cc341c55ac8c29d11d0629f8257f321d31ec4e1fa7
MD5 860fe19d987904d85e27a7c36ee53ea1
SHA1 b56ed74eea869cb9bf2e495a018f158933debf36
SHA512 2cae49af874446dc0587cd1da04f6758eaf3d0e02feeb71a7fd0e2e6cd63eacacf28e80cabbaeb1d9110a4789b5bc4846f8cd735354d9c38127bd8737caf655e
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHx:4UEtQevvqc2W1cpV2EI32
TLSH
T145474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3fe65205326fa1d75fd5999e1a4c86b53c6fcb1dd20fd36bd7df90bb21d849f0
MD5 bd710d91f3766cdc2eea8a3cb90cb857
SHA1 e1cd22f4a0c3665c6ff731e85abf90d352f744af
SHA512 7747e63f34c61bacbf6fb33841ddfb9d3497167642640dd0e16478043ae6b1f1d5f97ae3fc0cf33939e9ad4e315474f1a738d2e8badf1b128905967d25daca97
SSDEEP 24576:qAhGLJIFoiwtA5l7S53coHjto1GFxlXutIs1WZX5AR:qAMyFoiq5lT/M+w
TLSH
T15135AD81EBF955D4F5B3AAB899B69170EA77BCA65E30C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 46c436b0a17c4360586edd544e83fa94daebc630380864d9cf09cd1912af50ef
MD5 953e2cf2bb61ce85f8df60add66f6642
SHA1 ce70bf0f920c5fbe1d32dcabab4bb93db7b16413
SHA512 e2d6824b6f0843ea3d19687327bea6ebfb066eab57be145a817a439337cf97da5e3f3399ad3832ba221ff3bd07490d8f179e93b4bac0660e0b25e758d2e880e9
SSDEEP 12288:/mw5HEjsChNDBFgl0WDm+CihKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:+wuiOWzoHjto1GFxlXutIs1WZX5AR
TLSH
T1D785F14676E50CF9E96741388597D536FBF3B8022A25D72F0760CA1B5F37220BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 843dba2853202325a0c33fb2720362d759e8e9bd421aa57bf910d001e63f8d07
MD5 d9efdbf281f62d622e8a9dc0bd82d789
SHA1 09cb03c64c3baee142c30217cb2b7f4c5a87f9bc
SHA512 7d4b43c904e408203384e85c5f4c7b3057746d3f1f33b14da132ce05c5aea3770315c5f794bc9aa834ae92e8dab50c61066e667dede6f922e7e33c007eaca30d
SSDEEP 12288:6TZ1Iy5hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:GZuuoHjto1GFxlXutIs1WZX5AR
TLSH
T19B75125626F020FAE2A752789DE36A55EBB3B013173503DF07608A2A0F375D16E39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ac0dc68e1eeb2beb60ac7f176dd66c2c65160d1dd3a58ddd44e22dc6127dbba3
MD5 da52e3219086a4bf851fa2ac2721d07d
SHA1 d06edd4ebfdff42fc7a5dfe92e3d98ad0d85854d
SHA512 49c5876f7df028d44da5e9458c5d9a0030a3a032f7280f27dece58b4cda0a3c43911c859515f3244f932a01e9ad4ba1ba62e1dbae37677d383ae72093cff9e3e
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:fQRQyi36YOcPQLvw2gAf+PN30w
TLSH
T16D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 608655577423522af0d22afa9a9483f17d61965564583e63413f3e443e79213a
MD5 baaf2b2abbf91c1538f4254666d5ee4a
SHA1 a9d3380c92a9aa0cbac7f94d1c3a79a2d920af12
SHA512 79e8c951c66e57c6cae1b21a8adec851782cef61e75f207b600b92a9755b913563cd47d5f2086c04fc4289111a954d5886c3f68fb187ab003a35e239a29c151d
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:wQRQyi36YOcPQLvw2gAf+PN30w
TLSH
T164667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 22d56a5a38a8056a78d358cdd531da01cb9f10e7fcd232bce8b954ba5b53659e
MD5 abfc0b0d3b09b234923f13d9f173438f
SHA1 63dbd79acf6a63dae625c07ba3b144fde7330808
SHA512 594bad87fc081e5e4b0c4055468ea12afc09d015a2d013b7f1d5188471b60eb892625e61fc8dbdad0bf7281602ac9b23c4d89592e2b6958f86b8633664abe67f
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0+oHjto1GFxlXutx:V68Qg55nhheWu7PNU3/gT/M+w
TLSH
T1E1B54933B2F20099C44DE1769F4A973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4cc80993761598d7d3c5e6dfeb6e0caf662d7cbad6062cbae0ea6290032c31d4
MD5 695a4b9b2bb91176260c07d2926e6666
SHA1 8a7781ea70f662790f5d0bf92e4e79634d30bbab
SHA512 c6b6dd16e2e14c9ac30af2766a2fe020cfd71c020701c98e0b68d4c0147784cafce607dba7cf7ea01558b1ff06e514d67ab4ebcdd807d35d0464af02b8f58575
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk995:fy5112gYy5azzVvL69nLKnhZHw
TLSH
T1C2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f974552cc76c1f5069b3d9c86a7742efbe752cc08108301182f8b560035630e6
MD5 abe148c9a3cf3c80fd2121c0d6d03a42
SHA1 0dfdc1b76f100654b3955e7843c63e878bf75bb0
SHA512 7d2007873f8ab69511dbbb6cb94e576250d6f90bbbfd2cc2741969b686cf347634cac25e2f049d4f838dd0d646db78edb5c5e78ec64258ed24614896e761e391
SSDEEP 49152:PB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glaT/M+w:xu6JmVxd2dMw
TLSH
T162D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0d9b39df8aac07f04dd69d21ca749267d44a4a05a48632f074b9526879e9a971
MD5 76efccd011429afa7ec6ec5e24acebbd
SHA1 2be7a1125c6360d8ca990af9dcdb84604d80ff79
SHA512 d3f7e05bfffd80164e570e0948efd3b63398f5fa8137ad62a91486534de317d75bab54e0a2432f914ea8c5ab71e79df5bfddddc0a994b7d9724e32a607a694de
SSDEEP 24576:Ohv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx31oHjto1GFxlXutx:+1hpsNoJpF1A6UU44CwH7R4xWT/M+w
TLSH
T112B5AE13F2D900E8D06DD17887569632EA72BC460B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c00b2a9b6c298149c51c0ee221345bf45c0e8a13ac0e9120ec4b0193f003b122
MD5 5e5509f8a5e540920e35e3b1d7931fbe
SHA1 fbe168c8b65cb01c5df6f98e34157380cbb49ddf
SHA512 58f653f1be9841c8ff0f6613aee22e744d0f8347a479b228e99f3f68d2fa4cb253c319afe533ecf2616920c6e30ea812637628d2e2c90b9d57aec87d6f8289c7
SSDEEP 24576:k4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnquoHjto1z:USuZQIY0Be2KRRVtOnks6NMHqPT/M+w
TLSH
T191C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b41151d20ecd570b3cd1818c4036acb6e2fff8f63205da56290a64f0e8c65a5a
MD5 203afdfd326a38306191a415875cf390
SHA1 a9779fa594fd7b5eebcaf20e2800cfa9449bd21b
SHA512 0cc262129fbccbeab3684aa48208a2d160b48aade29b28dd6eaf7377a137532ef6847ac1ee63929eea743053b7b0c318841919f1faa8f46d90ffc66e1ba08856
SSDEEP 24576:ehiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QL1oHjto1GFxlXutIs1Wg:ehtSn8EApI0figngiDn0AP5wqT/M+w
TLSH
T15B95BE13F2D900E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2562c645bab0f091c92983b7da16bb26c954b415c6e443fd8cfb30e91a6de977
MD5 106981da93278004c3dce16ad1e324a5
SHA1 0699a9ddb5c0eae84eece56a1505f25611e8b189
SHA512 8f06f2b573842800b5fa5ace9b71b2754bf3dfce4e842fd5654bc1dbe836635e0bf30127e4a07a19d8ce0e7abc7201eef54e940de22021958c5ac9cd011d9111
SSDEEP 12288:kYhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:kqoHjto1GFxlXutIs1WZX5AR
TLSH
T1026523639CF340D7F62551B029C77AA1ECBBB307594920BB8B50EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 1216e010491ea57413a09b0fabfb076f7a25360e69349dd07a9e96d937ca83b5
MD5 462f671aa7643d7ceb14b93c3c8834f9
SHA1 782ecf677019ced9f371bc123bb1b3ed1bb2f3a1
SHA512 d6487f79f2ba9189fb8f6dc19c65a43415abff2dab257958b665e017aec1696f6ada47a7e3533d688294643eabfc096d5679de30a2d5933b83bc78de00aa6d99
SSDEEP 12288:+VhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:+roHjto1GFxlXutIs1WZX5AR
TLSH
T1CA652363ACF340D7E62551B029C77AA5ECBBB307594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 e58411f20b16198581f6d687dde0576bc39e9fca9b0be7b606ffd48868a26350
MD5 c10c3a74620ee7f1764481a41b823f41
SHA1 0fd547f414b7a12e280a8a7df49fc862179fa461
SHA512 1a6b97214d9ac9ae106f2c2148c1163259876a11ab5466567d0c0d47ae255c19aa65bab7dd89e43d9b3d3921872f7e100444dfe622fc5222cac536047e573a08
SSDEEP 12288:xjhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:xNoHjto1GFxlXutIs1WZX5AR
TLSH
T19B6523639CF340C7E62551B029C77BA1ECBBB347594920BB8B90ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 767df4e65471e873bcb9555fba419a92998c4d7ab638122f788953d0759dbe2f
MD5 64c841045c09eb81ec2d4884d40d8e1e
SHA1 e0d3f7be7678698f6e0b8aa6907373b5ee371845
SHA512 4ae9a87f5ad01625a4474eaef2b52bcd9493331a40526b824ff3c5220726f7023f9c4a41ab5ebba490f2578cce0a34467fa5e956a7dc4b39c6b071d30239a44e
SSDEEP 12288:+V2hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:foHjto1GFxlXutIs1WZX5AR
TLSH
T1096523636DF200C7E53692B49DD36661ECBBB6465B2521FF8B009D190F391A0BE35BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 f43a8c8bec38866120bef87f5b8a87bd0eb2f1a4a582e8d2fe16b0e46800eb1e
MD5 b7bcf7f49970916df7ceae41c6bd07ac
SHA1 071fb04fb70b640cc74f3ea273811e6682e6ec1a
SHA512 ba2d3571ef82e5c12a26370b663e1adb61bbe0aff085669e9c509ec39a443dc5e5f1d2103abf247116363fc2c439c0950bfc4997f55910b7190893e4af443578
SSDEEP 12288:uuhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:u0oHjto1GFxlXutIs1WZX5AR
TLSH
T12F6523639CF340C7E62551B029C77BA5ECBBB307594920BB8B94ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 68c9fc4d03ffb2eb0463e49fad5085c3b017b92697d3a132a99fd9d5e1a55396
MD5 b8db1bd4ab8e27d7b2ca8c2643928bdc
SHA1 ff0bc2dcde307323f5bb6dbdbcfc4ae63117a642
SHA512 0495d539b7252c21c830da0c4f98b0227ef0cbeadb8997b1a0daedee176f5d1eef24aa417f6eebb39fac95da81a945fd98f31f57ec5ba2d40d0f2b1c155246c0
SSDEEP 12288:gxhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:gXoHjto1GFxlXutIs1WZX5AR
TLSH
T1CF6523639CF340D7F62551B029C77AA5ECBBB307594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 eab1c8be056de928cb9f2e739a68ea05f2782fd5a2c931fd78c1c4ca50c79346
MD5 f58037039069d14d7da51176f5d29c16
SHA1 a22f4fbd9b06ca71c662f2cbdc9fcc77537a3c18
SHA512 54d5dd302d8f91bb3e0d6fe5869d13521534739230b487fb6856406912eaa33b8f5862c44d993201de7eb940b1121541b109d88174367d4aa064f5216028376b
SSDEEP 12288:vthKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:vDoHjto1GFxlXutIs1WZX5AR
TLSH
T10D6523639CF340C7F62551B02AC77AA5ECBBB307594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 95a81f7b6387721b88807ff3137c3089abdac36fb40790782caee7e8339dbe94
MD5 8be86fea60a675fed077d1b5e73eddac
SHA1 392b7d027049dfa9cae9e75baea48b1fee6af795
SHA512 e87170ede1d2e30d9ab905ea87baa911ad6310c36f6e1797cb074bc8a2752311b25399868e3b624b86fc597006b5c4b19b13d9fdc5bbedc4a01263d625752c1b
SSDEEP 24576:tZM0zFVSOLoHjto1GFxlXutIs1WZX5AR:tZM0zfIT/M+w
TLSH
T1AC8502A5B3A018F9EC67813DCD569916D5B37C1A0B60C65F03A43A2B1F373A01D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 477190369e7e04d9abfaf6fd378236c4ecb04aa2c7478383ef2445505576818a
MD5 86c21213eb175d7a34e066f1ff6fec2f
SHA1 aafd2d94a32fd7d5114a7a5817e119870183e3fe
SHA512 b90b79b75f3da2e06becd00e26ec0cc2220e32ed54cf038e877a7aa78eefd556aa1a8ad329191ec128de3f6bcf5a7ed2ad98793f7a52d7f2f34825052c78d6ab
SSDEEP 12288:9MhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:9eoHjto1GFxlXutIs1WZX5AR
TLSH
T1DD6523639CF340C7E62551B029C76BA5ECBBB347194920BB8B94ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 fcddd03b17942822c59a31b6d407c977d8a729f6970ca941e6894e94d673623c
MD5 0dac0a5917b115b84b7c753ac900394d
SHA1 74e0f249fa39a8924151311b737b15282e9619dc
SHA512 9c0825970f578d66e15791961fc8d22818ed51b000b6aad9df1709fad66e52dd0c741d7e7424197161843132e314243a97f585e32e2d85b099d982a8e79a6b90
SSDEEP 12288:sghKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:sSoHjto1GFxlXutIs1WZX5AR
TLSH
T1BE6523639CF340C7F62551B02AC77AA5ECBBB307594920BB8B54EE190F3D0647A766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2cc16fed51c87a12fbe8aa3cf6670849fb146c5f8c2850752b1a4e902bb46807
MD5 2c6423f5888600015bb092ca5ec6475c
SHA1 01d7541b5bc91213991e7744ac596f32e6b14f2d
SHA512 e63df64b70827796aef3de955383403748dde2fe9d9ecb6cc0db46886e0039f4100c83d65f87d049636ee31aed89363b3d03b46451f6e6e2772815abb634eda8
SSDEEP 12288:dyPz5L85hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:UzyfoHjto1GFxlXutIs1WZX5AR
TLSH
T11F75025776F130F9D136927489931A11F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 2864246cd6a44a10c388de6ee617ae9198c3ec2d6a7227bc9bdaebc2b1ee2366
MD5 de990e647360b4119724e2b5716340e6
SHA1 3b47f21d29d470e72e8f0d5c8a08849f14068575
SHA512 caa1d8dabfd6a6ef0089aeefcf9bda70fcd61f1de4f7adc1c2062533393b72ccf095dd66376d7347726d86458c47df6e1060fe4f4436daed93c1ed889dbbd3db
SSDEEP 12288:gMhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:geoHjto1GFxlXutIs1WZX5AR
TLSH
T1D86523639CF340C7F62551B029C76BA5ECBBB347194920BB8B94ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 cbdad8ea68f388609ef4552648ad607e10aad6057e598b0bfd338778a390a498
MD5 3ef21f3828bb5950ab6c2ad1cee674b1
SHA1 a1257c0dacf1362f4261394fa755705d4b5a9d8d
SHA512 4ba45fe5b4db3efeb69017152f2dfbbbc3064faa185bc870e33c10ff0aeba80ab48890c368175824ae3123897c766bb9c11eac2669ef07c1ac879d6f9a252a8a
SSDEEP 12288:jMhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:jeoHjto1GFxlXutIs1WZX5AR
TLSH
T16C652363ACF340C7E62551B029C77BA5ECBBB347194920BB8B54ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 2898ab270f244af33daa0f84e386b40d6cc635f048f9a18a35006905e83e3306
MD5 0800b471436a0c1b01dea5068c10926a
SHA1 e414b5cab7b440902b9655cabb55a097af9dde19
SHA512 474ce5d5c87bd812ac4c88c9e4558715aca217556a249b596b20d24e80a48410247d99e5e0a143eab8c02defe92582dc0a9d428d2f509c4e8778e88259109880
SSDEEP 12288:byPz5L85hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:WzyfoHjto1GFxlXutIs1WZX5AR
TLSH
T19E75021776F130F9D136927489931A51F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 b01fd3b6cc97079fb9e7cbb4d71fb2fdd3f0d7cc6b3d5e7c844c47c315192465
MD5 c77ce339fdedeeec94cfd5da15502125
SHA1 12a5bb3b7b2aee104da272951714535c00792a31
SHA512 b4f0641a6e821a804a1685c9679bf3b20aba3ddab52615f7ac05d1d6a03d67bf8e9da2b5359929cef1d63a53d02ad68d745ac7fdbc4fd33393d61b211a4420ec
SSDEEP 24576:PTNaLl3z0zDdoHjto1GFxlXutIs1WZX5AR:PTALljJT/M+w
TLSH
T1CE8502A5B3A018F9EC67813DCD569916D5B37C1A0B60C66F07A43A2B0F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 d744025a98b9aec84ee97e63560aaf6a9708fea37b296da2d1fb38dbab11f2d8
MD5 ee40b602790eaae8eb2a9303783dca3c
SHA1 729a6777f060af908db19fcea33dce77ba099161
SHA512 79e1a8cac4faec49a11d3f6983c395ad1120a19c68da6da4e8c584162791fb641f412209283abaa357ab129aad2dd421e2b25f30573ce2d2324bf1096a3cfea8
SSDEEP 24576:M3pd9CHKy7GZ5oHjto1GFxlXutIs1WZX5AR:2pd9CHKyaIT/M+w
TLSH
T1B995DF90F3E410E9F0B79A348D765512DAB77C5A1B31DA8F03A4661A1F336D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 c5d55e33a4f502829c8542f2f81005cc32b3592e16c81340d5baaf8bb8bd52a2
MD5 ae2ecb4896513f1b4f1eecb454b057fb
SHA1 a3c5f5ee86c5b55becc28caa4d10c18d5802429f
SHA512 54874e8a5e960e31582e4365cee8d52da933b11429a7180769fc8d2dfc42be6a08d7b638755a32dd28a36720631e7e05142f637d6a1fc3d8c8d0c76b5447a0e0
SSDEEP 12288:hDhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:htoHjto1GFxlXutIs1WZX5AR
TLSH
T1906523639CF340C7E62551B029C77BA1ECBBB347594920BB8B94ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 bedf4bc2ee97790a68b0a200f00803b476547000208aacfb1b0891c1eebe1820
MD5 d01ee6a5c30a16b75484ac6f86b6a808
SHA1 8dce51dbe4c065a150a1a209ceefb6f7eaf4f7c7
SHA512 8f934321751038576b17d99d86df0b41abea4eaaca7dc3bfeb9d1101cf1c1e3ec85a82465cc1e6596012567eb828d9a6f21565dc2d9b871a998fbf12ced112a8
SSDEEP 12288:1ZhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:1/oHjto1GFxlXutIs1WZX5AR
TLSH
T1A76523639CF240D7F62951B029C76BA1ECBBB307594910BB8B90ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 75a1a11246b197a06f50a4c7a96a28fceaabf761213e2d405d6c6fb6076dbed7
MD5 8cfe2adfe7f4818d1dfaca51dae145c8
SHA1 449f741739f90d4ac9e64071474d379017a10f65
SHA512 b0caccb84edab6445d8bf8836c0ccd170cea4220ce4a42e8b3022d89dae79a2f1019077a965fb08a3c5ed7a7c841020b63a56e8c9718613f28ce1a2db71ba5f4
SSDEEP 12288:X6hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:XAoHjto1GFxlXutIs1WZX5AR
TLSH
T1DD6523639CF340C7E62551B02AC77BA5ECBBB347594920BB8B50EE190F3D0647A766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 f70525ce99f3a09a4df5111a13f94e7008c1577d18fe4b06ff5869eccda9e2a6
MD5 f93ad21f25fc17e4837f53499fe4aaf0
SHA1 451c2bfabd42ac7f1c0d593766644ca120a492bb
SHA512 d083a0209dbdd996e35f83e8f1d7a5582a0966b8eedc60631f1ff77e1251861b84a57b7888668dcf817d4b4df57d7eb45803a9e19be1b845a7b89abbab3d4df0
SSDEEP 12288:wMhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:weoHjto1GFxlXutIs1WZX5AR
TLSH
T11A652363ACF340D7F62551B029C76BA5ECBBB307194920BB8B54ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 8d606be5a947aa6390e2c4e20dfc0cd7a0e85f6223b3590c2093df7385e72174
MD5 6d0b85e4e1c692f9652ae6735ec1499e
SHA1 1d52c3aa3611ee949f2a961f300d4c7dd1632724
SHA512 13dab3ae1f3015d500b506087c926c5b3fc111e258782f04c169dad33ed2202b44b956088015b23877861585d6dd133fd54cc51cc7e49f4f4b1cad9222ad9c45
SSDEEP 12288:pDhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ptoHjto1GFxlXutIs1WZX5AR
TLSH
T1456523639CF340C7E62551B029C77BA1ECBBB347194920BB8B90ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 8d9a07d8131a4ef26347642827d7c7f43a9664a783c298af1c955e6c7a4e6249
MD5 0a2ee783f25685dec62b881033949154
SHA1 681f9c6c5e75deef28db8068c8002b352535e216
SHA512 04d75ad75e5e3852bdaead5b3386c47698bbee9699795092860bfb0c9f18d7e3f43c1b2df1ec97126429c39356089f7c09cf50b025682d1d60d38586a786d388
SSDEEP 12288:1EhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:12oHjto1GFxlXutIs1WZX5AR
TLSH
T1B06523639CF340D7E62551B029C77BA1ECBBB347594920BB8B50EE190F3D0647A766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 d40d5b5552cdbc88730ea96a228f8e5e3fc8f129815dbc1a46bbbccc495c39f8
MD5 094e42449f9e7cfeac4fd2eea3a33e63
SHA1 91ead407001563cd7c91998c45c3e85d74734c69
SHA512 fe22f2abe32271e57c1fb869d24ffd17b003f1f9dd496cd85efde6936ca4d927f76f376e4198cd8f0ca759a03102df7f15aeee5ba31f19b40020f2b28888f965
SSDEEP 12288:2uhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:20oHjto1GFxlXutIs1WZX5AR
TLSH
T18C6523639CF340C7E62551B029C77BA1ECBBB307194920BB8B90ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 3ae6a8d488876a4fd4649dab149a52fb1efae4ffd50223dc678b61a8078bd533
MD5 443b015fb59a7e644ffd99c45cce0110
SHA1 420c9e26e7687cef68e543103bb9c724165b3824
SHA512 974fc07884dd0f7aa68f2dcd5e614a079183a0571fcb9267d6a12b0e463f118326fb736829e4e5cda8f9ec354afb22210301e411898bd1b56cbb427f67e221b7
SSDEEP 24576:CcP4mcvIjkGOxhKP2l71nNKbrh/8KB2oHjto1GFxlXutIs1WZX5AR:tP4m4IpOO67W8KZT/M+w
TLSH
T1A265AE2DABDC0096D0BA917485668A4AFAB1742A1F3286CF1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 9d4966c3567c6c0964c529426f0a46baa405f7ed4399ffe2dd088217cfc1e7bb
MD5 82b1450fccb2907cfb96e1e9f4a3ec68
SHA1 3915c3f7d54671fc9fb8ba776366e24733e2b423
SHA512 dd7005a9582107557ff3369cc04dd2744d5e5249273664b80123d494ddcc17ea2be60ec96fff38d54cf730b6724bc7d3bb0d1b04cad6391945c7c59abf078ec5
SSDEEP 49152:6P4m4IpOO6708KZT/M+wCL6uRhTnZrCfQ:ippOO1HwCL64Ef
TLSH
T140B5D02DABDC0096D0BB917885658B49FAB1742A1F3296CF1160933D2F77EE14E36F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 24b08c44e878b37b74b50a622119f15dce77cacfb40e188aff3ac2ddc835727f
MD5 806cbfde61b90c0738077833c6e009fe
SHA1 34fdd5e0ddb6db6bc964631b8950142cfa5e7474
SHA512 f87fa279e92d25cf389a0e3eb1c95f9725a040af3dec9e8375ea79a69360833fe7c42e4daa8d7870e841ae5b210adb55845788eaee832e04dca1e53723801421
SSDEEP 12288:ezsf8hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:puoHjto1GFxlXutIs1WZX5AR
TLSH
T1F175F11AD2A401D9D06E6174CB865A41F7337D2647E193DB57C0F93E0F3A190AEEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 a20d6bf522cc00c19acd865b11fcde6970cb712e64fef467ed3422b5bc3ad11e
MD5 1cfaa5449c6911cc8926f7c4325d7ece
SHA1 37e822332e02db36a38bd0fca65ac1fac3c86c24
SHA512 9a53559cf20449d02c0f0ad6520d3ea4ed5ffec2cd084fe252623f7bc7495ce8ad8d0bbde2e123e1dfc9a21c319c43456674e6168cf945a98ae27473d1d905c9
SSDEEP 12288:2chKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYKN:2OoHjto1GFxlXutIs1WZX5AR7N
TLSH
T19465236399F254C7F57A61B02997AA71BC7FB3160E4410FB9B40EE190E3C060BE766D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 66ef23d74a8e0b662f14db1b70184659f232ee94be3a845b72a21b2a20f70c79
MD5 3ef24140cd957cbb90c6a92bbfaf2a4b
SHA1 152dc72e9f727531c14c79cf098cc65bba8b8316
SHA512 9fd246ad791ec41245ab51ef2b6a32d0115890fbb51faecceada1b47b2e86cef751bf32aa9a6566ca3dd624390675fe11da0a35b6714b0ff9b43f45dfaed3c70
SSDEEP 24576:SoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9EzwwXg/booHjtq:Sa0h2GEkuAe73q3pp46zwwQtT/M+w
TLSH
T13F85AE1E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.5MB
SHA256 6acde6e9c8307a1c51eaba6a0e04445320c1ca39021ebcc4fd4abf9f1974d1b5
MD5 7562c112a439d7453e32669fa5bda1fa
SHA1 69e689bb93c1620461df8527fd8cee880f01faa2
SHA512 9fba8256cf9fb92cdd94b04d1d46d6da8c5b427f4d666b16b4809fc1e53f4ccc1c688b7ff9f834da11e3cfcb6e149922584924003c15b8b21c42ab2955ca5c31
SSDEEP 49152:8a0h2GEkuAe73q3ppj6zwwQtT/M+woL6uRhTnZrCfQ:8a0hNYGjJwiwoL64Ef
TLSH
T10AC5D01DA7EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 e30a593ebb74dae508c64f0b08fc2c79de0a6d5a661a7f9d710f5219aa48bcf5
MD5 cb3878c6299bfa25dc90a31d475e6f9a
SHA1 455263be96b204d723cc9a0816a9b80eb67def0e
SHA512 8a55640a74c1c93e4a35079cd4fcab4dddec57bbd9fab107f96f381e850522a48de283f74455a5ba9e15d300b797c2401a9859a77ab943040985cad95a5a8e81
SSDEEP 12288:6whKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:6CoHjto1GFxlXutIs1WZX5AR
TLSH
T18665236398F250C7E63562B029C76A75EC7BB3061B4910FB8A50EE190F3D0E4BE766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 78371239f55ac1e58244609b5217982a240e70aeb412545242e42c30c9f512c2
MD5 52c644dd8e2fe839119860870f2e42eb
SHA1 75ec2c532e389185bc6b18353b4e2c6112927e91
SHA512 6706bddb2cc55791fcd633eda659b5e98866b9462ddb4ffcf2b40088b0ce08730222c9a019f5661789c46099318faff48aa255d077917e3dfc1a6296f9c025e1
SSDEEP 12288:QObbA4LWOsvAYFTXhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+J:NPL3UTxoHjto1GFxlXutIs1WZX5AR
TLSH
T177950155E6E100F9E97B913CC9A39A12E672B45D0764E7EF03A88F251F232E14E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7fa4f913d3f6016255718a94d0643e5a82976f5dda2e082df888a4a9eb916dfc
MD5 e14270e16e3630ac7f421cbfa32a5d1f
SHA1 61a6731533f46eac6a4398057a527c0a59bd7bfc
SHA512 0a004a64228e31c1fac15a25349c3fc4d6f421b328346db34cc9e7ed23b26a066030bb5c6a82dc085128f8d20a4817cee006dc79c94c1c1affbd452aaefae8ab
SSDEEP 12288:MpFtfO7hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:cOFoHjto1GFxlXutIs1WZX5AR
TLSH
T16975022A36E910E5E136A17C8A835359E772B466071213EF07D0C53E0F77AF86D3AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2a6bdc5679ec1a13b39002936fc40794b48bde679f9c8226fd66ae42b26bd4ac
MD5 2721965c38df86c207d50bafeb30608a
SHA1 39eb7fbb6018ffb3059bdcda54faefe79c438f18
SHA512 8c1b8d9fa75ad9a8e9a66cb3e1ace466edb573aa8d11d2d1b688ea1d583dc775bb7cd1749329ec097bf0c9d9f959ceea8efa3c03702f6c97e1c690cb174e7683
SSDEEP 24576:17NM9YqZqmWMUkPjZM48Mv6bEhseoHjto1GFxlXutIs1WZX5AR:17cBWMpPjN8DbEhkT/M+w
TLSH
T19865AE2E6BEC81D5D476D13DC9E28205F6B2B4611B318ADF1162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 6482f7b9b21940b5e9f97b751b6b30996f06c5e35344aa5903d07cbf979ae0e0
MD5 ee39ef20b6ed26254936bc221d0e7820
SHA1 5199ba6e04a609f4557bc6980d687a8e71b1a520
SHA512 a731818f997389b993724c12e69d8b793bb421052790aa52461237b2c42911f77d5964ae7a7ff2e55b15fb29acf277488d4ecae3c70cefb4d935ec708f5d9831
SSDEEP 24576:RW6BApg2YuyuNDYTabvcdvNYf8km1goHjto1GFxlXutIs1WZX5AR:RF2YuHNETovAvNYf8km/T/M+w
TLSH
T1D3858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\SgrmBroker.exe
Size 2.5MB
SHA256 2a524b6666804ba9d1871cd9f344e43455f2d518cc835ce8e7bd3ea36cafe67a
MD5 cc98b828033f8ec7f4f103c3da4ae066
SHA1 14f6965bfaab0a37983330cce769d79559699e2e
SHA512 026ff0089eb5a9a4b9d9e7fd704c96a8ab28641dd5953f85025ea23feca599d9531a4d5923718c35ebe5ab41a2f26456bf01b42a895d3a41dd2db912c066604b
SSDEEP 24576:QTMdOz0FFS+bmSL8oHjto1GFxlXutIs1WZX5AR1ZbR6SG3WRNfaHIe4HZxKsrCZz:Y0K+bmSLVT/M+wnL6uRhTnZrCfQ
TLSH
T189C5123EA7AD14E5E57AC27C8A439A06F5737072032275DB06D0C17A1F6BEE4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 083535f4032fb528495ea0b7b12973eb405fdb20aa8aa302be82428ec287a8a7
MD5 9020b6d36c0898c360e086284a68a4aa
SHA1 68e1a17ceb074ebfa4b10174344a47e03205fb0c
SHA512 f1ea2fd94dd12c57d8475a70eddb4fe3017c95631e6f963c676388760a156be0cece89c9399359f9a16a163a74350d162fda27c26384d9218f6072142bb96502
SSDEEP 24576:DAFs06+Omlf3NXEbTo5oHjto1GFxlXutIs1WZX5AR:MFs060lVXuNT/M+w
TLSH
T1A165AE2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 4fc2ac0126e317431a89b30608f5016fa17230036fb7e46701c9ca6dc8db7688
MD5 cc7792ce3cdfb28278a1dc20a603fbd0
SHA1 d3dad537775bd076213dea55c1a624f41979411c
SHA512 fe2e45a88affee09025c852e5c4fd66e880b730a788bb4f3edaf4d29f43b119d10d04c8ca9e05ae646930aab450299149be9fc3599acbeefca7bc6c659e86be0
SSDEEP 24576:KJnJ5D3WhUoHjto1GFxlXutIs1WZX5AR:KJnJ5DGhNT/M+w
TLSH
T1C285E03DD2A410E8D4B7C2B4819A2B55FE72343D2F2269C718B4D5353F12EE0AA79F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7eadf6894e91378777228bba96c6038accb26752bec6092518d9e4370672f980
MD5 8ca9c87e551c2dcbac1910c60df4c609
SHA1 357323c98e8a3b53f34d8a8898f865630420f752
SHA512 9b86225f9bc790d1a3319497a51579fb1b17cbe01a698927d4e0b10163805a27e61a06e4a7919b8167f0c8a5901895b6d42bb0ad913be441f7441b3c3a840d7d
SSDEEP 24576:uEPghm6/7IIXdwcXrif7qQncjlP65i3VuzoHjto1GFxlXutIs1WZX5AR:pg06DIKdwc+eQnSt65aVDT/M+w
TLSH
T132956C16B7EA5294E8B3CAB0C962A5159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 f9419e692f3f4e546721d06f09d991522120daa56d95d9504b339bdae389c14b
MD5 3329e96f1d395d3a74c2ec96a8e75960
SHA1 23d44c039388055509b1e04cf35029e4efc9458b
SHA512 1caedb0323edace5cc09d633cb7f9bbe7267f01d910d3de13416048bb733e3fe36ad4c3de36f2a8059016dc9653b1c3c264ebea1cca64f54955571a2efa23ba0
SSDEEP 12288:fEP3RiS17UeR6SGnGRtOW0eNfcUMFHVOFe6Q8HOOxKsUpbZUqOr2NSARk/TtxIUU:kiSZbR6SG3WRNfaHIe4HZxKsrCZRQwR
TLSH
T17A05122CEBAC60E1D21A923D46508709D372F03657677BEF56E1827E4E736F46C3AA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 fd43b793ebc5eb390582045d9301bf753ee7d3e4dfc96236a4d79812ea1ae06f
MD5 556c9aca9fb8bcb2c56c045f342fe446
SHA1 de665cb6a735ac299374da5cd4ad650097ca69c5
SHA512 d77d7f2e8fb36be1c7596d54447ccf73d41980cb0496913c01576c48a72d3935cf2147492fcea4c280c67ba540f653a861e91c22b73a97383ce6d06e4623c793
SSDEEP 12288:9jkyVhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:9IyroHjto1GFxlXutIs1WZX5AR
TLSH
T17F75120567E060C6E67A02789EA392A0DD76FD211F1112EF5580FE3E5F3A6E0BD31B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\System32\msiexec.exe
Size 2.2MB
SHA256 5705ad3b54cc17352d5f3be9db02664ded46feda15895da7c378f221a207da82
MD5 f12c3ad756e493e3efd805e69507365f
SHA1 a2160bf7245cf83c52cf7ac9548763089e6b1426
SHA512 1f9e68d366bbd8e2d6d1a7884ebae0a701c29887253c2b5d17885f9eaeede62f364633259078ab974a64e03d862c526de4b74990d24f9bd2836d5cf7c77deb88
SSDEEP 24576:wxoHjto1GFxlXutIs1WZX5ARNZbR6SG3WRNfaHIe4HZxKsrCZRQwR:wqT/M+w3L6uRhTnZrCfQ
TLSH
T1ABB52315DBF524D2F26693784A635705E972B037132A75FF2AE0C93B4B3A1E0E836B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 175ab37fb10573bd9e28299bfe76e21af35a7add8edf24d057d5f13e0fe77d03
MD5 8a43647429c52c8567e1fad3bef62ab7
SHA1 67250783cf9709aebf7c7bbcf5a0006e504b3a4b
SHA512 fc37986f04d859409c321645c2a22fc8e18df9cbc89978a834ac3cb9b17a3372c6168e9059e786000be4a6b1319d9f17ffd220e6eecde4a2c87a2a689b80a8cd
SSDEEP 12288:aQLhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:h1oHjto1GFxlXutIs1WZX5AR
TLSH
T1AC65236658F260DBF62551B419976B61EC77B3261B0520FF4AD0EE394F3D0E0BA72AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e83a7ecf2dc79960b67f2c04ba5c3c94b60189b37629ede33303cf3ab37a15de
MD5 40b391cae2c557471c965582c12dd31f
SHA1 7b7720c726a40ef352bd4a9e2842e89911d53785
SHA512 48842fb369b27667ab8bf8970dc0edd95e74d3f59dd9672568f8d1648bb644df741081f9935cb61279b2af4d7f892a3566399bb5c37a0eea4227ebd1d84d52f2
SSDEEP 24576:3Q9MxZKdcz9dw3GoHjto1GFxlXutIs1WZX5AR:3VKZHT/M+w
TLSH
T18B558C2DABF9058AE177D27594A250C3A673B4311B31D6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 2600a77dec31517c691070fda1884d9a2fe0530b935a1930e72fc6fdf8c58186
MD5 0bf63f3cbd7d2dccccbb1ddd937990ad
SHA1 436f254a3e801fd7217aea87bc9f9941bed8b7a4
SHA512 101b7889b88402f4df9f0cf2d99640027c7ae9baa8668f3bf29c06c876a63dcfde4a31728a581f23f6e0ae4dca195c1aa3a380df920170df6a99703fd718c946
SSDEEP 12288:6yoKo2bRple9pphKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:6yoc9ApvoHjto1GFxlXutIs1WZX5AR
TLSH
T18785E01FBBAA40E2E176813C89868755EBB3B0301B6213DB5691C73D4F279E8BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d13475a4bea863d1f68a3acb8e27e8d90f4680245cbaeef75817d1d3e2621caa
MD5 b3eda2d143622c737d676fcdf2dbd528
SHA1 75382d701032226ce3b78df3359b6d5976ffe356
SHA512 a10aa110b7b93b829191e8bbaae8411c5c52e4c1246aefe8d82a5774bcb11c6c87321dea274508151d395b261390b536b1cce67e529a967ddac9a09b43134c5a
SSDEEP 49152:CWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKwT/M+w:00zuNIcw
TLSH
T1C1A57B3DA2F800A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 c2f190a7cf557959294758b4834f4a5acd18c96e7a04038626776efe4ee3ebd3
MD5 ed2eac5ae9d91e54720d1812981ccbf7
SHA1 b2d46f9f66f52cb81d40bc21dae2c87ed2ab812b
SHA512 66ac9d95b02f5fc649f07e2828464e00c919d63a4a57986e7d7a0dd939714a59f6541d68716b7e6fbaaa619ff88f4777310e07a70ff9a1ecee460f81846855d5
SSDEEP 24576:Z1QT7EcpfxR+N5AWAz3ooiYhjMqbeZbR6SG3WRNfaHIe4HZxKsrCZRQwR:MTDxR+N5YzTTjMnL6uRhTnZrCfQ
TLSH
T1D575C02EA7F955E9D1BE86798A23C506FA727821033193CF42A0C17E0E775D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 849KB
SHA256 27f9adc76431c3ab9d2277cfd47c6666bdfe8e49e50a693856391fbfba78ca18
MD5 231f60fd4779e34e23bba2288ca8a3c6
SHA1 80bae1114d50a7aa3b00bc5577b60bcd3b3d6a53
SHA512 adc0980dce50e9646b0080919542f8710efd7cfa4ef366f14e73113abec59630b2dd5477b77818652beb6bb329418684cd60f48fb273626947771d05753f19a9
SSDEEP 24576:4hbHjPhZbR6SG3WRNfaHIe4HZxKsrCZRQwR:4hbHjZL6uRhTnZrCfQ
TLSH
T1AE05123D9BAC14D5E275E27D8651860AD331B4361326B7EF23E1827A4F37AE09C36A50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 2.5MB
SHA256 d495413c3a116108597fa9092e8a720a3e903dd0ba2c225a3993e741febd0602
MD5 1f17c3946cc1f66a087aef000c13b0f2
SHA1 129a2a70e807a91cce39326872aa48cc8451dcc3
SHA512 92ebfb0eb7ae6f09b9fd26d27b2ee9c518c33b0fb77c57d8d5213bbff950e6053ca0917288f482669ef57bcc9b1b2f649a20123286b761386c5189c8502ccbd2
SSDEEP 24576:uTMdOz0FFS+bmSL8oHjto1GFxlXutIs1WZX5AR1ZbR6SG3WRNfaHIe4HZxKsrCZz:a0K+bmSLVT/M+wnL6uRhTnZrCfQ
TLSH
T10BC5123EA76D14E5E57AC27C8A439A06F5733072032275DB06D0C17A1F6BEE4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.4MB
SHA256 75c38cfaddb519abf8eb67cd006c90391a6382a2fa931ac22e69a026475d9f94
MD5 60828b9530806b71eae941a06e51b369
SHA1 e5900e33d29de5e5b8e37fa498fe409eedfe6620
SHA512 28a5e2bd7cac77c926b0d3a9d77c8eb9a557f409b8b6831a6827b3043b281b04421ff3535c858301ea3e2e0fd7117be6c1ecefdf22c5666d8da4dce9e1ca6290
SSDEEP 24576:Y3YgnJcRTk4yti+R5dUR/8ZbR6SG3WRNfaHIe4HZxKsrCZRQwR:YIgnaTk46pUR/8L6uRhTnZrCfQ
TLSH
T15A65C02DF3B910B9D4AAD236450147B5FB71782D1F219ACB01B0C138AF1AEE89E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-162-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/464-85-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1020-66-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1020-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1020-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1020-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1204-184-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1204-436-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1204-130-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1212-89-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1212-98-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/1212-95-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1212-168-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/1256-496-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1256-172-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1456-160-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/1456-437-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/2336-563-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/2336-565-0x0000000001230000-0x00000000012B3000-memory.dmp

Download

memory/2336-572-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/2336-557-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/2336-571-0x0000000001230000-0x00000000012B3000-memory.dmp

Download

memory/2448-499-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2448-181-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2508-545-0x00000000007E0000-0x0000000000863000-memory.dmp

Download

memory/2508-594-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/2508-544-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/2508-551-0x00000000007E0000-0x0000000000863000-memory.dmp

Download

memory/2532-157-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/2532-431-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/2532-154-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3248-109-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/3248-106-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3248-100-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3248-171-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/3292-119-0x0000000000580000-0x00000000005E7000-memory.dmp

Download

memory/3292-122-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3292-176-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3292-114-0x0000000000580000-0x00000000005E7000-memory.dmp

Download

memory/3344-280-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3344-133-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3708-70-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3708-81-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3708-76-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3708-79-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/3708-83-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/3736-165-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3736-163-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3740-177-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3740-498-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4056-169-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4056-443-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4080-135-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4080-387-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4080-142-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4080-143-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4228-513-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-506-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-598-0x00000205FE4E0000-0x00000205FEB50000-memory.dmp

Download

memory/4228-511-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-512-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-514-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-515-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-516-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-517-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-518-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-519-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-510-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-507-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-508-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-509-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-501-0x00000205FE4E0000-0x00000205FEB50000-memory.dmp

Download

memory/4228-504-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4228-505-0x0000020580430000-0x0000020580440000-memory.dmp

Download

memory/4252-276-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4252-520-0x000000000DDD0000-0x000000000DDD8000-memory.dmp

Download

memory/4252-185-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4252-202-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4252-218-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4252-441-0x000000000CE00000-0x000000000CE08000-memory.dmp

Download

memory/4252-529-0x000000000DDC0000-0x000000000DDC1000-memory.dmp

Download

memory/4252-528-0x000000000DDD0000-0x000000000DDD8000-memory.dmp

Download

memory/4252-526-0x000000000DDC0000-0x000000000DDC8000-memory.dmp

Download

memory/4252-500-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4252-521-0x000000000DDC0000-0x000000000DDC1000-memory.dmp

Download

memory/4744-52-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4744-44-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4744-53-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4744-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4760-578-0x0000000000E40000-0x0000000000EC3000-memory.dmp

Download

memory/4760-584-0x0000000000E40000-0x0000000000EC3000-memory.dmp

Download

memory/4760-577-0x0000000140000000-0x00000001401F2000-memory.dmp

Download

memory/4760-592-0x0000000140000000-0x00000001401F2000-memory.dmp

Download

memory/4760-591-0x0000000000E40000-0x0000000000EC3000-memory.dmp

Download

memory/4964-30-0x0000000002D60000-0x0000000002DC0000-memory.dmp

Download

memory/4964-457-0x0000000140000000-0x0000000140307000-memory.dmp

Download

memory/4964-68-0x0000000140000000-0x0000000140307000-memory.dmp

Download

memory/4964-445-0x0000000002E20000-0x0000000002E80000-memory.dmp

Download

memory/4964-444-0x0000000000870000-0x00000000008F3000-memory.dmp

Download

memory/4964-447-0x0000000002D60000-0x0000000002DC0000-memory.dmp

Download

memory/4964-0-0x0000000000870000-0x00000000008F3000-memory.dmp

Download

memory/4964-8-0x0000000000870000-0x00000000008F3000-memory.dmp

Download

memory/4964-22-0x0000000002E20000-0x0000000002E80000-memory.dmp

Download

memory/4964-31-0x0000000002E20000-0x0000000002E80000-memory.dmp

Download

memory/4964-7-0x0000000140000000-0x0000000140307000-memory.dmp

Download

memory/4964-14-0x0000000002D60000-0x0000000002DC0000-memory.dmp

Download

memory/5048-126-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5048-180-0x0000000140000000-0x0000000140175000-memory.dmp

Download