fcf234682669f7d8b639cf0b50cae6e23e4d29eda2230947ec8b0d6680f6b7a1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
Size 3.6MB
Sample261027-grp6dsaz2v
SHA256 fcf234682669f7d8b639cf0b50cae6e23e4d29eda2230947ec8b0d6680f6b7a1
MD5 d2e4e48efcfa8c3d2a4e5dd5ea232aed
SHA1 351c1b1255ba2dfe7b7af206a9a61a9f6a7ad03e
SHA512 5eb2402eb1a1f139ea459856a97fa36a1a8a17dc17feb81c5867e71b94e6e09de4e23308c0d1b09aeae8016dfcc315742a0024a360c1d6d9133b1405cafea63f
SSDEEP 98304:9cP234N9n1Jsv6tWKFdu9CrD527BWGjmUYUWd:9cPJN9n1Jsv6tWKFdu9CrVQBWGyM
TLSH
T15906AE2B76A80264E0B682B9CD27655FDF73BC432130952B52DC35624FB322117AFB76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 20 IoCs

pid	Process
2288	elevation_service.exe
628	elevation_service.exe
2892	maintenanceservice.exe
5212	msdtc.exe
5464	snmptrap.exe
5876	spectrum.exe
5312	ssh-agent.exe
4500	TieringEngineService.exe
4452	AgentService.exe
1676	vds.exe
4512	vssvc.exe
380	wbengine.exe
4012	WmiApSrv.exe
2840	SearchIndexer.exe
4308	alg.exe
6032	DiagnosticsHub.StandardCollector.Service.exe
6084	PerceptionSimulationService.exe
4616	perfhost.exe
2872	locator.exe
6112	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4ddc337e4bb6346b.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/904-0-0x0000000140000000-0x0000000140948000-memory.dmp	upx
behavioral1/memory/904-70-0x0000000140000000-0x0000000140948000-memory.dmp	upx
behavioral1/files/0x0001000000017011-111.dat	upx
behavioral1/files/0x000100000000c53f-119.dat	upx
behavioral1/files/0x0002000000021ae8-120.dat	upx
behavioral1/memory/904-127-0x0000000140000000-0x0000000140948000-memory.dmp	upx
behavioral1/files/0x000100000000c405-125.dat	upx
behavioral1/files/0x000100000000fa68-124.dat	upx
behavioral1/files/0x0001000000017ec7-123.dat	upx
behavioral1/files/0x0001000000017057-115.dat	upx
behavioral1/files/0x000100000001742f-117.dat	upx
behavioral1/files/0x0001000000017bd3-116.dat	upx
behavioral1/files/0x0001000000017011-531.dat	upx
behavioral1/memory/4308-532-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/files/0x0001000000017057-545.dat	upx
behavioral1/files/0x0001000000017bd3-547.dat	upx
behavioral1/memory/6032-563-0x0000000140000000-0x0000000140166000-memory.dmp	upx
behavioral1/files/0x000100000001742f-568.dat	upx
behavioral1/files/0x0001000000017ec7-571.dat	upx
behavioral1/memory/6084-586-0x0000000140000000-0x0000000140168000-memory.dmp	upx
behavioral1/files/0x000100000000fa68-592.dat	upx
behavioral1/memory/4616-593-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/files/0x000100000000c405-611.dat	upx
behavioral1/memory/2872-621-0x0000000140000000-0x0000000140152000-memory.dmp	upx
behavioral1/files/0x000100000000c53f-619.dat	upx
behavioral1/memory/4308-655-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/6084-656-0x0000000140000000-0x0000000140168000-memory.dmp	upx
behavioral1/memory/4616-658-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2872-659-0x0000000140000000-0x0000000140152000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a4082ced865dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000866a8ced865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b15d8ced865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb4b30cfd865dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001832b8cfd865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b84209d0d865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004664e6ced865dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062ecefced865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001aa465ced865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ea0c2ced865dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a264c7ced865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
2288	elevation_service.exe
628	elevation_service.exe
628	elevation_service.exe
628	elevation_service.exe
628	elevation_service.exe
628	elevation_service.exe
628	elevation_service.exe
628	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	904	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	2288	elevation_service.exe
Token: SeRestorePrivilege	4500	TieringEngineService.exe
Token: SeManageVolumePrivilege	4500	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4452	AgentService.exe
Token: SeBackupPrivilege	4512	vssvc.exe
Token: SeRestorePrivilege	4512	vssvc.exe
Token: SeAuditPrivilege	4512	vssvc.exe
Token: SeBackupPrivilege	380	wbengine.exe
Token: SeRestorePrivilege	380	wbengine.exe
Token: SeSecurityPrivilege	380	wbengine.exe
Token: 33	2840	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2840	SearchIndexer.exe
Token: SeDebugPrivilege	2288	elevation_service.exe
Token: SeDebugPrivilege	628	elevation_service.exe
Token: SeDebugPrivilege	4308	alg.exe
Token: SeDebugPrivilege	4308	alg.exe
Token: SeDebugPrivilege	4308	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2720	2840	SearchIndexer.exe	112
PID 2840 wrote to memory of 4968	2840	SearchIndexer.exe	113
PID 2840 wrote to memory of 1484	2840	SearchIndexer.exe	125
PID 2840 wrote to memory of 3928	2840	SearchIndexer.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2892

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5212

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5464

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5876

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5312

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3384

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1676

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4012

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2720
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4968
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1484
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:3928

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:6032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4744

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6084

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4616

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2872

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1c6e89ed4c2ffb1daba8548518160b1234591a456659d2d869f9d309d8ca81d5
MD5 25d0c460b311792e290a28be574703a4
SHA1 c5135ccd4b90df39f00a943d6a8d2d8baa45ed09
SHA512 6a62cdd79aa3878b04f945c142182fa48ce4f2c5b50e614ca5d50fabedef2d271d5b203453f875748e4ef070afae86392f6b19164409f39405b6fa9c0932d239
SSDEEP 49152:Nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnRDmg27RnWGj:T3q6sjBaD527BWG
TLSH
T1DBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 1e07fa416e21ed770b849626a707f37cfa37ba3bb7756e6a8bd3c731da3c7ffe
MD5 82945b6af5e0c70d54bfb8c56e723d52
SHA1 a282a509903ed3e5f612c5db1772ba0ad150f1e3
SHA512 f4ea5160efc45496fe68f05de031a6da2466434ccfa5c4230ca35afa2e1935d704a2e7bb4c878e7184d0339de0e662d1e0507b439a90611e26ae01ae1d518b2f
SSDEEP 24576:eXYfDtczAasqjnhMgeiCl7G0nehbGZpbD:9tcXDmg27RnWGj
TLSH
T113050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 cbcf4fd1e660d1a6d8cb08dc4a5fdd1e7422620cf80e62683269da14266eff14
MD5 62647b71d5369dff3470ca7c0abcc37c
SHA1 39e095637c32cb2076dae3c1d36e30cd688f4b8d
SHA512 34ad6dbd5087c0513e5ba7f04068b955f36b7d63b435c4afb0febc6940d5a3d38e5cfe3aa9e5140d194cedc7e6c72f568a780ac6aa7ff7e71164671c845be239
SSDEEP 49152:WPji0AjJDmg27RnWGjiJZHUmUYyH0UbETQK1:sjotD527BWGZmUYUWd
TLSH
T1F295D065F6788335D073C0B9C5D2A68EED71308607308ACB5286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.2MB
SHA256 06962ed95b499dfb433634cc65cd7e096d62c9e6edd2a55b7cfc338dbed276ca
MD5 b47d3cf43a3ae82c272f21c4c748dca1
SHA1 9a9248a7a3e2424c88d3c8f5eb6955bb931d5aa6
SHA512 fbe55248e55302d356fd32a0110fd4e72146e7805f51677f9ea2c41f7ae10e31981a01413f36f8936bd292b723b7b241049f1d377bcc1b37f3c7625b8b06fba3
SSDEEP 49152:a/ezSC6vUzPveHjyNDmg27RnWGjWJZHUmUYyH0UbETQK1:OezSC6v2XeHID527BWG1mUYUWd
TLSH
T178B5AF65F5788323D0B2D0BAC5D6BA9AFD3230464B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.0MB
SHA256 877140364c1029fff4c85c80b369566a1025b203daa1027a5e4c7409eeb24f2b
MD5 be3b9b2cd733f4eaad8e9af81776db5a
SHA1 99112d67dc7c97ae2d48c2f816705dad9df3540d
SHA512 975ac22f1d62f467be0ccd1afb08361ce12c68d69faeecaa82fafa1572523fc8db6504ba828d42f01c544cdeffa3ec226088722e8f0500fdaad68c65f8a44581
SSDEEP 49152:IVO88hXl+ODmg27RnWGjQJZHUmUYyH0UbETQK1:f/h1+OD527BWGzmUYUWd
TLSH
T1E0A5D066F5748335D073C0BAC5D2A69EEE3234424B318ACB1246D76C3E67AE5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 074f63092a9385464efd61265f608d16cd02ba7fb1c9370f7c09172283dba4a5
MD5 a24f71eee461a48fac8748f618c3479f
SHA1 4191ebae7db198f045b284137e9a95d31d297ea5
SHA512 7982071442ce45cb313b4e31ae62ded31c11861e8fab3fedea86cad706d7371cdb03cccf81a01183d90894a2c0fcd169053654d9dc80d395f4ea89ce3c1c5ae7
SSDEEP 12288:JLQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JLQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19EC423BE824C11CAEA7608B5C3E9F51E6C177E5698200C436A637DFDE6F5464CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 deeec0042108289f239614763804272afcd9d430a096355c1dfba001b5cf1a84
MD5 e544abb1fedd2ff2c58a3627db62a57e
SHA1 2f4405ab038cc45c248d73295edfdaf59410218c
SHA512 58addd347fb8788a7c5b770b2d72b563459be2e0524d17b7929112c84a2ace152000399ed23c616b181f33baf69a8aa2e493209b02e739d140a9d45718a075b4
SSDEEP 12288:beBNUbTVO86UXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDQ:bJIUXsqjnhMgeiCl7G0nehbGZpbDQ
TLSH
T19905CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3efbcc69343729008515e15fd2667a6f67abb06aed8e0cc0633a478cc9cbeb26
MD5 b4e8498189b4d3954fb09998c71be5fc
SHA1 3625906b75587ff03d114e02c9fc79a17527aaea
SHA512 bd986bc55085ccb918fe48d8a4e5f62fd111e0bb0e3072fa40aa7c939e0c2231d42ea3df6b1aa5204aaff5c74c26a8165b32fd23dbba0e2e274bf0a60fac2410
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THa:yQvGAdlCEL8c/DRNw5CWD527BWG
TLSH
T1EE266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 24c55e92bb5bd568390b0071ea769ab9c50b2e4b80b9e06e46667a6126e4567b
MD5 9a862f5f1f649cb187e3199bcc04be29
SHA1 6cc4704caef2d8bc4f57ab62c14bf395adc419b1
SHA512 79cf53aa6a74912c5962cd5affde561b8aa83b3db1fc07944d33fd7cd18d216fbfee7895fb5d9ff7a3d6cd90785e8afb9568b173357e1dcd6034b197c555a8f3
SSDEEP 12288:IAwSfxL/2Dc3RDLLmt0LDQewsAjFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:t0ewsAjFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C715E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cdfafa418587f311820ba69af467c00f187a0db7c5c4b6c822dc286fc15e1e4e
MD5 e0a26a5e9a2d3c84c5b602ab944eed58
SHA1 1278ed54434624122f9e0693417370cb8484e212
SHA512 848882b364ba5d4adefa38d5feacae7e660f91766f4332f6ba02ba401f6dc7f9eef6b1799c701b64812e5fafac0c3c30584e77aeeee70b24fd5ce6e42e8cd095
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHhVQBWG:wUEtQevvqc2W1cpV2tI32sB
TLSH
T130474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 3.4MB
SHA256 37e513c29f5dd96e38f9932b70fc1c04ee64bc889bb4c578e3c0e50d77869ed1
MD5 cd62e7d4cde2e2e571ba0cf447e654fd
SHA1 ef9f907ff10b366d09c49db23890877629162b9a
SHA512 78aa3893fd8f1c90d0c4fac3bcf26471c835317d47010e8ae0ba2ae778a601d9a0a32fc3f4703c159dbc177efd97f11063b3e74989f101341b4859009270754d
SSDEEP 49152:ZCbRquA/m2yL5zQfFiV+XenmE3/zZDmg27RnWGjLJZHUmUYyH0UbETQK1:2oqtVjnmqD527BWGsmUYUWd
TLSH
T161F5AF1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 44ee8d9f734550d0ca97414ea758d6cbd380c3207ca59349edff3b22d9381b6f
MD5 10709b300de0eed25049868bb9b1c12c
SHA1 2fd170ff213c5e0089408b03e01f6801b657220a
SHA512 f3ba406e886c92e121c3fb4a33338df6202241b238d398c85b77f6209f5e650b41cdb8f0947e57668851f9cd9fffb5f60023f7c8dfb1f710c1cf6d175942bdaa
SSDEEP 24576:1AhGL3IFoiwtA5l7S53GsqjnhMgeiCl7G0nehbGZpbD:1AMUFoiq5aDmg27RnWGj
TLSH
T1D8359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 cc0dcc5ff94d0d21907a585acc32a834f00eed8cbf99024623842536d29a6e25
MD5 1a633b4f32e6231b6c115f3a404337fe
SHA1 2c46aaa88becbd8e0a4696f0df2dc1958366aea5
SHA512 ffe8f88a612d3159094761907ebdabe4879ce01a650b5abccf2728df5fe325bb220ce94d26185d0f1ece7dd6e312299004d235c3d5ae15718d30c707e58d0d2f
SSDEEP 12288:VeZ1Iy1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gZussqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D7E412AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 00d32bc5823394502af6eb7b5f8ae6bf3c8927d8a0c07d892dc0cd2a755e4c8a
MD5 f4697d6be2de147c9974dd7e605b65f4
SHA1 caa96d9d0588bd0580c6406b1d6f5c7863e5842d
SHA512 a8864424fdfbe87a49d92969d3eb9dfa3d59589a4077fe0f6328ddcf7185fa1dee254c12aecf0424f345320d63e5fe1446cb9305afb298cf2677b05d7509ced6
SSDEEP 98304:uQRQyi36YOcPbLvw2gAf+PN3/D527BWG:1QyiKa/X+PNPVQBWG
TLSH
T19E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2d731b1b51217a9113173ef2c8d6e77d30183c4302083fc53cca912f91bbee63
MD5 a3d3983efe2c332c5ef2bb2c866027aa
SHA1 310db4945757aee76d9887a251b94975f8268553
SHA512 44d785ae108aedfd278d6f5048eb97463ed639b9cb7034ce666308de9cd2f120f8f559b3e6d46786b8d1cf00c7618c040a2690b3804d64c9d9d861258caae5b3
SSDEEP 98304:gQRQyi36YOcPbLvw2gAf+PN3/D527BWG:3QyiKa/X+PNPVQBWG
TLSH
T1B0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0eacf4113a061476f79381aa481247c5eededcf03393e9fc91102d308104f2c1
MD5 540ea7c44aa2aedb63d1ef4d4351bb09
SHA1 20dc83f7a398364526862d30d4fb23b66a1cbedb
SHA512 876df7a78edcbbd90bd56f1764fe8f4db66db026f52b8b8547810e86ce324587d0fefaa89d85816c44e8cb23f3ab1135616a0348f848986f7f78ea9da030f13f
SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL08sqjnhMgeiCl7Ge:z68Qg55nhceWu7PNU3/JDmg27RnWGj
TLSH
T14BB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d02d3fc6e36eddbd2f6453a8be3b48995d8623735bfef274a9de453e45eccbb7
MD5 4fc3b6d736747498c3a978dff9425a4f
SHA1 18cea474e22e3c566c5343ffc28685636e77faa8
SHA512 9bb088cb06400c5927f13b449570209e389102b4ea99654223eaf506a79c55f07a1f5ecc2dd31a318f3b1f9153d16cabecb9bbf03b53436e9c0cee232c0a2ee8
SSDEEP 98304:xy5112gYy5azzVvt69nLKnhZMD527BWG:MLIHEWhSVQBWG
TLSH
T18D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 075cd9f86018abc00e873fd145e7726066e5a050df0f27e63f88dcfa5c27d534
MD5 32adb510d4e1934048936b99d15402f9
SHA1 1878bb9b3e22416ff78fd1d8d2f124e067681a4d
SHA512 a7f9e3eeef2e43305e1138994a48735eab94d95ae16058908775e7010ba3c239de54f1e294a6d157db429e0dce36fb453e119568cd210498cc417c1b9e188923
SSDEEP 49152:qB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gleDmg27RnWGj:4u6Jmdxd2deD527BWG
TLSH
T197D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 126273c42ca5421d79809f4ca7d76aecaf25059541131dc72ea77b77b6597736
MD5 7128007032e70ea03fcfa57c7ace3a1d
SHA1 9f0a94ef190a5f62fd1e3a78cb0a769b284d9381
SHA512 56ef3ab54e1f736b38bbb1e857b779b5be8e1dc15da73a998948d20eafd31e8328eeced165802d91692be8d27ef2468bac6d01cef27cad443e9ce290552f812c
SSDEEP 49152:L1hpsNoJpF1A63U44CwH7R4xLDmg27RnWGj:LmifPWRqD527BWG
TLSH
T1D3B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 16f564e16cba1bd02f514e95a798f6a77d9b524c29605d5bb3a3b54bf80804bd
MD5 1be736baa52259ab8e6349ca0aaed981
SHA1 dd866d8ee8bd1add686c07812e2e447dee25700e
SHA512 a473e6c786a8b422e88b0fdbfab477822ca21b8bd524b98b5ad615b125be41d37c625c55b15393653dfe33d418c567a32e2cda94b0ef5cb46ac86ae09c7f9193
SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqYDmg27RnWGj:H5dKii61YD527BWG
TLSH
T1EEC5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 351aae0f14482f86333af4b3bfa5235826d1b2c693b4a30a4bc2c10be6642224
MD5 3fd3f5fdb006b3faecfd16a590bb0c38
SHA1 683306d546fddc77bd11f3d65176a862513c7b17
SHA512 2024dc8e3bb09e5a24fcc1925d37bf7be3375e7d9be295f2538b9b6e3a0d9116157b5d0121e2776ea799403c8914a9f0eac3fcda0977f74dca5bf0487f627c23
SSDEEP 49152:QhtSn8EApI0fig3giDn0AP5wHDmg27RnWGj:BX2imph+D527BWG
TLSH
T1A895BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 85970867abb60513374cdd522f2786e8867d584ea4f42a172ad7612f23e3815e
MD5 ff55a80c32f191b742da182d66cd060e
SHA1 192db3c21805f29d60b38d9f3a8e5b6b5a7901e1
SHA512 f75fe5cb8061516b75c05f6be8c1e4d4c17b0d68a4b498ae94618960a49183608ddb140be347de617bb9eb1fe0fbbc2658ad4d7de14c2eb5445b3590bd9f7dd5
SSDEEP 12288:C4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:C4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ADC423BE914C01CBE92644B5C3E5F15DAC173E5BE92004837A5B78BEF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 4300ec00e04b4e203d64b1a91338078d5c83517d163fc7befe0d31635e85521c
MD5 f8d926ca1fba78ad957c1799da98c14f
SHA1 ee1adac22ff7504bab8292907da455e2187c56a6
SHA512 ff59f69c22d5226d782cbcba08664c4d8d73306aea0f15f33b10305d1f717412e15b63ca88aefda4d88b3aeb8dffc70373ba3ce10eaef97a850e279d82dee0a5
SSDEEP 12288:qBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AAC423BE914C01CBE92644B5C3E5F15DAC173E57E92004837A9B78BEF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 9c210920604cc4c4ccc8c42acff520d771282ab656b14de072ed0abece94e22b
MD5 d8571db3f45472fb41af1c79cb5474b2
SHA1 db100f1076b85a6387f49a88683b86129ae2b1a2
SHA512 779cbe96fa8cf99641e193b42ccedcccca03cd01eff61eb12210c9884291de18041a29ea92c33ef5a6194627838da5583a980f5c12dd41c454d21b5e50bf0a77
SSDEEP 12288:k/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:k/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D3C423BE914C01CBE92644B5C3E5F15DAC173E57E9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 7086ed5c77cd7137d82a7c1a115894932ec852200b2500f587ea8c20da297960
MD5 d84c3c1190f4d63f6c587ed636bd4986
SHA1 aa3bf1ec668ba00ec07ff697b26c477e06aedde8
SHA512 a7ee7b5d0c16275cf1084a3b939b921463ffa3e27878a5ffc83371321bb63bf368a49b4b28f4777f3e5bf6c87487f5463b33b768636dd698a7f927e408d98ec4
SSDEEP 49152:uP4m4IpOO6708KWDmg27RnWGjIJZHUmUYyH0UbETQK1:mppOO1MD527BWGrmUYUWd
TLSH
T145B5DF2DABDC0096D0BA917486658A4AFAB1742E1F3286CB1160937C3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 648d92e2b37f117a3c3673fd35c8902ab14d0f4799fa85e59489c07f07357477
MD5 c9076692e82cb3f084610a999befd75c
SHA1 a4229d0490a6b81a7b0ad150627fbff8eac1fa4f
SHA512 c308cb5a6e1e9dbbc04b01c0a1a6b4dd39a5829494a0e575b02fd1a127e969a158982a32f3d79bb2fa1ab4ddeca0a6b372572ec917b65bffa7a3dd57cc8f2708
SSDEEP 12288:TbsfsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B4E4015AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 e4fd2d86094122f2413f5c14b776fb70a8de04f24d4501164df194920e6d1ad3
MD5 b5fb0d526e452d8cae42bb2b792db215
SHA1 24d7c5b382c2ed098c27dca46b2301cc09c2114f
SHA512 2f6848082f87c9b661a6ef0b7a1bb7f3e1906fc2197c3696dc63231f95e488e68c13d97a74b32db6d5f9590fb758ea59ec13b15449da863995678ddd1d5ca988
SSDEEP 24576:fhl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1DsqjnhMgeiCl7G0nehbGZpbD:fjJZHUmUYyH0UbETQK1HDmg27RnWGj
TLSH
T1085533FD120C668EE53B5AF15394E04AA8027E7E0B240D63F613B6E57D31CA8C67D627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 778KB
SHA256 b30dacc68ce35ebfd5a67f1b814e47d0d2c6cfd2c91688584e8dd9b679cf4916
MD5 db2740abcc41a47a10c320d0cc11a0c7
SHA1 7509f55557ed19d1cffd7d8cee058b93280df560
SHA512 9909d670b09cb05aa0051e2a118bb35fed346bfa381136d6b490ab5c47b0162d31a8abeade7046ba423952dedf4cb588763a7cb7d349695c738128437c50af22
SSDEEP 24576:Lhl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:LjJZHUmUYyH0UbETQK1
TLSH
T1730523F8260D6E4EF13A6BF13E54D1865440B57E0B550E7BF222B3903D10CABD4AA72B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 77a7c08a2c2d907305a04fc1b7084ad7795643c99c2deb5c423e8f93372d6f65
MD5 85b213e9935ed3df7975f3cd4edeaebc
SHA1 a9028ced2e30b4b778fa6450a8276fe6b12056eb
SHA512 7c86c839cea915987c4036492be0049f9ee4709ae4e408541b20febf77820b3e564a6069c8c214daa732c328aa56a80fdf0f53d897c7418ec42fdc4ae92543f8
SSDEEP 49152:3a0h2GEkuAe73q3pp46zwwQyDmg27RnWGj:3a0hNYG4JwhD527BWG
TLSH
T16185AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 65b92009e2aa060fde77881d430f73ee3306c6dfd0d887264989bc79629c7c2c
MD5 cb469f0514ccfe1e698ff76dc53c04fb
SHA1 c451a74f11c688ba146909e83945e8329f0a6624
SHA512 4be914a0a246d85c8a9e72faa8cd57be72aab6a446d68bdc7a8f64567f3b61054b5817dae3983365f9febf574b0710b843602dd79049f0dad4184045eddd04d2
SSDEEP 24576:ZhbHjPyl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1RsqjnhMgeiCl7G0nehbGZpbD:ZhbHjgJZHUmUYyH0UbETQK1lDmg27RnN
TLSH
T1776523BD125C21C9E136A2B99695D14BD531BC3A072017EF739392B96F33CE88D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 a64e333a933b84c9d2d7731208f28a0a58362fa6aed90391e9292bba70b6f0ed
MD5 15c96e893aa6dd8666c686f081c6ba56
SHA1 a969b5eb4f68f494694ab1cc4e3eb7c99ae6317e
SHA512 415c1d3f44c3510acb023537e69f6264041ecb4ebe3ba6a1f13df95d115c82f7a8c737acab14ce1586033167a96452a0b820198c6565afdb5affa7211970cc80
SSDEEP 24576:nCl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1RsqjnhMgeiCl7G0nehbGZpbD:nYJZHUmUYyH0UbETQK1lDmg27RnWGj
TLSH
T1FD5533FC110C268EE53B5AF19794E18AA8017E7F06240D63F523B9E5BE62C6CC27D523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 3d2ea33f1962a32219c730f6e7732618e905620624d8ab796ab51478c0e2871e
MD5 2689802a1a231a4e6d1146dfa8dc411c
SHA1 6e5acd36657a9ceb1ac8d6e2175964c94e768251
SHA512 3e37ede85223d6ac6f4b045faae3d119640e9483a4366afd2c02821c92c66dd9b4653f432e69ed3ca650f0d3611f274172850bb65577c6040d6492f3ab0155e2
SSDEEP 12288:3ObfA4LWOsvAYFTDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:YbL3UTDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C3250159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5bd79781f0f860e4da6392615c628671cd3c3837aeb7816a29437b25af80ec7c
MD5 ff030eeed243f129385ff25cde375a08
SHA1 d3762aec3a5977cab8066bdd5df9afe19fb40f49
SHA512 7dce2fcd592781b0f52335f6e89b1cac0449a49d90646c7f34aa7ee70d421ae05e4b05576f7c7cd56528406fb75ecefb31e4ce7783c15ca138b983bd90cca4b2
SSDEEP 24576:eOphl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1RsqjnhMgeiCl7G0nehbGZpbD:eOpjJZHUmUYyH0UbETQK1lDmg27RnWGj
TLSH
T11A65237D328C10D9E136A1798791D24ED6617C7A07210BEF529191BE7F63DF88C3EA22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7b2e598391e8637fb0373a38e0b7816b5a3d87e0f4448ca84a1fdd9a0f209d57
MD5 12356725c20e520b65856d7a41b4bdfb
SHA1 016165140a87c4a9327a3aad6129bd7145bec7db
SHA512 83dda345759f1d48cede89e690ba47dad89f9aafac46054bd2ac110d9c794f35ffede3be3322ce0e62d20b5e99bb0422a1a8b576865f78bf5ac682783c51986a
SSDEEP 24576:97NM9YqZqmWMUkPjZM48Mv6bEhscsqjnhMgeiCl7G0nehbGZpbD:97cBWMpPjN8DbEhFDmg27RnWGj
TLSH
T135659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 78220e84be178c2892effd976cb6621a5fd0d80137ce20858bc4d037ee5fbda4
MD5 bd80e5e6743af83c04dbe19a81bf28fd
SHA1 039ed6798bdd6e1560f31872671855bd21cd13df
SHA512 558f92965fd6097a7d5f111bc09aa1c9a279b294ef2b1d7c9da50445f9a0f6df92cd9adc3b7c96277dd4c92f594ed5719d302267a97d8ce66034c7036e168b3f
SSDEEP 24576:LW6BApg2YuyuNDYTabvcdvNYf8km1ZsqjnhMgeiCl7G0nehbGZpbD:LF2YuHNETovAvNYf8kmnDmg27RnWGj
TLSH
T1A9857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 830ff4a2491aa4a1aee6b29021121d58dd2b5b2994beb52ffb735c08065eb428
MD5 86eb3f8dbc6f93def54a731e0beb26f6
SHA1 8fcdcd50368af952ad1225b8b1298247418af73a
SHA512 282bacdc034b6db52a43b20aa0ea8d2478de4681017b77a2a05cf4db92e7cbe0d7c59aee71e2f04ca259fe0c492fb0eb8abd9af5e71aa8aceb62b89476e06412
SSDEEP 24576:eAFs06+OmlfkNXEbTorsqjnhMgeiCl7G0nehbGZpbD:XFs060lwXuSDmg27RnWGj
TLSH
T14C65BF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 284eef3820bb8637c6da49c6c6b6f5354b905c906f170221cf363d26c554cdfe
MD5 81d65fbb0ee204f699820001879a479a
SHA1 3d4ba7ace3a564d4ea72fa580ea4ddda09b01e7d
SHA512 58fb771c873c04a344805f694ac9c22f3b64da1bf8c4d0a57c356dc9ff6e3483591dd2bfba1ee6f922253b8b5d6c6a70778b03b931c513741cf3b15361621c0f
SSDEEP 24576:WJnJ5D3WX+sqjnhMgeiCl7G0nehbGZpbD:WJnJ5DGXSDmg27RnWGj
TLSH
T12E15E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 eadec90894834eaaa9274d7daeab91edde738799180df5e5d8f9423d2e17b9ac
MD5 617e2bf4b5014828a96310b260834b03
SHA1 b86ff88cc079e85ddc384c0c5d97d06fe55e89e2
SHA512 5ae1259f200fba347cba46d30e0f600be795d6a3784f54762171ad8b04afbbe18d3c5ad3e84a31b64df61ebb3fc4a2d0546468577ce796d5b64422f16a69b4a9
SSDEEP 24576:LEPghm6/7IIXdwcXrif7qQncjlP65i3VupsqjnhMgeiCl7G0nehbGZpbD:sg06DIKdwc+eQnSt65aVkDmg27RnWGj
TLSH
T1FB955C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 831ae2e9e634327ccd3e9598cb0831ec6455294a23d9bf09395a23312fe92eff
MD5 6026e962d6320a53c9fafc165d7c752c
SHA1 d71e08cd542e1ac1fb2a2ac3f3e70622c9943f5a
SHA512 7e332af0b28a6e51ba9bb2e6f7af58bab2543a2f25a4456bfb40453b97078539929e160785fd321a94b7c31d15274de012068a87771aa11809db1b21c63271e2
SSDEEP 24576:jiFl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:ji/JZHUmUYyH0UbETQK1
TLSH
T1400513BD274C70D9E13AA179AA908146D371F07907522BFF62A1C27D2E23CEA5D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 48af933db5943889a41d60c1e3a6e50129a0b406f031d661a6c710d2f4da0d04
MD5 788add5a32becae9749126bfddefa5d9
SHA1 4fc2fb5b7fc9b857406362d16b81fb84250e9cef
SHA512 c764512125ffb6d22c83ad9350e4025e6f7013beef404910e77551fe14b6bf1de80fdcdd136510d72261a87bac9766203a359c7a43ef9c1740e87699b29eb215
SSDEEP 24576:9pFl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1RsqjnhMgeiCl7G0nehbGZpbD:9p/JZHUmUYyH0UbETQK1lDmg27RnWGj
TLSH
T1586523BD234C70D9D13691B98690C149D662F47A0B111BFF66A2D27D6F33CE88E3DA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 2e73d8dc1352e2ffad7afcf9e1f8bd425b88013ca8067eaf471628e04b9efdc7
MD5 bc8245c51f6d6a7d4c9cfd965cc58b2c
SHA1 71bad0f23647249c103342cf268ec62dd1b38ade
SHA512 03bffc8f01f9500d4fd780598436f5e7a6433df73a95b735df498fc020494724643e664010df462381e26d8c11893c948e7f0a13370ce3ea9b13b88bb9da9092
SSDEEP 12288:6jkyIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6IyIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DAF41219638C60C9E9760578C6B3D1589C36BC31AF2046DF6191FA3EAF73AD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 027af4b27f99db04e8c0daa6f4bb8c2e3727e234025e05712bb612081a4e38d0
MD5 7ed21f304babb90c1a90db488753a38f
SHA1 8f1d1edfd56c0f5bad769cb4e3da180dc7d3567e
SHA512 6a5bd075febf9986e5d54ba7eabe91a333db797f384ab905b179964b70fa0de5d00c1ae0684be0c1cf64a51080cd5240e70bbf6816faaed73981970f0af3cd47
SSDEEP 12288:GyOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C6D4237D525C20CAE93245B4C3E5E51DA8233D366B2018E775E7F8F9EBB24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6d2fdeb18607092456c9b385f6ba43bd1732e44206909363b81448b7842403ad
MD5 9fe4bdb46c2079f4ad5754b3d751f59a
SHA1 ba94a60789253d574c1c5c788ebe006809f3e5ff
SHA512 c8891370bdb0b446463d9b4188307a560ad01bc473c154d9e94810982603694b65131e27161901f8e1aca0bcddd76f5a697ab4609ff504d990236ef1f2e57349
SSDEEP 24576:MQ9MxZKdcz9dw3ksqjnhMgeiCl7G0nehbGZpbD:MVKZADmg27RnWGj
TLSH
T154558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 b5a192d6bc4acf234a9aca97bf449d9f92f66f70ffd7c47d60f0499bb44e0e68
MD5 747220bea32833a43aeb865f91f2b3a8
SHA1 81886aad50e8ec7f55e0fd77914bb4835e8a6864
SHA512 51bd464bdb062b237d1893ba162504cda6ba9fe6d7cd02ac3dce37ebc2c2909b1eaf74591deab38d404dfb68d483a6e43ac049d0bddcb1309ba0f18ac1133e42
SSDEEP 12288:XyoKo2JRple9pFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:XyocDApFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T177F4E01FB76D40E2E176813C8985C249E673B4315B2257CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 379fafec54b44a3984a1dc2e888c940674f83d95ba53ff8905785d8ca3eded5c
MD5 57bf59906617b3ab6577def50cde5dd8
SHA1 7905a660faf5691b09549c00bf456b28ff7cfde0
SHA512 04232d3bfac7721fb73e611ad3e8ce0773c5b377703cf42ffe214cd7818e6c2783647e6753a5475651368275757f33a6a3c02a516fe059d022c648caa1d2d2ea
SSDEEP 49152:zWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK5Dmg27RnWGj:z0zuNIHD527BWG
TLSH
T1DBA57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 63bfc4c2f07da466f4db2049af34213ff48f434bd5cd115f50b581a7d0fd0150
MD5 24a89f83b14e35f10418a6b82eb35354
SHA1 f2a1d568c5bd08566fc7567100e8b58adfeeafca
SHA512 ab42d0ece8525e2d132b8d240f1f9ed9ad62f22b4ee3a14d75e6b80f23681ee9471fdd0fbe5a10b53ac3058db10df90ec25e92f57437dad441cc4e78f48b2d31
SSDEEP 49152:3a0h2GEkuAe73q3ppj6zwwQyDmg27RnWGjNJZHUmUYyH0UbETQK1:3a0hNYGjJwhD527BWGSmUYUWd
TLSH
T189C5C01D67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE88E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 aaf2141fce378f1d6c36c309f6a9d1f0972906abf451fd22fc13be99069d0159
MD5 e72b7d273dad4e60ca1ca01258eaeb68
SHA1 135f3fe4e6d4baa28be5f6ea4212823a69699cff
SHA512 dc5af04cf9208481866f648c6ebd47844f496bb91947fe492cefa1c69bec74bb116bc93c192706a2f95c287e24355e6a1e631361c5f52e6c72e5f41a71ce1256
SSDEEP 24576:Y1QT7EcpfxR+N5AWAz3ooiYhjMqbQl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:lTDxR+N5YzTTjMzJZHUmUYyH0UbETQK1
TLSH
T16175C02EA7F815E9E17EC6799B23C502FA727821033153DB42A0C17E1E679D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 1124019953670fc91a575686244d527990f78953a76ad0b3bf7b57f443b27f62
MD5 ad7ced5ae100c77589a807cd7a04cfe2
SHA1 aa075c315300c1a73faf3d563e25103fd6fc7be8
SHA512 b27e699187b4f72b0fedabd111e89329d5cc088eda5653fce1f7d30901ffe98bf7ff154a594a0630c1438137627d7e8de74c823bf10fb78f9af8b19c0cade0ff
SSDEEP 49152:bTDxR+N5YzTajMzJZHUmUYyH0UbETQK1lDmg27RnWGj:Du5dmUYUWdjD527BWG
TLSH
T162A5E12EA7EC15E9E17EC6798B23C506FA727821033153CB42A0C17E1E679D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 849KB
SHA256 76b0e0993026e55afad5bf1fd544d0f9e0a85e5ac3fb85e1702a97468a586aa8
MD5 f6e1d71eb2d6641b37448bafe62b451f
SHA1 5b3ac131570ed96c5699d43a846d90a2554a93f4
SHA512 769710d39c6d8a30e18c3a1dab911841aa089781ea0b2c8af8003cd7a8098f82710f383f869bbaa2bad04ec0c7d913cad4c6588714833f840202eaa89729530f
SSDEEP 24576:2hbHjPyl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:2hbHjgJZHUmUYyH0UbETQK1
TLSH
T1E40523BD165C21D8F136E2B9AA518147D370B83A072117FF639282792F23DE98C79F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 861KB
SHA256 91433272b5f446074af9876095458deee6ea04847c1d0719f34fc21dd65e0250
MD5 3f44d78b83b650235e993a005daeac00
SHA1 46cfe68380de3c1786f250b107afaffdbedbe175
SHA512 0528040ba0716f279c97ccc6d84d316253189e530bacbc4bdf34299baf6b8b6590e3dd1abb58eaa2508de2fdcf5c10d5086dfb165ec6233d0e4292a5f6fa653e
SSDEEP 24576:1Ophl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:1OpjJZHUmUYyH0UbETQK1
TLSH
T1EA15136D329D10E9E136A2799A92824DD370B87A072217FF4290C17D3F53DF89C7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 7c1664fef0b5827aeb399ab4e6f557349f2ca5f5bff1131fac0f935728cf58d8
MD5 0b4a3fe42e96de2e1d3db5507337d766
SHA1 daa4f334b8c3b372e4f4eda89a57a1d40e1e6056
SHA512 f8cc91ff9eb7364c3dc8847a67787b54e048cc883e76fd0cafb854909bd7be16a1752436a974718ad7186010b7ee11e3aca3460bc81984f170f919b2775f80c1
SSDEEP 24576:gTMdOz0FFS+bmSLHsqjnhMgeiCl7G0nehbGZpbD:I0K+bmSLbDmg27RnWGj
TLSH
T19D15E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE46A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ddc337e4bb6346b.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\4ddc337e4bb6346b.bin
Size 12KB
SHA256 8028fb7ed097b840a7e0ba7b05dad3f656165c6d237b3c4f8a9fb11837baac74
MD5 ed877c18732e4ef33d71fcb827f1841c
SHA1 9484714df89b4f0b457e54eb6de1265701ce3ae5
SHA512 09756e6e3f39b54d2359be5a91e5057958ebb70bd4f7dd0680ba71cb698373041c3df4e31840e96056452eaa5d82cb71592cd0b13a597e13e62ab35174d12ec6
SSDEEP 384:GRnRiVTjPMogprctsifJVpF6kufzG4G60b3ZyZwV:koTkeTYZf+hbJyeV
TLSH
T1A142D0FEC7CC606406D2768BE152C4DB7D2FE961014CF499A1824C88D646C25AB33ED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.4MB
SHA256 f63784cc58ef116f0e40817a9d1064740506f74b9e4b41f065c9624780da39aa
MD5 46a64ed4a4e86e73fd6ceb700b15a688
SHA1 17b8081458e5df894258317cac69ec798caef128
SHA512 f946634b0dca97edf5df3ef7bffdea3bcd61dcac376de5c0c5169f2d7dbcbc022590759752fbd0f0339300a05d7c50c3d62e0011086921e1eeefbe701e4485af
SSDEEP 24576:Bg2g0JcRTk4yti+R5dUR/7l8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:Bhg0aTk46pUR/hJZHUmUYyH0UbETQK1
TLSH
T17365C02DF2B910B9D4AAD236450147B5FB71782D1F205ACB4170C638AF06EE89E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 7a642fd194b46a0e2ec7c7185cb3159d60adc496f2e9298f0ef3a631504773c8
MD5 54b506d7913bb3251e75922293cd0685
SHA1 f53492b6e11b257ceed51cc0098aba237fbfa5b9
SHA512 3a26dba07b92163deb0b59a4a27296746e90ce1590ab92aa31c0415d7f7dd6bb3d905e2c0d9115f011b553c7329cd9d494fe3bdfd9b8b797869293d516cf4884
SSDEEP 49152:9hg0aTk46p+R/hJZHUmUYyH0UbETQK1lDmg27RnWGj:9pdmUYUWdjD527BWG
TLSH
T1A795E12DF2B910B9D8AAD236454143B5FB71782E1F205AC70170C538AF16EE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 768KB
SHA256 acf83f70ae2ee5fcaa3b0353edf68e2323dac2c3323fcf50886c0f8af5975af9
MD5 c59a2aadc109d2aa1116d6a4a35a4ea4
SHA1 e74d41578e72fc136bf10ecde4aefda81d65d386
SHA512 a83feb32bd4a256705990ebe4c6201ebea8a85effbd7b6c21ea04a113c3c97348cdef7c49f7c2aa6042bde1d44fced9bd6a600558885bfe224ac6a610eb973c7
SSDEEP 12288:EdAsK8eOKQLaunED46rLfOqiiUGhlbdNrEzsfgNmXEMv0ZscAjTQKZD:ECl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1
TLSH
T1EAF423F8210D6E5DE13AA7F23F5491879440B57E076A1F7AF232B3913D01C6FD0AA626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 825KB
SHA256 6fb5cb5ac4820afe3afb9f8256c24b5b74dd1800419172385c3a77347873e956
MD5 94c6fcf8f24aaa38d5f0457a6dd41682
SHA1 9edf5dcbc77698bb1a3b543c7247efaa021d5513
SHA512 b74b061b6242a5cecbc1c0473c02bab12d49ebb1f6a581febe95a0aa348ab3b080879428301660eaf831dbabd8275ad11a4c7d7baeef0dcde7e06639868c00c7
SSDEEP 24576:pll8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:pfJZHUmUYyH0UbETQK1
TLSH
T14305236C23DC34D8F036A6B1AB6541468570B87A03251BFF75E1D67A3F22CE9D079B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 ca238ccda23f0322798e1cdb0733bd95b282c25c1cd80098cbb362f78f4f4397
MD5 097eb62ec8f82c3b34472ce446c8721e
SHA1 282b3d8e3f7c9c1f928d9fd60eb26450b4494644
SHA512 34b46ce858b6ea43367b61017c29e53a2b020643d8a5b972799d5459b0cac8bcf2b336fe3a6d9f2097be1615ed0337cb5f2f4ceda88c400fffda7ff05c5034a2
SSDEEP 24576:/ll8eOKaa+EUmUGhtgs4NmXEbZsLTQK1RsqjnhMgeiCl7G0nehbGZpbD:/fJZHUmUYyH0UbETQK1lDmg27RnWGj
TLSH
T1966523AC138C30C9E43656B19765D14A9421BC7A07241AFF75E2E5BA7F328E8C539B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 997KB
SHA256 7e5b8d61efb95925801e3b79e99ddeeae022d8603c036ae3df7d1e8d852e8391
MD5 69922c4db36c089ae4d4129dd3ad89a5
SHA1 19245bf8ec4e46df1e75aa8dd6929bbd19286a11
SHA512 c4776eb9c2c09a4c7c8b0a8f09702f9904b5b3dc13c2aa5a7cf2da4d75a6f166bea6cbfd62636ca898b1b995f077a682b4c93af0992bb8e71f02c47347f03d40
SSDEEP 24576:3wutOWpl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:3w2OkJZHUmUYyH0UbETQK1
TLSH
T19625029933981CF9E56782358657C136F7F2BC161A258B2F5370C75B2F23261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/380-515-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/380-169-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/628-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/628-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/628-158-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/628-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/904-14-0x0000000002C70000-0x0000000002CD0000-memory.dmp

Download

memory/904-22-0x0000000002C70000-0x0000000002CD0000-memory.dmp

Download

memory/904-127-0x0000000140000000-0x0000000140948000-memory.dmp

Download

memory/904-1-0x0000000002180000-0x0000000002203000-memory.dmp

Download

memory/904-112-0x0000000002180000-0x0000000002203000-memory.dmp

Download

memory/904-109-0x0000000002C70000-0x0000000002CD0000-memory.dmp

Download

memory/904-8-0x0000000002180000-0x0000000002203000-memory.dmp

Download

memory/904-0-0x0000000140000000-0x0000000140948000-memory.dmp

Download

memory/904-70-0x0000000140000000-0x0000000140948000-memory.dmp

Download

memory/1676-401-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1676-164-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2288-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2288-154-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2288-36-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2288-44-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2840-177-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2840-517-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2840-198-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2840-182-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2840-216-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2840-338-0x000000000CD60000-0x000000000CD68000-memory.dmp

Download

memory/2872-659-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/2872-621-0x0000000140000000-0x0000000140152000-memory.dmp

Download

memory/2892-75-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2892-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2892-69-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2892-68-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2892-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4012-173-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4012-516-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4308-532-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4308-655-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4452-161-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4452-159-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4500-156-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4512-166-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4512-434-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4616-593-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4616-658-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4968-383-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-400-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-406-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-405-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-402-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-412-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-413-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-411-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-417-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-416-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-415-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-414-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-410-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-409-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-408-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-403-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-404-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-375-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-376-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-370-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-387-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-391-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-369-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-374-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-392-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-393-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-395-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-373-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-396-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-397-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-398-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-407-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-399-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-394-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-388-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-372-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-389-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-390-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-378-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-377-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-386-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-385-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-371-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-379-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-380-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-381-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-384-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/4968-382-0x000002353BE10000-0x000002353BE20000-memory.dmp

Download

memory/5212-89-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5212-172-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5312-149-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5312-155-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5312-143-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5464-128-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5464-243-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5876-137-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5876-138-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5876-328-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5876-131-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/6032-563-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/6084-656-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6084-586-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6112-657-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/6112-635-0x0000000140000000-0x00000001401D7000-memory.dmp

Download