e805389d3366fb2e210c3a3e87da2b6a773f8b82af3f362863ec94701717f747

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 6.5MB
Sample261027-qde8psd19k
SHA256 e805389d3366fb2e210c3a3e87da2b6a773f8b82af3f362863ec94701717f747
MD5 830813e39b3479b1b8b852ced2e1b85f
SHA1 eadbcbe7ebb03c9ab8839efedcb08100e9560cb6
SHA512 853e129beda2f0cfb355a12f4a6043de39b4e5f15c2f94e302493040de5c417673d20f3c343c5a7132fd5afd3b890234b41c59d39be9a617c5a30bd24d615be4
SSDEEP 49152:x2DDjNdasG6ML+3QoQHlpoPoFvNwQUF8Q1IJz5RVO3suyXcX36SakvFTCT/M+w3:eHHh3A3tec2nlEw/YbJzl8Nw
TLSH
T13D66AE17F68903F5C09AC17597674272F622BC2A1F2161EF264CB2241F7AEE047BE365
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4152	alg.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
4264	fxssvc.exe
3580	elevation_service.exe
4792	elevation_service.exe
792	maintenanceservice.exe
4864	msdtc.exe
4184	OSE.EXE
4140	PerceptionSimulationService.exe
2460	perfhost.exe
4324	locator.exe
2132	SensorDataService.exe
1768	snmptrap.exe
3496	spectrum.exe
3616	ssh-agent.exe
1448	TieringEngineService.exe
4696	AgentService.exe
1856	vds.exe
2096	vssvc.exe
2064	wbengine.exe
2876	WmiApSrv.exe
2372	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cf16e33ec665fbf6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f88ce561466dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004843cb571466dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb5176561466dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084ffa5561466dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055ee73561466dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077b197561466dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1100	DiagnosticsHub.StandardCollector.Service.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
1100	DiagnosticsHub.StandardCollector.Service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4076	2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	4264	fxssvc.exe
Token: SeRestorePrivilege	1448	TieringEngineService.exe
Token: SeManageVolumePrivilege	1448	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4696	AgentService.exe
Token: SeBackupPrivilege	2096	vssvc.exe
Token: SeRestorePrivilege	2096	vssvc.exe
Token: SeAuditPrivilege	2096	vssvc.exe
Token: SeBackupPrivilege	2064	wbengine.exe
Token: SeRestorePrivilege	2064	wbengine.exe
Token: SeSecurityPrivilege	2064	wbengine.exe
Token: 33	2372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2372	SearchIndexer.exe
Token: SeDebugPrivilege	1100	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3580	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3468	2372	SearchIndexer.exe	111
PID 2372 wrote to memory of 2900	2372	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_830813e39b3479b1b8b852ced2e1b85f_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4152

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4104

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4792

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:792

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4864

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4184

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4140

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2460

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2132

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1768

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3496

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2968

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2876

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3468
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1e9edb8be7cad20b8fdc2114a8120815ee09f4539c405479dd614942e88ad672
MD5 2c6c1082c68f467f2e967627a95d06c9
SHA1 024860e70a2e23d4c426e041cb61c7ab1c86f48f
SHA512 94748ca6599563ab38d80049c448592d8f3b75766ffdae2c3334041e308ca38c344303cebdcb24de6af993e8c7e7c3f4a4df0da1a1dde8569abbf5d87972a3bb
SSDEEP 49152:1b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnQT/M+w:L3q6HjBhw
TLSH
T1F5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 8816bf44b9a89b5c615d320037f431f8db9b877b4d34c473bb24e694980fe478
MD5 049a0f3ed60b9cb6e986a1de10a1cf6d
SHA1 4fcbdd639dbfe729d4ec29845c1589bafb72da95
SHA512 9b1fd246983d17f3552c0d0462556e87ad00aebf5ecc437ffe3c8e93e1be3a91fec0c0146728b021b41e4df3b5d86e896fb25ae0934ba9bc66ed55fd68851635
SSDEEP 24576:8XYfDtczAAoHjto1GFxlXutIs1WZX5AR:7tc+T/M+w
TLSH
T1C585F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 208edb5daeb44530c721d9c7e8beda8939fd46daf0a079a1d494fc58e6c6d62f
MD5 33e31f93e894dfbe2dcdda27f458053f
SHA1 60a54a5f506e3f0456c7ed70232a14990416235e
SHA512 d84e82fc74896060c4aa434693a4dc5aaac4d07f9ead09e22f5f4ba5d6243377c064b62e5b1525c30afb388dec9f12664df36f0533fb21e2e18186f954922af6
SSDEEP 24576:k0Le5ji0hmxIrMXoHjto1GFxlXutIs1WZX5AR:kPji0AGLT/M+w
TLSH
T153959E26F5748375D073C0B9C5D3A69AED7230861B308ACB4286D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2921771319812864000b3cc8a311826c968a46243b272a8444d098b964428d2d
MD5 bd4bc155c9d8ff02459d8e143a95dc20
SHA1 7f01afabb0daf778c23c7932e8a2b49ed8c4f910
SHA512 cdbdaf40bd840ecdf6806a12354d22ec1b3ef38fdf8172ed58c3fe081d7e2fabd94c40d0163086be7464f2aa38d53e7b0a412aa0408e64e3cf88d977eae4b9cb
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWE6q8wyudoHjto1GFxlXutIs1WZX5AR:r/ezSC6vUzPvxHjyvT/M+w
TLSH
T1B0756C25F5788323D0B2D0BAC5D7BA99FE3230465B3089DB0246D76C3E276E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1cf86254f9e345d844212cb805d67e29ee67b02aec0f2184e132e56459cd1786
MD5 e3303ee0beb6d6b558dc585497e5bf94
SHA1 9c5611151dd4d864e983e9b474ec0c916bcdef70
SHA512 03649034dcd33759748ebe1affd5192c8f9234cdd6db1d9e91700c40e070b56725a789a634f3becb7572c7808ff31c82667ac0b78d1de4a23dc199cb11a42e9a
SSDEEP 24576:6VbqPb88hv/l+6EoHjto1GFxlXutIs1WZX5AR:6VO88hXl+sT/M+w
TLSH
T1B6559E66F5B48331D073C0B9C5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 8096fdfc7882a64a41e53144c828adf07c3b33f7aef710f534d0be760795f9f6
MD5 a446efd321647c659c89bb0ae41339f4
SHA1 386276e8b946393426d26404b1766f729182fc5f
SHA512 58f1f30f74c52371b3fb656a371c3abbac9ad79547e5af7527da40e29dd1de4c80a8e91d37d4d5f9ac2f74db9d9e5eae6110518c2a89d958536f4a987b965fec
SSDEEP 12288:aHlhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYiN:aHboHjto1GFxlXutIs1WZX5ARHN
TLSH
T1E365236399F250D7F77A11B02DD77A61ECB7BB06094824BB4B50FE190E3C060EA766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 a923e18ea3419386f44786498f50850958702b880aacdd0dfe536acb19dea72e
MD5 f744ce0657247060957fda1e2d8d8a30
SHA1 d959abc2b10f84a01984850d30df5732150fc969
SHA512 f53d592d77a5900b42cb8a22885caff7996c9cfb40aabc4848477e1b641ac7ec5f313e7495ef7cf20923b2d62a63242dd30718d5646b3b9b72dd7cc6081129d8
SSDEEP 12288:seBNUbTVO86UGhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX5Z:sJIUsoHjto1GFxlXutIs1WZX5AR
TLSH
T17885CF3BEE38FCD2C27A4DB85A928640E77274314F51A3CBD165C20E9E275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cecc00200bc48bd38d709fbb55af1cd391864f85cfc1d549599fc60b9ad1ceab
MD5 94d86d6060ff7c292465ca8e57a9046f
SHA1 323285627b8a03327d8f651ba8220c7409e78286
SHA512 44026ec513b64aeee9887467ef3da84912bbc51cd4d3a3b578025aa78c728297b4053827f8ebfff85b85ce5ab03624f27ccb0793e4f983c61e43802ba659b726
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THK:UQvGAdlCEL8c/yRNw5Cow
TLSH
T1F0266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 ef247f13fbf3ed2b780d7fdcffcbe08fa0090dabf5f392717be75abd11ecc982
MD5 14cdc047baa1d54216486c1f7a6c67ed
SHA1 5af4eb3ae801c3bcfd28a21ce9401ee9cc223e4a
SHA512 a40149bb7d1e7de7ab1852a0319e3474e9891479d7ac067abe2fc7cc3e653a403f5c614968b2b16c4ce30f3aeb9968156a2af560708125537052e2f0fdf77610
SSDEEP 24576:s7ewsAjioHjto1GFxlXutIs1WZX5ARTN:uljbT/M+w
TLSH
T1D685E031FEB0E036C37B0DB12B26D716687DBA204B5119C3E3E89E9E49341D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dae88d12704cb5e22936221fcff74c3a93fb9543c54bdca9eddb39660b634eaf
MD5 ddab3aa02d27d4d2e040402fdfc7eee6
SHA1 f2039f511c96ecafc19ee8f2b2b4d77f2551f908
SHA512 cd88bbe83af80ee5a5f3fa860996168d25777cdd79a1addbcdd557cb3eaa16f726a69de7acbc446e872fa226ee3dee90c9d937102ad3020f755ec7184e6af0a0
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHY:3UEtQevvqc2W1cpV2EI32
TLSH
T16E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7c325f6bff114b84685677eb66ff0a09965bbab5bc4a5cc298ef0ac178165251
MD5 db21d5cd748098e176a8611c7afc9e22
SHA1 bbda3ca445f24f3274aeba519ecc00da40c4f310
SHA512 0d61e260da6fc335dbabfb9ec101ded018faee339fcc442d499f6c2e9d52449de0bd47adc5785c31bf65254a62df59beaefd049f029c2d368169401667747d63
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/z7T/M+w:moqtVjnm0w
TLSH
T1C0D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 90c7488c98f95befa7c565957908eaf7754b4e6da1162166f73d3b3fcc30af1b
MD5 af3a0979f12c5aa8982a2e36d3c0ce7a
SHA1 31757fe9c6deaafbf31f46501364d6263233444f
SHA512 397517b8b7e1860439f2e54d014bcfcf907a4ba49dcd26618a0b8f77ddb9fa3ff7d4f7faaf670dcc7d652e910a5d54b0f9d453dea08d6016a3474d0ccc04cb5f
SSDEEP 24576:XAhGLJIFoiwtA5l7S535oHjto1GFxlXutIs1WZX5AR:XAMyFoiq5CT/M+w
TLSH
T1C835AD81EBF955D4F5B3AAB899B69170EA77BCA65E30C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 fe60bbdfe8234bc83a5234aeb19f1aae21d0bdd9cf804b6d515a84e23bcb660d
MD5 707db0d3b85c5e180c0eebb3a675fc0a
SHA1 02b198f177371175f455892c6432a447bc483e3f
SHA512 b0257dbb648219b2e37729c7298cf1061fec05fe02e24273ed027ffeaca8b38df9ecd9fe8396ef4ed729a14d81c6d2d648f7231e7834705c4b316c40ffe45c4d
SSDEEP 12288:Vmw5HEjsChNDBFgl0WDm+CzhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z4:QwuiOWuoHjto1GFxlXutIs1WZX5AR
TLSH
T1EF85F14676E50CF9E96781388597D536FBF3B8022A25D72F0760CA1B5F37220BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 3d69e40c34e6f639e41bc946efa642b93e77097b3014eccc4766ae72c67a8398
MD5 07d7ba6ee0c5b406f38b16a5db28b5b6
SHA1 88ab7f0b6ec76ffb4efb9c51be325c9ad081f71f
SHA512 060b0c40dbb7697e4d1acc8f16dd2cc6e05d8876d3a1753e7ccda1875f45c6fcb96d265dc72558920e8d53e3b41b854a13c64bce71dd23e405a2fe6aa6b5a10c
SSDEEP 12288:HTZ1IyghKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:zZu/oHjto1GFxlXutIs1WZX5AR
TLSH
T1EA75125626F020FAE2A752789DE36A55EBB3B013173503DF06608A2A0F375D16E39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8b36d42731cb91339d56d7e51cee2f829835d2df16b6f72b400bda95af8190d3
MD5 2ade30226adc232f299db8ab3dfc4169
SHA1 5e5552e00cc19ef9ad0d905f475bf21209a6bfd4
SHA512 110b22610a59bea6a643c5d3ffde2530087a633debcef03175acc5dbcc5b5c2c2ceaf4be8a565faacc63486451e1dcc4f9e7a3ac84bc4b5d42faaec626e7f8ab
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:EQRQyi36YOcPQLvw2gAf+PN3Fw
TLSH
T1C9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 56406eedb6693ac0be7c59beb3eabdb9c06a4316015169cc1960e37b930351ad
MD5 48df47617bde09dbe4ec450c77de787e
SHA1 dcc3c2313cc1b38c9adc712c18e63512d63818ee
SHA512 6d4f1c63a6e0300ccccd4f1681a201011e2c44d3171759822c849208226b6e01985634e237d11ca8886f7e8df29fd3de57c8d37588703d0d345011da2a04a56e
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:XQRQyi36YOcPQLvw2gAf+PN3Fw
TLSH
T173667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d1d8da059a49ed1738b4dcd0fc311f62082e12bb7107076bff7d9ec9715c5f33
MD5 91ff7c81ff70c0a5d371674c4fc72511
SHA1 b886cc98ae9bb74cf53e9f6983b1550a724fce44
SHA512 24bc3ec2a77325ec949c8ce7c63c9f36949229cc93a3ac6d65a49c0222e1cf26e5daf605af78d21a5ef68bb9c9af71e0237d2e5baa395e751534eda541144ac0
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0PoHjto1GFxlXutx:s68Qg55nhheWu7PNU3/LT/M+w
TLSH
T1BCB54933B2F20099C44DE1769F4A973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f4165a9780f7a102ecce08cc183a0093dd67df3300d9c2d9a9afdb839b0d1992
MD5 cd6adb821e106e3bd4a3bd9b2c10fa64
SHA1 4825f5245bb33558e2c4889c78c90cd0024094fd
SHA512 3c01ceca5411735477cf1fe6076abe04382eebceabd24eef6c6dc8f1e287e3504b74dcc7ea0d7a4f38d1f7b99a1f06c2980d35653684c4bf0bece5c3c300d1b5
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99:sy5112gYy5azzVvL69nLKnhZmw
TLSH
T15F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 07be63848bd161dab4f67a33b4240d2de90d3ecf4b69beba52df866b7d4f3c2a
MD5 71767dcf49772aa810f8cfbeaf39223e
SHA1 01ae840710a5d77e246e45a3d0c7b2b2cf702500
SHA512 3ea20b77e306006537b0d7540900d0d5361e56b212f104d39875f828112354b5be4e23d95b1aa6a5806e8dac163bcc1b68384b9a0ab79ca7b4a534695e277909
SSDEEP 49152:rB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glxT/M+w:9u6JmVxd2d9w
TLSH
T157D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d5c58bddf6a024699f1acfc2c9a78f5a7a20421ced0608a06320f541d72c67ee
MD5 00acc163df4e4abe3ae3e4c984111a21
SHA1 4b7b6c3795e4684500b4f2ef12442a31c1a8fbdc
SHA512 e5f38dbb0fa43fe35897972bf3d0020cbaed18a930f0bce8d1e98b4f150fbd722234016bb1203fca84f4679adf56efb497fede5b81f49fc47920080c859ec42e
SSDEEP 24576:Khv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx38oHjto1GFxlXutx:C1hpsNoJpF1A6UU44CwH7R4xFT/M+w
TLSH
T1C6B5AE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8e59096656936e6ad0c916facdffbad8c02280f649af803a6d2b5a9e7f6b8cfc
MD5 16e9dd97a9fc4e69cfd21a090bae9f83
SHA1 fb20c5747a993c96f36e9418d425bcc736822ebb
SHA512 f047d74c31105e9aed5e6279b6e2718fdd45bbfe521e0da0252aa51bc537ca5a994af76fc89a1eb5dc0335dafaae51eb643011aa3ebac6584e4b1fb08b666139
SSDEEP 24576:p4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnq/oHjto1z:PSuZQIY0Be2KRRVtOnks6NMHqgT/M+w
TLSH
T173C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 197c2b46b921e7ccf0a86eb4f26b091cc90b62e1f46b9fa17b1a0fb2447a5451
MD5 4cd40b73ad679de0d670c7e9ecab88c7
SHA1 67d442417fa819f8cb0d904170dc9ab04c766862
SHA512 fabb47df80f3720a5af41edb8088935cc995f86f8a25a6678322e3e95b57560ee1d4584ff29418146bcc79157fbebeffad1f37539688afe2af89a8c703b8d9b8
SSDEEP 24576:JhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QL8oHjto1GFxlXutIs1Wg:JhtSn8EApI0figngiDn0AP5wBT/M+w
TLSH
T1C195BE13F2D900E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 608b38498b3b273aa926552ead16817d5fd273c827bb0a7a9d31ef340b06b53c
MD5 a848c13c25b0c3793f5ced5517063691
SHA1 11ac7ca84fa603be5d139db36f9aaa6889c4c35a
SHA512 5e13258569d34af99eaa0d7c77f91ba5d8cbd5636250430ed66d6c3731f288f9fd87877e6fa3c3e9e9e547bf9fd9f8f3982723e937ed2c534a6f799f084572bd
SSDEEP 12288:qNhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:qjoHjto1GFxlXutIs1WZX5AR
TLSH
T122652363ACF340C7F62551B069C77AA5ECBBB307594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 11ac53df87e03c4b66d2873fbd2aeb63c81c2688c473d2ce2c4130be4427ffc4
MD5 5e1e7ed7e692496caa2a6ce09ca9c616
SHA1 4771f5edb472c59fd1fd9d9a574e2b0e4cc7404e
SHA512 1edd7e57940ebf7ded46da5e72bbf088270927c39531d5ec3d7b4ac5b2a1cfb085bc10abee84a51b0dca7fb448b2ab9728ae8b73f3306c02356745e120d28dcc
SSDEEP 12288:O0hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:OGoHjto1GFxlXutIs1WZX5AR
TLSH
T1B2652363ACF340D7E62551B029C77AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 c60156c9e2b25bbcb7c24ee464cae3905eb0fc12ec00e712df48af42a2f67869
MD5 4fde211ff466ab175661376bf844a32f
SHA1 0950d003b4aaabd17491095df2cf2674b40bc195
SHA512 6dabaad44fa24a8ee69ad366c8628568a5b11796e288b800d01181325f6218f42964545c6b940b15260d6401039eb1097bf9b78e882397951943e5d490d0ac6c
SSDEEP 12288:XOhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:XUoHjto1GFxlXutIs1WZX5AR
TLSH
T1336523639CF340C7F62551B029C76AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 b4967d587d84cdf523874ad0508f64e8460a1a942a03d9b7f4ae06a77e77b928
MD5 710cc377f101a5b15e1ea61774100521
SHA1 4884b7235e3e3dc16bd776942d3ee1ce9abe7d06
SHA512 6c4908ebb1f5e00439cb45497063daa96cf90470c96171b8e80946f6e0752bae13d5cf21f8034f9775c6d5cb41ed6b89a76d8f65634317fe7f799d054456b48f
SSDEEP 12288:KV/hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:2oHjto1GFxlXutIs1WZX5AR
TLSH
T1736523236DF200C7E53692B49DD36661ECBBB6465B2521FF8B009D190F391A0BE75BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 3e0512c84d84d3c6a393de30d9551325e4600937af813725fc1d06b17db57e0e
MD5 f4e7042e451ec96843f4fe04b148f241
SHA1 3e4f0e1dd9cc99535282123469a560d212d57c01
SHA512 0b14f32dbc9433f9eca62f885cf573a9b7c00b607eee4919631315681f6222d42d84f0e8b4683af18d7a4aa18ca5e7b9d7419f5d6c7df85941ff2a6211bd0893
SSDEEP 12288:LXhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:LxoHjto1GFxlXutIs1WZX5AR
TLSH
T119652363ACF340C7F62551B029C76AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 5dcce4701ab2260261737ef88db488523751eb0ec465316f64f2621323320495
MD5 3679dbcb65b810e91e23e1dd9e03da75
SHA1 88b1feebefdd59d13f08139d1889dd307a065035
SHA512 bee566612e608906a564eb61b5612bcd6bcc3c32d50071b5eb409443d41c7b71e632389ac41b8ec3ab4b6b4fdd518e71a7afeba0feb297aa65d1f6d0b8f9ddc5
SSDEEP 12288:IYhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:IqoHjto1GFxlXutIs1WZX5AR
TLSH
T137652363ACF340D7E62551B02DC76AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 ef33f096cfd790b20b90d6456633cec76b38176a445ad0965bbac24b6ee74992
MD5 5c03a18f281da9a9be94e98caef3d1f1
SHA1 bf4c74a2978bf28d6dd841db59444bf074b3f1fb
SHA512 130975b0f934ff2f08faa1acc9cb272301d6e00eafbbc4ed87719c6af8472baf28164329e88adba9a248ff91cc7fd80bab9950828c4d1e795b13ccb593c3e3a2
SSDEEP 12288:QshKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:Q+oHjto1GFxlXutIs1WZX5AR
TLSH
T126652363ACF340C7E62551B02AC77AA5ECBBB347594910BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 bde26ebf3bb0c468e059a0136b608cb0e8c3992ce7dc9f3803e3a080a758af64
MD5 f3d2c1c2dd428075d144490ca274b3a5
SHA1 e172349a4754d5e06e4afc43ed24be7c387ed299
SHA512 a4f6303203081b1aefa7ee66b3837b4312f4904c0d876276c9173fdd6c0cc50e5ecf5a9b74ac833df543d3da9b2a871589c447d3a887a5c718018345011c6f3a
SSDEEP 24576:wZM0zFVSOmoHjto1GFxlXutIs1WZX5AR:wZM0zfTT/M+w
TLSH
T1AB8502A5B3A018F9EC67813DCD569916D5B37C1A0B60C65F03A43A2B1F373A01D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 77c855d770fd946d2c105ddd44865717994243748713aea186a8477638a95663
MD5 b19b8cf6c5d2f0b061676cee93bc6ed1
SHA1 a74f2835b9c525efd1adfa841c195f6a23eb04a4
SHA512 834217930236b029829f50b70cd4a7b4250ffd30409523100ed1ac6ccd43abe202a8b7bd66b55605e08a3cf0c2cf9a0338e9375e0934d7a2806273a0aef70e01
SSDEEP 12288:XphKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:XvoHjto1GFxlXutIs1WZX5AR
TLSH
T124652363ACF340C7F62551B029C76AA5ECBBB347194920BB8B50ED190F3D0647E766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 7e3ad4594a28f971f4b6aec80fe78a7a9da82ea177087b98c35727b713a3124a
MD5 f8752ee3112564240eb47c258c8b19f0
SHA1 1ab65b79e8b58ef634f85f116ccbdfe3630e6b16
SHA512 fe597c9e9aaf78877f131422f9eeb05b14716ded39c8cbe43a25552817b8e6ec38616761ce0596be8607cfbf41781657fce1d01c77462092ffd70fa5c5dfc39c
SSDEEP 12288:D1hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:DLoHjto1GFxlXutIs1WZX5AR
TLSH
T10E652363ACF340C7F62551B02AC76AA5ECBBB307594920BB8B50ED190F3D0647E766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 a4c14f429daf6609b85f53d122fafe2a2f6e0c8751d87abd8d13e8a7827d336f
MD5 7017b03e9fc3535a481494af1fa90d81
SHA1 af793de954718abf4beeaf6e7981dd348c319007
SHA512 f540227b2cfe96703ae345281945a46926c17d38b5cfadeb1ad2ecda57f7020f80067900febcccfeb0029ac3dbadf7b92a05f812beafbae04586ac9ca77c9e46
SSDEEP 12288:qyPz5L8ghKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:3zySoHjto1GFxlXutIs1WZX5AR
TLSH
T14575021776F130F9D13692748D931A51F777B43607245AAF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 5f6b3be3df0fabee7a4257ae2e1502cd3e6fe34cd4640dc1a79940bf336db7be
MD5 b1ab0364831752230f732958f5fe568f
SHA1 267a5e45f5882f532978ae8995e2504b7417ddef
SHA512 08f5ef763219173b59f811c0217ddf10a5dd88af3615ce316923ec54bc82817d41906528549efff4b234abe4b9fb3634d8601e5d7634294a5739b5047591c935
SSDEEP 12288:pphKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:pvoHjto1GFxlXutIs1WZX5AR
TLSH
T1B3652363ACF340C7F62551B029C76AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1c8d6ba9104e0c2bf7b8c76e27f3425426e067587ab865b7193dbf454437fb0a
MD5 2668e9c8ee5f043f0eb06e407b9db90f
SHA1 e228fbe8038a3afe1e6b3b2b6c9bed68028b4acd
SHA512 db3e99e811f7454d1e75466278e5a5ad35c20bd266e1e36dedbad22e7481b0f782e8f767a7da95d5510baa48ea7ca13d6663a75ba88d0d2fd42866ef8027b729
SSDEEP 12288:TphKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:TvoHjto1GFxlXutIs1WZX5AR
TLSH
T1A4652363ACF340C7F62551B029C76AA5ECBBB34B594920BB8B50ED190F3D0647E766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 9ba10bbd657f227e92a3e2ec484a6ba8b998b967d75888229a1df0d791fe0280
MD5 e73fbb1d2561d38dfbc02c0311b1f32c
SHA1 b06eb4704ab1b6c86a3746d1845cb5a0a2b1413c
SHA512 011f89766e9a4b9c626247a577c42b16edfede00faa64267eba1e12e4582e0493391b002d47ee2c093efe8f0d7227a742b18e39d6512fdc416916d00d8afe33f
SSDEEP 12288:QyPz5L8ghKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:hzySoHjto1GFxlXutIs1WZX5AR
TLSH
T15275021776F130F9D13692748D931A51F777B43607245AAF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 669394f12203de344fa80659822129a4090a61f5c9ad0f49807559815a56bd66
MD5 92e86cc72e927ab90f541781af2b7e71
SHA1 0012859922198137f956844b3731e813d4a500f5
SHA512 6134d3691efd41e7e85c7152bf64249b3654124c834e7c7477296373f916bf989074a9772eb5b2d22150d205e05f47674d8660397bcdcb7fbcfa65137b6fb8e2
SSDEEP 24576:BTNaLl3z0zDkoHjto1GFxlXutIs1WZX5AR:BTALljOT/M+w
TLSH
T17E8502A5B3A018F9EC67813DCD569916D5B37C1A0B60C66F07A43A2B0F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 120a108de5407f65953c700bcadd9fc4a123226eb8080965c3876a5b7a7b3cc9
MD5 9a06628a2a412f4ae168adc708e5db9e
SHA1 52ec92dffdbf78165ac77565cdf835fa96bd3f2e
SHA512 bdde589f3f0369b8c8f8fb7ae32bd8d91de0b72681425a880ef334ff5c6b50c5cc2f34db5318eca3203c8196f27ce335772cee45d62e67539a0d8cbbb98bd92f
SSDEEP 24576:6cP4mcvIjkGOxhKP2l71nNKbrh/8KBnoHjto1GFxlXutIs1WZX5AR:lP4m4IpOO67W8KeT/M+w
TLSH
T1E965AE2DABDC0096D0BA917485668A4AFAB1742A1F3286CF1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 874759c5122aa589f1490a146f5964faac658a4f108287daa8471f97f7387af3
MD5 ea032e44faf1ebe82eeb10c8799910d4
SHA1 4b01af94d8476b1cf16202aeb24fdd727cbf19ec
SHA512 5158d53cbc4e4cf14462f86fb6586277bb3722abb4861b5eb84d3edb42b53d4f5c0141eceb613085e7c5748e5353f460533e7d999a7cfa55e31747b73c5b3288
SSDEEP 12288:pzsfZhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:Q/oHjto1GFxlXutIs1WZX5AR
TLSH
T1B775F11AD2A401D9D06E6174CB865A41F7337D2647E193DB57C0F93E0F3A190AEEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 97902942e60be2223c5e00de2da218a00a7ab446ec940e244c318176c7183870
MD5 a98f43309e5306c01b328552f19658d5
SHA1 d1cdb8e67cd4aa3ad5ca776dc41b017bfb8869e3
SHA512 c3761ed1fa57d935f36b2a33e06eaf6d5a38aad6af0826b3872fb7523c8a477b9154c2fff32cb92d03821c419f1b1fa132cfcf006f808dbb6c252b675c153d53
SSDEEP 12288:45hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY9N:4foHjto1GFxlXutIs1WZX5ARkN
TLSH
T14F65236399F254C7F67A61B02997A671BC7FB3160E4410FB9B40EE190E3C060BE766D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 19885058e14bdc58f8d1abd1179a8fe3bc9d499499f1375303471c899aaeca2d
MD5 0f6009d6cbd94a401b8d200da45f2953
SHA1 287221b53295894dbd4325aa6ac74c24a98f11b9
SHA512 b116bdc7adaa64350f26946f79fd01b15ca7bbbe168f2caa50183624b05a27c7601d50ffa497c08d483100500b3f83cda85ea24de5c4e0c0fb48203f7bf2ffd4
SSDEEP 24576:OoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9EzwwXg/bdoHjtq:Oa0h2GEkuAe73q3pp46zwwQqT/M+w
TLSH
T1CB85AE1E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 d5248101564053802a5b3486849656847a448c97b84f422b38aaaebdc70b38fe
MD5 29da4553e694b8503e5a8fad8951cf4d
SHA1 9c7348dce5ad65abc12a9e5e55eb7cdbe7844fe2
SHA512 6eae1906d10f1f7c363b255f2318abda1ce4b2e3af5e8f2ae428bdff0e744ed08ab318a279c0900f55f1fcfa2a438bf4d4ca73608f1bd561f14f66f9f46e10e6
SSDEEP 12288:BhbHjfXkhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:BhbHjPWoHjto1GFxlXutIs1WZX5AR
TLSH
T18F75017E1AFD20CAF171A1BC99839606DA32B926171163EF1781C23D0F3B9E46D35B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 3a8cb847a764d39d5f3d282751d09f942fc953f6938338500ad16d263a98ae21
MD5 6767492618b5a197ebc31c96231ced07
SHA1 299e7c2fd24632925aa6d3b3bc79da7587e2bbe7
SHA512 b14f1400cad79667037421413a42f819de70e2d6ae5f53e53a768f2e74e791917544ed797c0cfe2580cae725db0c89ceada62ae87f3ccfa0079059d4a5a33669
SSDEEP 24576:b3YgnJcRTk4yti+R5dBR/uoHjto1GFxlXutIs1WZX5AR:bIgnaTk46pBR/PT/M+w
TLSH
T1D945BF2EF2B910B9D8AAD136450247B5FB71782D1F209ACB0170C538AF1AEE85F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 2352af1df661abfcad729e79b036183511a9711dde11f557c0c409b78740882e
MD5 cc9982434258bfdd14a13dcb4228c5da
SHA1 8bfa40df7c7e3a90211225c577b165b6feda3bee
SHA512 599d96c5acd93a308b19441960848b06344ac4d2a3aa32b7adb88e412549940323726113a7b4aa29a9d955975ef67c2e5474b5c71252f869f9e2fed95ebe1b79
SSDEEP 12288:4FhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:47oHjto1GFxlXutIs1WZX5AR
TLSH
T15C65236298F250C7E63562B02DC76A65EC7BB3061B0911FB8A50EE190F3D0F4BE766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 06fc5dd2b2a9d45d073fd57c4680635e46e016ce5c689088616dbfb277eb523a
MD5 06e158e42b8c497959e42334bd160aa0
SHA1 bf6125b7951714f2daf733bc561da7540066a3fb
SHA512 05644eced07fbf999ec3df4461ff8f4d772b8132dc9c841cf9f692530c3d9e51a8877e8dee3644d1b1a1082859bb91ef30065b901081fc5a341f06c08b6df360
SSDEEP 12288:IObbA4LWOsvAYFT6hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+J:lPL3UTAoHjto1GFxlXutIs1WZX5AR
TLSH
T119950155E6E100F9E97B913CC9A39A12E672B45D0764E7EF03A88F251F232E14E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 e0475f67842343ff18e9bf3e27e2e86c1c75671b79fadfc347105d0db2aaf55c
MD5 60aa6d89df0428f6a9e646ea244263da
SHA1 86e9d73e9bc0a95179c6954d5a3cdb42bdd837e6
SHA512 e2e77aaae22660851acf1c68d7008dc95c5cbc2ed14ea4b76e3f58a688199b18249403fad363bcdbfd2f87c8fc7ea229ac706883a5e6ce43304441aa6b9b7990
SSDEEP 12288:FpFtfOmhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:LOMoHjto1GFxlXutIs1WZX5AR
TLSH
T1C475022A36E910E5E176A17C8A839359D772B466071213EF07D0C53E0F77AF86C3AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1fc4790fb6624c5877cec49c5afa87bed04af17e6260ea2a7d3094a9e3ed3af0
MD5 b672901080cde82c4f24f0559426dd83
SHA1 d95ee41cf617887f09c681cb5718c1991e949448
SHA512 e2bd4c79003b8c42dea132c824fa8069fc0f6db2833ebbbd326ce4739db617a51fc31a51b2aaab1bdf8f841e073ce37f19cee8d926bad26ad5547529f714e556
SSDEEP 24576:b7NM9YqZqmWMUkPjZM48Mv6bEhsvoHjto1GFxlXutIs1WZX5AR:b7cBWMpPjN8DbEhXT/M+w
TLSH
T11D65AE2E6BEC81D5D476D13DC9E28205F6B2B4611B318ADF1162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 70bec5f2d771f27714663c60a1ea7ca11c35647983ae481b4eddd0e512472f1b
MD5 128539710d10bf77192b165412a8369a
SHA1 3186ad8f6c23983b7f6873a9934c8818c14a9da1
SHA512 f5e620a244b0b53eba882dc5d88e0d5dcaa459206628e175415462455f085c9604149e3bdc24fbbd1039a293fd4d1fd6ca9b3fee5aa8ce2884e7026ad93d5a9e
SSDEEP 24576:7W6BApg2YuyuNDYTabvcdvNYf8km11oHjto1GFxlXutIs1WZX5AR:7F2YuHNETovAvNYf8kmQT/M+w
TLSH
T17F858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a3961ffce3f8585546938aeec79619bbff149467653cfe4aab3508d4a1b5803c
MD5 5069c76e78d7735d4fd21b6c076c147d
SHA1 c9ad31331c62f6b7d157ab5aefbc7c21d31a743e
SHA512 27c3c135dca29fd461084df1db6a1b28b8bc69d882710e8e6e0c3064cff610ed6b5a46dafd9df74ed4e332244d6bcc5aaa45fb08a3f4ea65908097918691769d
SSDEEP 24576:JAFs06+Omlf3NXEbToIoHjto1GFxlXutIs1WZX5AR:OFs060lVXuKT/M+w
TLSH
T1ED65AE2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 69e2683b2cc13246228df997839327ba43e18e1a0fa03d483edf19cae247b20e
MD5 34c9d6b5522f5088f2a631df22cff79f
SHA1 2a5848af2b2583d44956668ba98f99f812c7de4b
SHA512 ec6ab38cd6c16200c1475187ad292aeb5558db1d10741fc96cff5ca22f40127579bfe7fe18136f4b82f711d71521c9e372a4d294a29519f9842e91a861068215
SSDEEP 24576:1JnJ5D3WhRoHjto1GFxlXutIs1WZX5AR:1JnJ5DGhKT/M+w
TLSH
T16785E03DD2A410E8D4B7C2B4819A2B56FE72343D2F2269C718B4D5353F12EE0AA79F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 80eead9152de3e513a977ce739018a27c74319ec1a0f89b5fe7c3e9611d13d26
MD5 e6254b4dce4cb44c1f2f203d990340ad
SHA1 54b89e99ff49018758d144e2a5c434470d4dac84
SHA512 ec1d2691b0d4562fc0e8418a115171a8a126c1f518db37f743493f3a87988eec0c88929c79ba4282b8ab021192ff640c6006cc365ff9b0e2f13427bba5a7bec9
SSDEEP 24576:xEPghm6/7IIXdwcXrif7qQncjlP65i3VuuoHjto1GFxlXutIs1WZX5AR:2g06DIKdwc+eQnSt65aVsT/M+w
TLSH
T16B956C16B7EA5294E8B3CAB0C962A5159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 7b8412299638cdcaaba15739f7472459867219584c95a1106fda6ffab3a7d362
MD5 9eda05f0ee40fa5843e855d7486e2146
SHA1 a1c5d1a647a9d0004ef273c41c1d24d94c70869e
SHA512 3a894b705020fc245806d5af7ee8db39b6952ea4840faf2b2bc0f2ae708a686d6a8592c82c8bd0d5dc8b2b3e372ce495e38635cf3542b2d64ab7d2109ca72d05
SSDEEP 12288:mEP3RFzhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:lF9oHjto1GFxlXutIs1WZX5AR
TLSH
T1BD75126E2AE960DAE136A07C59938645D7B3F0211B1223FF4690C63D4F3B5F46E39B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 6fc3b8784ab64da02fec9085c2ea39047a77fdf76d9fbacb2ff17e8ba0a8b906
MD5 086e5d6b03645ec4c4597270873e0f06
SHA1 a5efb45d11f3d8a5bca81612bfdab3c40cd1c314
SHA512 7f9c4530c09fd199a7dccaea6c529954f21b65131ffbce13b60d63edce24a3e6e4cc4e23c6162d377bf17ae5b8871d41471e600c1d1079843181a10c1730c7ee
SSDEEP 12288:sjky0hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:sIyGoHjto1GFxlXutIs1WZX5AR
TLSH
T11875120167E050C6E67A02789EA392A0DD76FD211F1112EF5580FE3E1F3A6E0BD31B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 acd32da441c56bb701078359b98b74bccca03e9592e0ff87ba2d518235c22a30
MD5 51bda5d484524a18280566778372fce8
SHA1 4c2b3efbdfdc90f95f75b7a28db107bb99a95a7a
SHA512 8a9b42e9662a3692b9742769ddadfafa3367700e8d4795217fa8037a3d7383d20fc9d5fb6031fa24d905ee5a77e552396be108fae98cc197ae5f0951275b8258
SSDEEP 12288:PQ2hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:I8oHjto1GFxlXutIs1WZX5AR
TLSH
T12B65232659F260DBF62551B419976B61EC77B3261B0520FF4AD0EE394F3D0E0BA72AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 247bf6062bcca5069b93c26ffaea6afe700195c3f35b3c7ffb025376bbd7f0cb
MD5 d5aef7dd2bcd7fba41904a4cfa7b1f5b
SHA1 44b8086f8904f3d6679beaf5d396467cc7b96858
SHA512 12a428935a13818abacc463f22ea0b15cc55cf5b35e90f3de4bb70c86c8e5c5ffc8026711e30d4b6ee297b6eaa66f2e84a4aaabb343de61da36762254406cdc4
SSDEEP 24576:mQ9MxZKdcz9dw33oHjto1GFxlXutIs1WZX5AR:mVKZYT/M+w
TLSH
T193558C2DABE905CAE177D27595A250C3A673B0311B31D6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 49189afc3ab2719161d1a1829cb8b28e5a1d0369f40cdc1ccf2c917ca436af27
MD5 a097716d22c15491edb22fc67beb5511
SHA1 380f6dff41e20559d2b802512f2efe8b0032fe3d
SHA512 3e0105b4a2864eb5760585a36741ca4e10c866baef910ed547bc1d4c83e25da5d86e40fde9c94104313ec1a51264f0c4016188bb0227504b5f904fe957e428cb
SSDEEP 12288:lyoKo2bRple9pQhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:lyoc9ApioHjto1GFxlXutIs1WZX5AR
TLSH
T18985E01FBBAA40E2E176813C89868745EBB3B0311B6213DB5691C73D4F279E8BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f6601e45a5e9d9f8c404ba44ae7ad6175008c5010ecbaf392069fad3b734f113
MD5 5e0b2466bb1ef2acdaf235afe90aefda
SHA1 b98855b1d43c3a74630fc9ffcd29ce199f49d752
SHA512 f530ceb986649a8b6632674e65f6c712093526ba6b78019b67bbbe2d6354fff7d19b84d9460ea8f87602140bfcc7c35cbf6dc851a3f9be319fcabd2dd35fe9e5
SSDEEP 49152:GWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKbT/M+w:Q0zuNINw
TLSH
T134A57B3DA2F800A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2e0bc74e8fe33e66ed6654bc7047ded9c7f82a9363c2a446b51b56466416a749
MD5 d1b213aa274869deadad017c57a32a88
SHA1 4dbcf02cc5bc87c63f3af1de03674cfe26f33d66
SHA512 66f78205f2b335f0c3f2c702875a4783906ebe69657431b1ef13421c12381cc72dde8afd8a38ee5831aba9781ca8c467434bd20e9e40234de1ab05dbf6e152eb
SSDEEP 24576:o1QT7EcpfxR+N5AWAz3ooiYtjMqb9oHjto1GFxlXutIs1WZX5AR:VTDxR+N5YzTfjMlT/M+w
TLSH
T1F955B02EA7F915E9D1BE85789A23C512FA727821033193DB42A0C13E1F7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 0af2b5a8a9d6a13ce2e17602d2f7055e288a60a8ec5998858fb2f1fc997a4991
MD5 4925ddd189cf08722c67684b87734932
SHA1 3da869e121c8cdab52d82a7da4010980471c87df
SHA512 34b4a856978aee1d0a6bb223d2017a8a1ac3c669c8385f0543f2a7432180c4cc90368622ebd0cb6c358ebe861c27e5592ead54b412d0b704c4236e7928dde1de
SSDEEP 24576:1TMdOz0FFS+0mSLZoHjto1GFxlXutIs1WZX5AR:v0K+0mSLyT/M+w
TLSH
T1B385F13EA7AD14E5E47BC27C9A438906F9737462032166DB06D0C17D2F6BEE47A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 86890576ce0a7853e7a9fc31aca49dc1934bb74db151a35317dee6316b886abb
MD5 c6d4f193545883100f38287032cfeaf8
SHA1 7e891b37777f8e729f1cdce041b2f246c2b9c7cc
SHA512 cd667281591704577d5155498a5437da14aeea7c90a0fb67887a2175f0fce0197d0d5f5bfccdc6da22dbd72463b945651634712a061bff1878d57532b5d89ac0
SSDEEP 12288:9406hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:/AoHjto1GFxlXutIs1WZX5AR
TLSH
T19375221A27F430C6F43292749AA71261D972F536171421FF2AD0DE3E0F3A5E4AE35B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-71-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/792-73-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/792-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/792-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1100-24-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1100-34-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1100-33-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1448-270-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/1768-256-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1856-271-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2064-285-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2096-273-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2132-326-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2132-255-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2372-287-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2372-459-0x000000000D410000-0x000000000D418000-memory.dmp

Download

memory/2372-161-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2372-458-0x000000000D410000-0x000000000D418000-memory.dmp

Download

memory/2372-194-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2372-177-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2372-418-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2372-422-0x000000000CF10000-0x000000000CF18000-memory.dmp

Download

memory/2460-102-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/2460-107-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/2460-253-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2876-286-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2900-431-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-450-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-444-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-445-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-451-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-446-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-432-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-433-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-430-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-434-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-429-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-452-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-428-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-427-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-442-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-436-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-453-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-426-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-454-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-441-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-455-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-443-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-456-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-457-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-435-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-440-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-439-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-438-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-447-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-437-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-448-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/2900-449-0x000001CA86400000-0x000001CA86410000-memory.dmp

Download

memory/3496-118-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3496-124-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3496-257-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3580-417-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3580-47-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3580-41-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3580-241-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3616-135-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3616-129-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3616-258-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/4076-277-0x0000000002C50000-0x0000000002CD3000-memory.dmp

Download

memory/4076-17-0x0000000140000000-0x00000001406B7000-memory.dmp

Download

memory/4076-11-0x0000000002C50000-0x0000000002CD3000-memory.dmp

Download

memory/4076-18-0x0000000002C50000-0x0000000002CD3000-memory.dmp

Download

memory/4076-8-0x0000000002620000-0x00000000027C0000-memory.dmp

Download

memory/4076-260-0x0000000002900000-0x0000000002960000-memory.dmp

Download

memory/4076-276-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4076-6-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4076-272-0x0000000002900000-0x0000000002960000-memory.dmp

Download

memory/4076-0-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4076-247-0x0000000002900000-0x0000000002960000-memory.dmp

Download

memory/4076-294-0x0000000140000000-0x00000001406B7000-memory.dmp

Download

memory/4140-243-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4140-89-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4140-95-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4152-32-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4184-85-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/4184-79-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/4184-288-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4264-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4264-75-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4324-254-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4696-142-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4792-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4792-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4792-295-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4864-242-0x0000000140000000-0x0000000140199000-memory.dmp

Download