e85ece7f3959d62df7a5d3a59363ea3a75e177d8dbdbd985fcf02436cb0d27ba

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 6.4MB
Sample261029-2htgnsft7v
SHA256 e85ece7f3959d62df7a5d3a59363ea3a75e177d8dbdbd985fcf02436cb0d27ba
MD5 9dbb3d1c91d3d79fabfbcb744cf73de7
SHA1 085a750f93af92821a4b485accd5859d58e1e215
SHA512 17f5c75e4ea88bccec1e440341d0da8b0ead752f9ea20a5772989d23d577302419815175ceda6b3e00713dfa037c61d6a072f6e186b6cd4c6c62c29d69de29f5
SSDEEP 98304:Qf+5INhrKmsxFM6dsepXd+3Ps1PvQb6Y+k:COmsxFM6aexd+/QP9Y+k
TLSH
T1CC667C5663F802DCE0B7C678C6264A13D6B2BC165771D7CF1264956A0F33BE18E39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5644	alg.exe
3748	DiagnosticsHub.StandardCollector.Service.exe
2640	fxssvc.exe
5648	elevation_service.exe
6132	elevation_service.exe
1396	maintenanceservice.exe
3724	msdtc.exe
548	OSE.EXE
1508	PerceptionSimulationService.exe
4412	perfhost.exe
3864	locator.exe
5832	SensorDataService.exe
5636	snmptrap.exe
2448	spectrum.exe
5232	ssh-agent.exe
1472	TieringEngineService.exe
4296	AgentService.exe
4492	vds.exe
208	vssvc.exe
2468	wbengine.exe
968	WmiApSrv.exe
1328	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7e0d815e4bb6346b.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095ac7fd7f567dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e59745d4f567dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000319664d4f567dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbd90ad7f567dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8412dd2f567dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c505dd2f567dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006158edd7f567dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000311e2d2f567dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eebdb1d7f567dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3748	DiagnosticsHub.StandardCollector.Service.exe
3748	DiagnosticsHub.StandardCollector.Service.exe
3748	DiagnosticsHub.StandardCollector.Service.exe
3748	DiagnosticsHub.StandardCollector.Service.exe
3748	DiagnosticsHub.StandardCollector.Service.exe
3748	DiagnosticsHub.StandardCollector.Service.exe
3748	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3788	2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	2640	fxssvc.exe
Token: SeRestorePrivilege	1472	TieringEngineService.exe
Token: SeManageVolumePrivilege	1472	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4296	AgentService.exe
Token: SeBackupPrivilege	208	vssvc.exe
Token: SeRestorePrivilege	208	vssvc.exe
Token: SeAuditPrivilege	208	vssvc.exe
Token: SeBackupPrivilege	2468	wbengine.exe
Token: SeRestorePrivilege	2468	wbengine.exe
Token: SeSecurityPrivilege	2468	wbengine.exe
Token: 33	1328	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1328	SearchIndexer.exe
Token: SeDebugPrivilege	5644	alg.exe
Token: SeDebugPrivilege	5644	alg.exe
Token: SeDebugPrivilege	5644	alg.exe
Token: SeDebugPrivilege	3748	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2912	1328	SearchIndexer.exe	113
PID 1328 wrote to memory of 3464	1328	SearchIndexer.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_9dbb3d1c91d3d79fabfbcb744cf73de7_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3788

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5644

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5268

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6132

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1396

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3724

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1508

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4412

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3864

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5832

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5636

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2448

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5232

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4424

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:208

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:968

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2912
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6f792b381c1a0e7cc6086a076f58dc08740d61ca3dfed4f0f6ef18f8afea5ff5
MD5 dd92b2ddbdc19d169b73c1a136c39956
SHA1 b3b295c4f8a1d31c41685586fdaa73057a172367
SHA512 c35a3ec356919639ccac077a314166cd2c8f6eca1a969d375b637101d4f31cbf37161286366b020b616ff4789c64b6d4a9b086a941a8c674e478d3572c8648b5
SSDEEP 49152:Cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn6B+kn3Hnx:k3q6sjBd+k
TLSH
T1D1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3194a28afdc16e58e71105bb9a2e771a1d7cfee244969363216e8b4399540d74
MD5 9b7902f78a088edb457711a2a4c8d068
SHA1 17de49d978de1b8e21ac51ee7e580dd995578a45
SHA512 be4faa417a5b4386d6c944d21d76de555044718c02be4e0a40c1748126ab98f26a92bbddb866adf3946e30260d78edfc01132bca15d5bad310142e1865c825a5
SSDEEP 12288:Z1XLsswWkxy2lRq2czA/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:3XYfDtczAENyBo4kx929bL3Hnx
TLSH
T1FA65012967D409F9ED6B927CC8A28511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9ee40916f500137531a9d1f2f1e2c811b3a73a38479b810b50e973d9f359a605
MD5 21daacb0e436315cd7ab5c645564ce7b
SHA1 8cd1182981eb3542682739c47016d40dafc3f3c2
SHA512 38cfa391b8a8c2fa8dff2d1fb423af7959284df7171495d96aa444849333464f2ea65406398dab0bd373df0b1dd92f456260fba1e152756ccd028b58426482d3
SSDEEP 12288:dXZNYVLeyUji0h90ZD0wxpGZIVuFrHs2LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:z0Le5ji0hmxWrMVNyBo4kx929bL3Hnx
TLSH
T1F5859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a70b74ac161e7c3a597358f1fdbc3957e1948970a610b5494a933e6ce000079a
MD5 66f2a863fd22cb98b23662403b99f5d1
SHA1 2846c42a7b62eef88642000c6a014edf7f571a9f
SHA512 c2178f7ca77aacac520510cdbb320f72761a49a38f013bba784d582f712a33d70f33e2417069f680e7fd6895c8340582cee2a68c1e0949beb4eb3601750f7fec
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWn6q8wyu/NyBo4kx929bL3Hnx:r/ezSC6vUzPveHjydB+kn3Hnx
TLSH
T155755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2d24ef363d32ca563543fabde0a5d2454f2528012f91f9356f5281ec22cd856c
MD5 f674dcaac4326071a196de6661afe8b3
SHA1 c1c2cc1fc50ce9ad6f127850a5f6de506bcf6981
SHA512 51f81ea2679ae9428caa516af2d05f066c967b299cdf56462d750a1eac8fa4a871cc024b6aa3208a989ef200f44c0706c4112d398ef3f0c52445938aaeca99fa
SSDEEP 12288:+VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98bLDAptNyvUgXZ32dT4ePc7N29CD:+VbqPb88hv/l+Y4NyBo4kx929bL3Hnx
TLSH
T1D5559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 928732b59d6bcfa317234c1736320513d8d3050bb9ec144df0d82ddd942553a0
MD5 190c382d463aaab6d2c14b3b0b969ea1
SHA1 f5b34030bdbeeaf3c533d3ccec974954ceb63961
SHA512 6100042366b0df7aea5cf20b4c38ee1e7becd231eb4a4d2b2e9f4e59ae04988555a0e8ec6823d062fd6521f25ff0f83225930e9d724fcde85df145a90c77aa6a
SSDEEP 12288:jxCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jxJNyBo4kx929bL3Hnx
TLSH
T1074523134B0C627AFBBD3E70759E8454CC35BC890D95DB98DE62ACBB48BC992DB21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 bb9fbc8ab21a88c9006cf3923bc5ead86bdd66793b4e148b9f77f1f0f54cc69b
MD5 25480e1b14256f8684eff71e6d372dad
SHA1 879b69dcc53b12c176e5c4eafd5a39b29b305b2b
SHA512 2d109934ba73661107709205a2f0ab57e5d7522a9e3176a4e1f91ad291d17ee5ad200663a222433de9aaba99d2e3c8865898f2bb771fd5b5b55260d095dedd35
SSDEEP 12288:HeBNUbTVO86UDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:HJIUQNyBo4kx929bL3Hnx
TLSH
T14265CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ab3c43a43bc7d403ad1dfd2b9850801a2bb1354995d27f5d9702c7cabc3b3b4c
MD5 086d373cba7f867286d400b3307adc77
SHA1 74445c8430804c58be053c8242fa8a6bda76c343
SHA512 710fde8e7de7fddfca627dbd42047d540e23229bec6ec0c395d033fc84b10c19a428ff733e023b867964e7c3f3e9ebabae87165eacd7e4b271eeba42bd9008e1
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THh:/QvGAdlCEL8c/DRNw5Cc+k
TLSH
T166266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ad48724131992e4c693ec52e044340e63c70f8ade4204f356731a0cb5656538a
MD5 48cc9b0b41b3a09e5495d101a4626204
SHA1 7e3ee0022b4a4da64c1f7835c7ad66c7ba12e276
SHA512 de6807d32077d3c96369734f27df10e38169a1ff971df0ca139e58b5f7d352b72c0c2af90f978776eacf4b9928c72e11d8b7efd8d50a44d910e8f61630d4a9c3
SSDEEP 12288:DAwSfxL/2Dc3nDLLmt0LDQewsAjlLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:8eewsAj6NyBo4kx929bL3Hnx
TLSH
T10575E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 06db2cfab282313e2cd3e7eaa5454c7abd417425045764c47b772cdd082f1d69
MD5 7b4452ab7f7096841c6f2bcae4d4f329
SHA1 60082d58b05b19d4554cc82f291f5b4d4e3b2d6e
SHA512 0fb3bea3458f9206cb52b2605367764196d31ae5df6d7fee0575d2b5180109438da38f40ba0a03767f1e94437e9e2eb95deeb0d4863da96a3d109f9d789f65d3
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHn+k:jUEtQevvqc2W1cpV2tI32n
TLSH
T18D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9b60bacba03e238b01073aed5eae7d00a85de08c1a86bb08ba24cd577208db62
MD5 65b29743249e84ee6dbfca12ebf1eaa3
SHA1 aef8dc383ca976f71578243a5b8b6f4cf41f6095
SHA512 0484fdd5d2e97179b9191d3964499f58e6719850e7d105796dbcb9b2655e97f80b91d9c2ca4f85e6194ab2f372c4b8144f3fa3000bf75c95dbd6f1b37c2551bc
SSDEEP 49152:uCbRquA/m2yL5zTfFiV+XenmE3/zJB+kn3Hnx:DoquVjnmo+k
TLSH
T148D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 54e09a236896e3295412bf66a21201b1250d7f27bbd6d502e992b97d0af619b4
MD5 32b76938ed19b12f960e03176e4cbfb6
SHA1 85c31a9d0ce78bdf415938c518e157475a1e258b
SHA512 7a6b044e88eff9a880444521ce0baad6b2c4ee977aa313bb164369afd7347b8754a67eac104b537fc9a92e083af7a23e1410d9c860355629a82d19af3b16bc31
SSDEEP 24576:cAhGL3IFoiwtA5l7S53bNyBo4kx929bL3Hnx:cAMUFoiq5kB+kn3Hnx
TLSH
T10435AE81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4296246417a09fb1a8169ef7913ed2556d2b269c17e9a20f5fc73c64587b75e4
MD5 52756de111a8f770da51d1e05d8f7bf6
SHA1 2df0d805b03ec0baf5abd588ffb61d0e57966159
SHA512 e55082b979fe5b5122ff506c54be6ff60b470239213c6d04ddaaf0a0eb3f1d05180f9afadf9cf297403a806d2099cb3beceb686fbb276153e1de25da27027436
SSDEEP 12288:Amw5HEjsChNzBFgl0WDm+CgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:dwu6OW2NyBo4kx929bL3Hnx
TLSH
T14065F10677A81CF9F96756388587C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2fdacf65527cc501846e0d44da26d4a3c69770a8914aa93237cedc275d3c0297
MD5 e4a90e25811b962745b32fab2b8343c0
SHA1 86cbf8260fa2c8ce182b04fa354208a86eaa3dab
SHA512 55512e6d607db6165044cf03ebf9238056de93e925ffb154e2f545d1ba6859871b71324fe3009d35bbd9439d34db67b4b5f95a973073cde36ca0f55fce5b5e96
SSDEEP 12288:VgZ1Iy1LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+ZutNyBo4kx929bL3Hnx
TLSH
T1D9551216239831FAF2AB2678D8E58644CB32BC461B7183CF5A2145BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ed45e1656c90eb9e9db5ca4e3cc506c25c90fab01ca1a7b5dac6a18605905512
MD5 a7a3075bd42d971ef6e6db777ae23067
SHA1 2c4a4c95ef5e21fd9f939cf326e465136009ce94
SHA512 263957aace51022caf437eb7c23fba8542373d63d57e51b18d6a85184e2dca8135eda954a340ed7cc91f540168c2d9c5f7cfcb709bd760a5715ec071c26fee5c
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ut:yQRQyi36YOcPbLvw2gAf+PN3B+k
TLSH
T18D666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 85c4c68374abb87ac9a61472934d6b392b1ac5e1fc67f1218884b522f8bb4442
MD5 3d7cb4cfad1ca1db0db4fcc96a6a10a0
SHA1 f8e9aa1bb4f33ca9af9bcb72fffce48493fac38e
SHA512 5e7a92c301dbcbd162dd98a8f0dd5582c86f59ce0e243c08e9f3f71ce9a56dd3982660112f12cdec6cf7e65050b6f7f804ce71b41ca5a533d9fe5eaadd1bd0af
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ut:4QRQyi36YOcPbLvw2gAf+PN3B+k
TLSH
T182666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 befb17570fca6f38e89b236519a7aa2d0d6b5beea3b998416021e013ac806a36
MD5 21ce0f818490194764e2a5eb92c2b7ee
SHA1 770f59822f15b6a63ce3673c1c89d97a17c7995e
SHA512 256f18c5cf108a2b25c49c6100314722030d75c4e7952330c430fffe82a052057da91da3e54f3bf4c467c7a80d00aa4a512cab6c1daa078998e6ca44402f7535
SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL09NyBo4kx929bL3R:B68Qg55nhceWu7PNU3/ZB+kn3Hnx
TLSH
T189B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7a2e072bfe3763d2996ea40fa820734746f1b7246858afbd5701ed98fc964643
MD5 9e39eb0006fe15e41077657a61b2197b
SHA1 72ea2d2e53c928c3a9db006e57f81e15df3d878d
SHA512 780a362293fe34522b42ff4ea46dd7adbb55e1ecabed1251c607b0eae7d39d8bb6f79f007f3b7dc97fee8288a391997ae1d19576e08a18e9fd5ba086de6fb331
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99H:Yy5112gYy5azzVvt69nLKnhZu+k
TLSH
T10E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3adf54f4ea81fa1f427a38f62dfef4519d819a672005813aec55b5cbc84ff25c
MD5 78055516ad43d3f9ed831df0900c9224
SHA1 c708176d9abec2e867b83dedebd860a742d1ffec
SHA512 f761a81efb53c95abd61c53b595c7413c11258d504907508e7abbbf2be32efcba186c45e294344deb873387ce4e22c0b71d6d5c76221b65ac36d9b43d1890676
SSDEEP 49152:7B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glvB+kn3Hnx:tu6Jmdxd2d5+k
TLSH
T112D5AD13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2e5e58376d11896a207b1bfb6eb0e993545d37eeb07cd5343276e0be4f1b5546
MD5 073d96c4f354c3e3400fb501ed465af3
SHA1 d6bf7325ec3c6fe0b67006cf728b251a8c9885d1
SHA512 866d8983d0f80e829759a2bfa275fcea33aacb756074ff2131440df51bdcbed1e636ede2559fa15fd47c57ee5d5fd79059728a98586ccc4eed4f7bbfb6ed32cb
SSDEEP 49152:I1hpsNoJpF1A63U44CwH7R4xDB+kn3Hnx:ImifPWRo+k
TLSH
T15BB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e7058e1f5c64fdffa600dfe3abd377c7f18237cb3a573843672832f2725a0439
MD5 f6b5c05f17a697e3f072fd59e57b53f9
SHA1 474f93a003a0b08de518676b714e32e8aac68155
SHA512 150aa97a1e160d2c7a802fad217cda3717c0dcd971a52956c754c30f52d06e9548cbda6632bd00ef227fd1a274d1d86f360809dfcb71055beb28077c6158193b
SSDEEP 49152:uSuZQIY0Be2KcRVtOnks6NMHqKB+kn3Hnx:g5dKii61C+k
TLSH
T1C6C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e14c2c2d9b6f868b79f3eb1ec5a578a3bc9ad26ce3e14846011af12168507f64
MD5 c485021020f4aaf9b825a29e686f042e
SHA1 6ef2679a958f2844c0d912495e2d97305889fd89
SHA512 4ccc4db4e9f1f41b3dd591a2d8a7bb365db42cf85645ef730142ce9ac755aa8ed1cef640a131b26e6c4cba0fa37ceef5beae64e5233acb9a131315ebd4027e04
SSDEEP 49152:OhtSn8EApI0fig3giDn0AP5w/B+kn3Hnx:PX2imphk+k
TLSH
T16495BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4154497d6d86de1824c962b91eeee16e0034db9e6bf3099b27006d372b36c5e3
MD5 6f6dc5eb42c98a25d3375605ae586e14
SHA1 86188ac5dc02cf85a8d0c676a1396f93417f77bc
SHA512 f5f12c06620547a346f1ad0618cd35d3227f8f85092fa64a63c2327483afac1deac731506b8ed6dfd24ec16b2b626d2a025d6ea2d9d81104f5157e2f9f9a0c26
SSDEEP 12288:oKLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:oBNyBo4kx929bL3Hnx
TLSH
T1414523125A0C627AF76D3FB0A44A8158CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2e0d5498342f920b998b6954fe56d47b8441dd8e0dc7674a533da17638b7e493
MD5 f420940c89e1e5b3e0745576734c369e
SHA1 d66d6b08aadb988b6ace89f804fb7b783d3a6d55
SHA512 01771ef6e497a0f186a7a13068710bf5910c942d9a510908fd241bf452d722d40e3cc89d936119085da220d30be8301c50d35282a08eb5b932b2b5b879feaa63
SSDEEP 12288:WBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:W+NyBo4kx929bL3Hnx
TLSH
T1464523125A0C227AF76D3EB0654A8098CC34BC8F1E9597D8EF27987759FCEA25F21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 261c534a8ca94c573f502f0be500c88582dec3b0f6d0c8b3b68906b5500fbba7
MD5 8843ce991c0962dc11b61593bfe835c3
SHA1 fafcebde8335de675cc525f960dbe9bc15edc1c3
SHA512 e01bc0560d33fa1588d614e2781e898c15f1a52a551e8dd895627467a7ce203970367bfe923675f3327e614ff8b815f312d32f90e3b1144aa704e882fa122fa6
SSDEEP 12288:lLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lINyBo4kx929bL3Hnx
TLSH
T1874523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 68eec772db53b09ee58582e003b59166cb5186c6b932f1232d177216940f8486
MD5 678aef482b5c8afd91a9e3ba7aa25f78
SHA1 a623e7133a1dd74b641939024a7804a400051a25
SHA512 735f8c9066a86b5dfd6657f94469cf8e5c0950ab6d518368ec94fb5688db10fc086375cfa9ac7969faf048225d6d2983898b2846228cdee451ca4705bb510bc0
SSDEEP 12288:IVkLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:oNyBo4kx929bL3Hnx
TLSH
T1885523025B5C12BAFA7E7BB0D85A8054C835BC8A5B7197DFDF1248BB0DB8B915E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fbb9c538f9898f707d715688b0473fd136cff16f8330541cfe36824026e0ea90
MD5 a4df928269e170eb437f6c3d6088d83b
SHA1 533abc7f0f575a34897a8819926f91430f42345a
SHA512 745d930312ec63447cd54b03cd8555a6767faf2aacaded6db7f18e59c2603d33d3c73a56fb64c76a09627eae81cea8eb1f402247d707a17350987356789a0b73
SSDEEP 12288:/cLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/DNyBo4kx929bL3Hnx
TLSH
T1464523125A0C627AF76D3EB0654A8198CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 760779181e6446215384badf119bff78c70d8fb777b6d51e9ef0b3f1d9a2b6cb
MD5 b513b75bb3eb785bb09c411be6cbc2e2
SHA1 736c106ed3396fea060101943644939c0cb0872b
SHA512 7dcd1c9ca4100b2622e6639ad25cb7f5a33f48718fbff92a19b7e3fd93c5125aefaedfbcd67df5ab65f40a62c68633d92a53744955c9feab5490576e8f7d9aa0
SSDEEP 12288:QtLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QyNyBo4kx929bL3Hnx
TLSH
T1234523125A0C627AF76D3FB069498198CC34BC8F1E9593D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 80b85c68004929d0f7323e066028f63d3c5140c4e8f9d94af939495d6faa964d
MD5 6003eda5bfef78decd84c062ac7dd5f4
SHA1 7a8e0352843c9247538b7921c8dab28b97d37638
SHA512 629f76a26d723c169576611e8d9211bc9ae4c61d6298cb5452ad995db14e640594c6a4353838dd7b3dec9e96ee97488ecc6c2d7e362aeec01c70b91c7b3b17b9
SSDEEP 12288:9ZLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9GNyBo4kx929bL3Hnx
TLSH
T12E4523129A0C223AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3a05381addd655a222f5ff8909cbab62ffb9538401c2888890e6634367c075f2
MD5 e344fa10535aae7f6062dbd0b336bd54
SHA1 4cca8f634901bfd320bb82e7bb847c0027b30091
SHA512 d468851ae4269637fc33271a8b659fa5c6d0a6ab9c515b7f831219444da1630d1bd25f91aaaacde8ccea376778b8f411265aa60f33b7580597b74727cc33e02c
SSDEEP 12288:giZwbjzzFEoS2cPvyhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:jZMXzFVSOeNyBo4kx929bL3Hnx
TLSH
T145650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07A4367B5F773A10D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 32121e25335672e0205bf24070ff45caa89e4970916cfcd84d3cd665fccb2712
MD5 0eb10ab02ef42321fb96a6dc9138a4be
SHA1 5a03bfebc58e40380a0446f00cf6230f9d5c29e9
SHA512 b7c2dc82cdcd8530e82553e7e3e775e9c6e8aa7e6ef18cee6bc9dd14289658bd687e1d0f861a1792026c655d541725361dfe5f93fe8fc1ffeededfcf51ae7507
SSDEEP 12288:iuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:idNyBo4kx929bL3Hnx
TLSH
T1764523125A0C227AF76D3FB0654A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8a7a1a1cd19ec3a9747c04f47ca62de8ef5141ef2bf1f3667a14f7b3fcdf4431
MD5 9a09f6d610141a091f729adc270b28a2
SHA1 966cdb96f65d77dadd405c0d0a0d43e6533a7762
SHA512 6b7a4e52d9a9813f0077c36ef49b1d915287442f4a6e3d30c81ae6ed104118aff3d49fc69c086367e61f0f062327ee406f617f90a1f705fd4521c3b9d9f42c4f
SSDEEP 12288:9SLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:95NyBo4kx929bL3Hnx
TLSH
T17C4523125A0C627AF76D3EB065498598CC34BC8F1E9593D8EF27987759FCEA24F20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a332de0007d80626d8dec7876fa32e2186ded3a3d494e6f0965b516299984731
MD5 b28cc78b41b3c5aa6949431ca7d0534c
SHA1 9fd91ed64fa96ec947b7e8f4738457d7287a1ec8
SHA512 f4a439ead08b9a5646d58b5deba932e29f5203c36213e9fdeab5caa6b6c3a65fadc34e8690cc8ed7ee176a6d1a4e69f5784fbd20fe99540564704993c9945bc0
SSDEEP 12288:LyPz5L81LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mzyqNyBo4kx929bL3Hnx
TLSH
T15B55120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6b6b17b8a964dbab19e65d8314ec37693088343e69aa6c708e75623867eb1a7f
MD5 ae327f4a9993981db9c8db5223b3feb8
SHA1 9f53590ec9bc8fbcbfadd4b0cb235336884270e7
SHA512 b92d02be1d60834b14ef66db52f9ee54bf8041e67e41d7d505dcf15fb3277e450c668e187373754ffc0065d4a86e5859ae2b0b06c19e7cc05eccc73e402fb79d
SSDEEP 12288:puLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:pdNyBo4kx929bL3Hnx
TLSH
T1804523125A0C223AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ff3b46d0eefc3e1afd90fac8349ea4c8f9efc59cb129ab4055d9a7c4ff627eb1
MD5 f5777b266131cc759d675fba7a40f4fc
SHA1 cc4f72fda12c6bfd362f2f5c6528f6645058b84a
SHA512 9c523e89b8c47ed80d3d4f268d8ec00917c8540bab8e1798f78bd78f3542762ac890386ad469322fd82461e00306fb8f6534d268b83a20ab246c5f93e6ae097a
SSDEEP 12288:WuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:WdNyBo4kx929bL3Hnx
TLSH
T1724523125A0C227AF76D3EB0644A8598CC34BC8F1E9593D8EF27987759FCEA34B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f21cc34e5e17af2d619004c3d65fac31e9daf62998135d79e98336bd85b1aa26
MD5 a64ca5dab9ff1f40484de9454f282d72
SHA1 a9afb39ac3bbd6a50822328f8b5bf1f9f0fe3424
SHA512 f48e2b5e1a26342eafae0eb06536c19831beba2f8e4962160bd3ed761add058dab2d95d6447b5781afa2f854c025ee253afd2c1287af31bd2b4b792ae3657f3b
SSDEEP 12288:EyPz5L81LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:dzyqNyBo4kx929bL3Hnx
TLSH
T13655120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 6f80018b7983d8c86152a512c32d3fe450224849eab22a41ea39d3586a967827
MD5 179472e2949c7ed9bc3d9d3dc0948e78
SHA1 16b1ebd461bb1fabcd0019c46baff57bbaeab6ca
SHA512 c56960fd18168a3e898d4fdae0adbf33d16f4ad26194e76c8819fb55bceb07c402cf7146e4577450bc5d848393e2473b348af1c08d46bbe14f49dbccdcb553a3
SSDEEP 12288:eCd98WYoaLHF3z0z04PDvh7LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:PTtaLl3z0zDYNyBo4kx929bL3Hnx
TLSH
T1076501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f3378e3ad15d187e0499dcd96bf5c515c161a9b36a907f810b031a3aeda5b4b8
MD5 124ea27b6c69cb975274a5f4e58d9a38
SHA1 47263c8bc5e83808824f7f9b824e5d0c77fd31a5
SHA512 32c5d4afd6f8827d559abe65e95c14e9df8060fab58eb31e72fb3e9e9b940ba3a70f7afa3b96959e072d5267ff3c306616bd2ab60e477a9df2fec6dd74f5a91b
SSDEEP 24576:zcP4mcvIjkGOxhKP2l71SNKbrh/8KBlNyBo4kx929bL3Hnx:IP4m4IpOO67N8KgB+kn3Hnx
TLSH
T1D265AE2DABDC0096D0BA917885658A4AFAB1742E1F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c4ee5a5e12465a174a01c01228eab1083cae50b7484b0568a01007044ca43278
MD5 7690e94509948f3eb1b1628f8bc2f390
SHA1 37b06aadf248bede866b6f6aad11e4e132a5fb05
SHA512 18cc7423085fe9b19c52a7254656a36df5981d4741c06f6353179f75625f3a0479a320909315ed9a2fa6de70c220875daa29c4eca8cc7df2eee6ff6357d4244e
SSDEEP 12288:A5sfeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9tNyBo4kx929bL3Hnx
TLSH
T18155F01AD25812E8D16E2274CB468A40F7337C5947E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3089ca18c133500b90ed857c6600582f15d05e34b4aeed47fa655eb079dfa5f8
MD5 bec73ba7c5f01496ee8bc967608d3de6
SHA1 731260cf756f9f595ceed43fb3a3328a964a7b19
SHA512 7cff123b5ce64685cca18718dbdbcbf70daab1e7515d921491a69011565107a9313019dac0c3508dc59f5befb4fe195b9704625ddc40905e005ac64ecb36ed66
SSDEEP 12288:0+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:0NNyBo4kx929bL3Hnx
TLSH
T133452312975C623AF67D3F70645AC024CC39BC4D0F55D6DAEE1298BA59BCEE29E30207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d628c2df7bffa023f63c35bc4fa10ff10fdd90552bb9cdb4a22d2318650f9b9d
MD5 537a540694dbd3e74e14f58bf1a90314
SHA1 f338634f5677c8633f8c2ce8a28392b16e89481b
SHA512 5b5bf44f6697bf857df25ceb91c6bbd44bd79ea70479b7450ce9f2055c9d79ed5d76c2067e2d316b4047e699d546789372d0650de8d681724848ac4d6eacbc7d
SSDEEP 49152:La0h2GEkuAe73q3pp46zwwQMB+kn3Hnx:La0hNYG4Jwn+k
TLSH
T10185AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 4d9ceb119aace743573652dea834121025ca51d60e4df7d7155c56c529429a85
MD5 10cdab1b794554062fc14d80b57186ff
SHA1 a705394dacc910931fd3320ea8be7caf81911bb8
SHA512 ab8086b2782dcb08b4387d4750b0bf807db71f00f6806730bcbb949d5e8b0791d0eff0dc1abbcb786567b27ed516ec57e0303523c8bc6829b2671ee58c2ef5a0
SSDEEP 12288:9hbHjfXxLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9hbHjPONyBo4kx929bL3Hnx
TLSH
T1CF55123E17AC21A9F275B67C9546850AC731BC1A1B2193EF6792817E0F3BEE10D35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5dc68fe17dabb123c1234b35860ad885418ee4d782d60d2d0cbef0249a8d922c
MD5 c811c07986e04ec3ef35c351960950f0
SHA1 0cf0da723bdf5b306bfbfa1900dfe0bfb1808253
SHA512 15b602a5189f3685ce86fea0df9bffb16d5eb394570f042df7da56802e98abbb3ff491d194e324a0326d426b94c8feee0b43d6abc4ef3eb3bc6c7942ba36fd84
SSDEEP 24576:H3YgnJcRTk4yti+R5dpR/2NyBo4kx929bL3Hnx:HIgnaTk46ppR/9B+kn3Hnx
TLSH
T14745B02DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 de45dfa56bc3b4e8a97ad2b18a829e20e6cf2b42a6cf005ba8e9788303beaf73
MD5 3de5894833ef8c139ed020018a8ed311
SHA1 2ac29d5aca05295ab8d72bbdeaab3c7985fb155d
SHA512 ede857360127221b13406196e51b05d34c6c242e4ce27779b349db18e2520c27e55595bf1c7d733193d697f0c07dbf896d499425c92018a51654f6d9a19101a7
SSDEEP 12288:4iLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4pNyBo4kx929bL3Hnx
TLSH
T162452312560C627AFA7D3FB0644A8558CC34BC4A0F6597DBEE66987B59BCEE34E30103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 db7c8babc334d1aec7f8e132a7e5301f6ffd8ee917dc1ee053ec5df3512fe8ae
MD5 0f5a409dc5b71a4170ad0224f8074e17
SHA1 a46086de2c3d009c558545b79c8e8cc9359a47c4
SHA512 f7234ddfaf1d41f77db16aafd6747cf88172206e758d986d38d71f8d201f63cc08f7e896b883f24ad15afbf7ef760f1b4b5c6133ddf952873bcd29fad2be66e6
SSDEEP 12288:JObFA4LWOsvAYFT/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:+xL3UTENyBo4kx929bL3Hnx
TLSH
T13A750115F79800F9E97B923CC8A68916D672B84D0764E7DF03A84A661F637E24F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 c5471a83368b2bb8681d54f47f67dffa590cdd30b07292fd8cb8eaa25d8208f8
MD5 0c2bd52bdad090fafa6554248846afe7
SHA1 f3e45587f3c8e21dd2e6b052e807e315f900110d
SHA512 37f514edd88fe0815a77fa10f57f5469a7ef8708469a4cb20d623fd17caeb91c1bb08c5529fe1258c8dcd9ed84ebc57cd4a952fd5eaf8990220c3c8cd82ed606
SSDEEP 12288:dpFteOjLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yOwNyBo4kx929bL3Hnx
TLSH
T13655011A369C20F9E579767C8986820DC731BC560B2257EF46A080BE0FB7FF85D35A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 14371310f5a62209ad5555344bbb299ab3a423faf0c419fc88f6efbb7658f225
MD5 bb2d9f763dc041b622419f8d7b4ec6cf
SHA1 62adb09b38bc7f963117e0e1c3b910472c7fb8d2
SHA512 2d425719ebeae5fa99ab1b9dfd0aa75d084017c4778f4bf791a6c7182cdd9e779c7907fe71f14e6addbf66ea9f4d1f1f0ee12eaab20f3734f637ad8cad804eac
SSDEEP 24576:X7NM9YmZqmWMUkPjZM48Mv6bEhsdNyBo4kx929bL3Hnx:X7cBWMpPjN8DbEhFB+kn3Hnx
TLSH
T16265AE2E6BAC81E5D477D13DC9E28205F6B2B4611B318ACF5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b9cf446dc727ea5a666272dd02f93ba470ddfb5e0222bd9fa3e6a0e73cb09412
MD5 e8b9968c6c58c2704e6562df6b2a5bda
SHA1 60bd9c89bca0fe67bf7cf5f1bc79365f3391e1a3
SHA512 bc15101017fbcd4feff6a87015db1c776e72834c6925e04f6bfbe719bd3d5b5a8e58b9e006605deed77ccee777aa72e0ba4e391e810a7f9f2aae84cafcd7ec55
SSDEEP 24576:FW6BApg2YuyuNDYTabvcRvNYf8km1HNyBo4kx929bL3Hnx:FF2YuHNETovcvNYf8km6B+kn3Hnx
TLSH
T18E858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 171ce1fa2715b85940cc5a805a98f8cf9dc348a84fa88f6cb22831fbd4bd6628
MD5 182a572ced82df842787ea168464393b
SHA1 b6c2ef322f9b8eb7dd36e5ffbebfac337e5280ab
SHA512 f8390f1da70aecf728b55c6c8bffe9bf38ce4e53cae3c46a479f4c7c68f6ec2609c53fe4b210f7202f4639f8ca1e05a871ada852ccc06b89224e90a0c3f570e5
SSDEEP 24576:5AFs06+OmlfkNXEbTocNyBo4kx929bL3Hnx:+Fs060lwXusB+kn3Hnx
TLSH
T1DA65BF2F62AC00D5E07ED17D8997C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 8964fcec1ef9bf90447440c233a91793a87854ea39f2dcd20a3d7dbc01e233e1
MD5 5dbb7ee2dc6d125cce49c3ac5109e4a0
SHA1 842fd2a1ee976cf3b035d89964f8f294d9a8b371
SHA512 d515d9ca993deb7f54459c59dbeca4abb4db5e29775eebe3ac9783bfa25d50844b0bee63afc7c93831f1a1d699778e80d5705ac288fa74e4692624c3a66d9b22
SSDEEP 12288:ECJnJ5D3VkrazxOLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:pJnJ5D3WKjNyBo4kx929bL3Hnx
TLSH
T1C975D02DD2A810F8E4B7D2B4815A1755FE72386D2F226AC76874D4353F22FE09A79F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 beb213690f01d0b1a0f2d3c3dd670e2e97b1da749a597861fab0b818fe6efd60
MD5 0ee40ff05f77d85f515bc72a395e775c
SHA1 7f9f22d924318695a158e698f5fc07f56391524d
SHA512 8d49191999525456e2cc53f1345d455fdcb3aba11a377e0fa35181296fb0b8007200010dc6be441cd4e173ddeeeec86829ffe8fdc35bf4bb165f483c171b3ab8
SSDEEP 24576:4EPohm6/7IIXdwcXrif7qQncjlP65i3Vu2NyBo4kx929bL3HnxL:3o06DIKdwc+eQnSt65aVWB+kn3Hnx
TLSH
T1F7955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 2af642630eaf1d701018bf0a7ca3898577b213cc362731ad4da27326f404d879
MD5 730ed4b4e9a56d29953c663fa1b70fbf
SHA1 550bf4f5adc5524df24ac46004d82cc6b5614933
SHA512 61a67824b11b45c38f5d37c081c1862af0c84da94a1163d06b72a774c045986f8e664da6ade340abd88d43dea4f9d4ad9c82e48908a9fd78bd68dce3ed72c60d
SSDEEP 12288:UEP3R1gLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:P1fNyBo4kx929bL3Hnx
TLSH
T19355122E2B9C70F9E13A717C94918104C732F4651B5267EF5AA2C17E4E7BEE61E38B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 daa05156804510fe8f1fed96ec70b750468dd9071d5258e24b21c794f26235e3
MD5 c7c051590ba86d31c94aae4d8b379114
SHA1 a52589fbd683f47a1e1983bedc70a36c7fd2b60f
SHA512 48dea993a0d64b8bdbdcd99a50f6441b7d088288d53b5065efe40660fab237a7ab9f18113d40c37a927b8154725dea1aeadccf9f3589e38a2ae66ba7d136609d
SSDEEP 12288:BjkyBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:BIy+NyBo4kx929bL3Hnx
TLSH
T1E7551205638C61A9FAB92A3899678194CD34BC101F2193DF9591EA3F5F7AFD1AD30B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 71cc293aecb4259ae543f8c00b92f82e74bcd03c3aee44f961c4dcd26608a53b
MD5 6de0eeb4c4124b4d885c19ca72b47efc
SHA1 1c98b85c9e2a0bdefbece14353466fe8edfcf379
SHA512 b048f7c2068940251847ac1252addb21b76b43d7b750aad25163bc27e697c480b85e37001cc595507ca9258c88489ad14342a549a98b1889bbaa4abb511e224b
SSDEEP 12288:83zLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QgNyBo4kx929bL3Hnx
TLSH
T19345231A171C327AFA3D3BB0645A8554C830BC4A0F51A6FF9DA2D8778ABDED25A31503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 f67454cb472b93bcd582c949148863d8451c60d30a67e21ac74a5430865474b4
MD5 711cbe1c3b1afe8710cc9d027cf43775
SHA1 1bd50ac1425897274a654ace0e6af5b52f75e363
SHA512 84531d687079e332e7f9d74e2692dd9436c70a679f1c3a7524391a67953d06b729760d7cb2d6fa938b4f1c1a1f2700778ac00e6507c194edce5bb32f9d482495
SSDEEP 12288:fLQZb3C97GYnZMv5zBcKY97MD3WLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxfJ:DQ9MxZKdcz97w31NyBo4kx929bL3Hnx
TLSH
T1D3558C2DABE9059AE177D27595A240C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 7192b02926fd6b116b7ed3f30f87f5b0963b8e2424b89a9408231506998215ac
MD5 229569ae3cad0fc6440da73f9613a359
SHA1 ae5d9e1bac1f01a90e1d530b27ad0226a16f5d93
SHA512 6b96ac21ff2c79da1b5343bba630bb51d058125ac9e5f65537939beb1705e206b247ec24b3e2e0a31da0a16458ccf0964be268ef1b755a9320f5e34b966c508c
SSDEEP 12288:VyoKo2tRple9plLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:VyocvAp6NyBo4kx929bL3Hnx
TLSH
T1BD65E01FBB6D40A2E176923C89858245E773B4301B6253CB6691C73E4F77AE9BD34B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b2f354355b83e00707a4f674bf2dc3d492eeac60688d40e045706fd2486f7669
MD5 4b5d4ead01035edbf3c665290670cfe6
SHA1 631c6465c815504331fc160ceb4a19a4f6d5e6f6
SHA512 3747f7e6835a4ace11cb74e115051ece1ffea6814f4c1a805a9a4c82aff25c4c87c9b56149a328920302c194c59816c2a6c0357ab8fc60817739667002f83257
SSDEEP 49152:oWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKpB+kn3Hnx:K0zuNIr+k
TLSH
T11EA57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 189914fcb2cfbc30db0a4325008d48210f28ef890b2833d1ee48c28dea61cebf
MD5 3098fc41fb51b7e0af6bcadcb94376cf
SHA1 70326680347226f1141d0658ebdb312a5a63586f
SHA512 450c9aad44b825feaf6704b22bd39f64540ece066cbeb2bd3e57d0d12e1802b5020f39993267eb72fac47975fab72e968a24eaa1ef735d5a6fff86911986d30a
SSDEEP 24576:x1QT7EcpfxR+N5AWAz3ooiYujMqbfNyBo4kx929bL3Hnx:UTDxR+N5YzT4jMjB+kn3Hnx
TLSH
T1B455B02EA7FC15E9D1BE85789A23C512FA727811033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 30ed97ad709df31f1d6af1151b8797e11d825632db1ba4506745e29da5f29e18
MD5 59257526d95b412392631b7d22a8e2c2
SHA1 235c7aae9550235df24db13298e9b34482e82e79
SHA512 fb2aa265df71957b3ebacbe21fac1155df27680add3728189e552b934555f41662699d8b7090244958eb7a2e83417ec3c8ae3ef43579e88a8e347d7c5ae77336
SSDEEP 24576:XTMdOz0FFS+tmSL7NyBo4kx929bL3Hnx:l0K+tmSLUB+kn3Hnx
TLSH
T1AD75E13E636D14F5F57FD27C96438906E97278660321A6DB0690C07A2F6BFE43A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 0c7c1e41e1cf54ee5f921b31b55d2e39c0eaf9c73f15d11d345904113c266ad0
MD5 3f546e69bdbb49028474298d5e17ecb1
SHA1 20c5f98d8f2c94ddb6508b26446614f77b3a28ae
SHA512 650593e64f9ff9c02e8537113dfe820d2cd5814456ecbb309664799359d34f22812842387a4820ec8c22571b945e5df61932e4a519fb8971818fb023cb78b065
SSDEEP 12288:/4N/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EENyBo4kx929bL3Hnx
TLSH
T19555120913DC30A9F57A76749A2A4154C930BC6A1B2167FF79E1C87F4F7AAD18A34B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-211-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/208-205-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/208-364-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/548-101-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/548-351-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/548-95-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/968-368-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/968-231-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/968-225-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/1328-285-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/1328-369-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1328-242-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1328-268-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/1328-252-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/1328-580-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1328-452-0x000000000D0F0000-0x000000000D0F8000-memory.dmp

Download

memory/1396-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1396-77-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1396-79-0x0000000140000000-0x0000000140178000-memory.dmp

Download

memory/1396-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1472-178-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1472-362-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/1508-352-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/1508-105-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1508-111-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2448-157-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2448-357-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2468-367-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2468-221-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2468-215-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2640-82-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2640-37-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/2640-80-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/2640-43-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/3464-466-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-455-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-514-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-467-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-468-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-469-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-454-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-456-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-460-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-461-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-462-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-463-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-464-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-465-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-459-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-458-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3464-457-0x000001C828F70000-0x000001C828F80000-memory.dmp

Download

memory/3724-84-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3724-370-0x0000000140000000-0x000000014015C000-memory.dmp

Download

memory/3724-90-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3748-27-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3748-348-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/3748-33-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3788-448-0x0000000140000000-0x0000000140907000-memory.dmp

Download

memory/3788-1-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3788-9-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3788-0-0x0000000140000000-0x0000000140907000-memory.dmp

Download

memory/3864-120-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3864-354-0x0000000140000000-0x0000000140138000-memory.dmp

Download

memory/3864-126-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4296-188-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4296-193-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4296-191-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4296-182-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4412-353-0x0000000000400000-0x000000000053A000-memory.dmp

Download

memory/4492-195-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4492-201-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4492-363-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5232-358-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/5232-168-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5232-162-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5636-147-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5636-356-0x0000000140000000-0x0000000140139000-memory.dmp

Download

memory/5644-21-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5644-13-0x0000000140000000-0x000000014014D000-memory.dmp

Download

memory/5644-20-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5644-547-0x0000000140000000-0x000000014014D000-memory.dmp

Download

memory/5644-14-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5648-53-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5648-47-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5648-349-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5832-498-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5832-136-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5832-130-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5832-500-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5832-355-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/6132-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6132-350-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6132-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download