b36f28ceb9cea921ddde06a3f4985ab09dd5ade421bd5ccede21a16cd5b83ba1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
Size 1.6MB
Sample261102-lsla2svs2m
SHA256 b36f28ceb9cea921ddde06a3f4985ab09dd5ade421bd5ccede21a16cd5b83ba1
MD5 c08e0daab736ff86589b7237a4194959
SHA1 aa3e1024b8a20109e08b2d1d564d711ffdc95151
SHA512 275bd148690896ab0f4561b58b1ff16df16a6591705275c7622dd26115686b5d4af7f5bc12e76ed50f63c1c8d9d50c2d95a00e1c94cbee4b540dd0f361736ab6
SSDEEP 24576:6M1mrPSIwwcYqYnQ/tbw/2Mkjy6Fr7g0oQ:6M10XwWQ/lFTjN4
TLSH
T11C75F12DE3A495FAE5B7D13CC8924507E6723C959BB1D38F0791195A2E333E08E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1760	alg.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4488	fxssvc.exe
3100	elevation_service.exe
936	elevation_service.exe
4492	maintenanceservice.exe
2672	msdtc.exe
4688	OSE.EXE
4156	PerceptionSimulationService.exe
1976	perfhost.exe
4644	locator.exe
3248	SensorDataService.exe
856	snmptrap.exe
2476	spectrum.exe
3372	ssh-agent.exe
3560	TieringEngineService.exe
3232	AgentService.exe
1204	vds.exe
1200	vssvc.exe
4664	wbengine.exe
3120	WmiApSrv.exe
5048	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c4ff976288da564.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091373c3eaf6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c71563eaf6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034b37b3faf6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096afb93faf6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003fced43eaf6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca84693eaf6add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4996	DiagnosticsHub.StandardCollector.Service.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
3100	elevation_service.exe
3100	elevation_service.exe
3100	elevation_service.exe
3100	elevation_service.exe
3100	elevation_service.exe
3100	elevation_service.exe
3100	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2348	2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
Token: SeAuditPrivilege	4488	fxssvc.exe
Token: SeRestorePrivilege	3560	TieringEngineService.exe
Token: SeManageVolumePrivilege	3560	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3232	AgentService.exe
Token: SeBackupPrivilege	1200	vssvc.exe
Token: SeRestorePrivilege	1200	vssvc.exe
Token: SeAuditPrivilege	1200	vssvc.exe
Token: SeBackupPrivilege	4664	wbengine.exe
Token: SeRestorePrivilege	4664	wbengine.exe
Token: SeSecurityPrivilege	4664	wbengine.exe
Token: 33	5048	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5048	SearchIndexer.exe
Token: SeDebugPrivilege	4996	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3100	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4052	5048	SearchIndexer.exe	110
PID 5048 wrote to memory of 1740	5048	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_c08e0daab736ff86589b7237a4194959_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1760

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1696

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4492

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2672

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1976

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3248

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:856

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2476

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3372

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3244

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1204

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3120

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4052
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 84d40a8ed68ee8c63f995ee2d0a240f57ea6d8064c94322662d7c375940de71d
MD5 44504158589b5fcfe8e19313a5ee0917
SHA1 ba87b61a809f795a1e9c2c089fa6798276b6276b
SHA512 7954f11243348b1942220dffd4a08a2b42e0861603645fc7bf4538ec31c5f662da73c88cfb1095b0aa00bb9aa7a93c247fda11c6ba3c100f4275cc32775970dc
SSDEEP 49152:Eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5Q/lFTjN4:+3q6HjB9Lm
TLSH
T163D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a3d668b91ccc3d4caca3425d3766d51b283850e3b762897b487224b90abc912b
MD5 7651d13c782888822dec674e27c9fd60
SHA1 7ff7d187bda67a1f1a9a8dc833bc741c7910dc76
SHA512 290dda3ae1dca6b14cda95e605867d97742b965a343520b2a9d6750d7a426d30b4e0b5d86c0ebb2b9ab368dc7c32f80487f705a8a0a560a80dc996040c82525f
SSDEEP 12288:T1XLsswWkxy2lRq2czABcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:JXYfDtczABcnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1E265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e8eaf091d3a1b74c49cc297596426b33a21f6a0b5593ea9de5546d619d8aa0c7
MD5 96f069ad87bdd03ac504ee9131f683ec
SHA1 348e318b2f896dce75f78a954f099c791a304b33
SHA512 85a1ebc57eb0f6df96362ccb4ba4c5a5c8e60bb2ee3f05bf77091028a03074479c2c9aae74907e75edcb69c361a4fd0f8c5aee030f38befdf68d40bd5b34d13a
SSDEEP 24576:R0Le5ji0hmxLrMScnQ/tbw/2Mkjy6Fr7g0oR:RPji0AlwQ/lFTjN4
TLSH
T154859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0795154fa99b29a7729eb2eb89e0ef32e2a46e633db4eb041c72dd4cb063d5f3
MD5 d7e966fee7403e916c5c83d5a22981bc
SHA1 c34f4fbc477287f6bb98c4f69aea825bb042d511
SHA512 2c41e53640bfa47cde11b855143c35e8e214103079bd3598fd0c2e204952ed418202e7f9881e5fac22e845c8974ab4c58dec612c5a9d2f195f3c111eaf49572a
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWE6q8wyuwcnQ/tbw/2Mkjy6Fr7g0oX:T/ezSC6vUzPvxHjyMQ/lFTjN4
TLSH
T17B755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e7042316c1a38b478e614ffcae73a4dedd462ebecd909c945c5ea0181c337f62
MD5 1bc60f0e2b8af4136b6c0fd78c28b1e7
SHA1 2a7f3e6348bec564ae41c5625bd365727ef9c0e3
SHA512 e81e24c1f8863bb3fc669b5dab608bdc56b8725058ab343fb615f22bf3ab098d834cc4c59a54084c801d2c7cc3b2eaeab5a3012236ac7d11dab090ecb4c4a7a5
SSDEEP 24576:qVbqPb88hv/l+69cnQ/tbw/2Mkjy6Fr7g0ol:qVO88hXl+tQ/lFTjN4
TLSH
T1F6559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 04111f5eab89f7a59abc93ec1c5597cbd0f0367bee8b7f4faf9d63a819b60950
MD5 e8d9e2bd34d984094cc416cf4e39454c
SHA1 b9d3b2f5d842703d81784522b1a5ecf19c80063a
SHA512 07ac245287767b0f8941d950b89476fbcd87234dc2f75eb0f632739c61364f941ab321b40b385c906a1289ef7ce996bc93899aa9534294c964944b02b725ee18
SSDEEP 12288:WzecGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:WzecnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T10D5523796A24F897FF2B06B15C8284826B7B0EC1BFD4E74E6744322D857C39456DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 4a0847b370335ffd28167eef79c0f0154b5fa0a1cdc23d510e7f53e512ee4c69
MD5 aabf48e0dc14f87f7bc82cf03e44d054
SHA1 335cf70f41afa9841a47876ec47785baf7936cbe
SHA512 bf782d59a06afce389b7ecd6a2203ea112ed2a85f10db9612712eed55a2deeb1990e40c0b811ddaa7b54a169b7f671f7a8f63f9143a428167244cc1a6d8b1d76
SSDEEP 12288:deBNUbTVO86UVcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:dJIUVcnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T16375CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 94c9e5dd7c2fdba4cd7da8c98c2f392d7c425d54e9b82d08a2f17cad135ebb8c
MD5 188e242bc5af700514a24bbb0a51a04e
SHA1 a4f932bcee55c68e00690bffc70afba603818d64
SHA512 9f74a444c35e909913c479d8c2e89b887ed04c665917ca78905f5f208f7494ec5901ef3bd7c997d2b4c83a8cfa5889463afb86495db765ed09fc67f7567c269b
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THw:xQvGAdlCEL8c/yRNw5CkLm
TLSH
T14F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 8fcf79f616088ac8770c5e06b137552f7840459c625c1496bf9c86aa6fffb180
MD5 14d56e03deb48594d39ab037d25c2e8c
SHA1 399347818399edc3736b5d9bc1ea397e1f003ce7
SHA512 27a504ac4c2bb05c15b7c4c92f568c53a8473f964ea323c170d964c86aaecd336223b019b597c4770e710d00c2baba2a4f332483528ff9474c2bf5322014f8ca
SSDEEP 12288:nAwSfxL/2Dc39DLLmt0LDQewsAjzcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg:AQewsAjzcnQ/tbw/2Mkjy6Fr7g0on
TLSH
T11A75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 07101bed6a0809e1449a73edaf0ba537462189f1151be4bf71586291a093776a
MD5 68ba576b75b057aba9fce8959dc143a5
SHA1 289df79dfbd30ada05e18f8dbd513cbdb548cd48
SHA512 e6ca5b7236724fc123981dc07868e66f41a1a120816e25bc6dceae7d3de1a42e7a3db5f37032125c9a2f793d1625add03ff7cde517e499596965c8598173fe93
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHrL:LUEtQevvqc2W1cpV2EI32
TLSH
T122474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 233fcd3aa7380714de0ee1b4a506994287c46e0d0f5e3642d3e1c5b21f17395a
MD5 7852af3a452c771ba86e25fd8cb3e6bc
SHA1 8103b398bae4997ee1f41a9252883e4691080646
SHA512 629f6627525321d90dee703ec7cb20d62ffe1e7a25a2b43775a5f53938ac0f12603450f792dbe5c6e5b747007e8452e75f5812c9fe9ac71eb3499e8d31c5a72a
SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zgQ/lFTjN4:PoqtVjnmALm
TLSH
T1F4D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cc9841e40a076f3280717d89cacdfe27c62cd4c598b872001e8d1d89c6b89c0d
MD5 2113071b7b71782b1c542575427a899e
SHA1 29469458fa333beef604d7a3147819d41a8d2296
SHA512 3627782cf517fd643ae390327931ec94f05a758d46fd291589152d5f2b55b0f672a2ed2461af53cfe70c6c2b2e77caf0d3e6449bb44d6fd2fffcecd573d2c1e4
SSDEEP 24576:sAhGLJIFoiwtA5l7S53kcnQ/tbw/2Mkjy6Fr7g0od:sAMyFoiq5bQ/lFTjN4
TLSH
T1AE35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b6193d13f4b18fe9079ea6e15556f5fa0bf1b93fba04505435fa6fe9fc702d17
MD5 ba7a0e31377dafa66653dcf5d697b8a6
SHA1 2760c64be48348eca3cabf1088a04298fffb222b
SHA512 0962b7f602fc28b714157219efdb93df6d8e3763a66da04b06d1b08afa1578d86919f7ee8bcb9592c5dbe8c7b78860dd205adc55eb7ab5d5a4023f1585839f9b
SSDEEP 12288:5mw5HEjsChN2BFgl0WDm+CQcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoW:UwuHOWXcnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1A665F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 33e865f2503973fa804839adbf769cb738d9c9d6d13c0ea2a1552ade1d10d55b
MD5 fc2922f3f8b7b078d918d8d47b840ffb
SHA1 adf87ef04047d27113ee0b9d9e1da7b513170ca5
SHA512 f859164ebb2fe1093474e0c8d863c7b39b4591c725c5712835e7864f518436252803e0ccfd6f314dd4a354a5a64970cf4dc5af40f3dfd0c71f97e8a7373fe3ae
SSDEEP 12288:+XZ1IyjcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:OZuKcnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1E755126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 430f35b24833c530a4f174ba29adef338656345de983f393340fde72b03acc59
MD5 79c8bf8adc38f3cd6a578bb37c7ea98b
SHA1 b67b5ac9b457d51d77d2f7f3315bff0dc5aef569
SHA512 67fb64bc9468af5078a5904e9d270c8910eba28358c5089db9fb593e233f68473b9692ab8c1fdb025d589bc6370acb70a7e083580d4a32171334a7d88011e535
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:wQRQyi36YOcPQLvw2gAf+PN3RLm
TLSH
T131666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4f64f04214b33f05667e1cac1810fa48268846c5a5c087a56ea34c1f811d2003
MD5 cf45e762202b87082f4a1cb731e2c17f
SHA1 daf5c62b991a4bc509f7d20c6a4c3e308ea8610f
SHA512 8b516a7cdb5e7d8a084969d95738019973188a9c44004f08e75fcd1e99d926c70fd36e8d547bdf41cb5a66eed2bc20a81f7f14c4729477ef75215e6099293e6e
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:6QRQyi36YOcPQLvw2gAf+PN3RLm
TLSH
T1E9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 deda05c6eccdeff6166506fcae8078df8a2aeba1813bb21bee970f67296ee27b
MD5 efec89091aa732834f1d08ce6ca39ecf
SHA1 ce258f107f718bb681cfe50fb429a6a48214c5a8
SHA512 629d4b7a1b2047e55d020da8c784e10036c1143a04a40848129fa507b482ac591ad0a22dd81f0205bdcd9baf47415aa2373fb990b3f9526c5e6ea312d32992e4
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0acnQ/tbw/2Mkjyf:k68Qg55nhheWu7PNU3/wQ/lFTjN4
TLSH
T1BAB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0ff3aeb7eebacabed5369aaac81e9a5b0f2752971a4a8318490306c6911fb62a
MD5 4d0abc728d4dafa496aa62bf350baf1f
SHA1 75fe54c23462da80f33d61f1b0470bb042a8e76d
SHA512 df4345f5c5c2ac7a50ca763311612c89df84f03af3ae4f041ac4034031561a3da354761deec51e9e0b73b08df9acf24043e19eb761d7bdf76baf2dd7ae05df66
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99G:xy5112gYy5azzVvL69nLKnhZaLm
TLSH
T17E167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0f4660122899a86fe444a954ced21209ff76f427f1704a8470f794741bf6c6ff
MD5 0cee5790c794f3673c1e4fec9393c3f1
SHA1 fc45bd1fb5123b1efe0d4e2530a102d315a248fb
SHA512 18b74e83c914580d094855ae4c7b3538c0431f6948490ad9a24302d09c9be57b544015dd1abfdd3360340ba819498e1c83c47c4ec9fa30ff12662fd8d9ea53d8
SSDEEP 49152:YB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl+Q/lFTjN4:yu6JmVxd2dZLm
TLSH
T153D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 626c0f7ee844f0d4782359dcc1eb5c0a7107e0f102c6346c290a2996bb745990
MD5 d96d889124ad7ca7f31ec00fccefb847
SHA1 f8d41912ea4dc0c347392e6f3476383e950a2d32
SHA512 b96716a713dc5d2dc72917b3b17538338e1d7f36a07f88ddf1c7737b78bc59350562cd2527032840e0069cc5a6f1ef388a8a698c5d91b200a862272c7d907e59
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4xaQ/lFTjN4:PmifPbRALm
TLSH
T1EEB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a2823a5157a7160847b30d332ddec875c9b652ec06908ea72b1f9217943ec92f
MD5 87cee9025080a8a385139fea3a83a564
SHA1 ebfa50b117df912285f7706d4eb1daf2871b508c
SHA512 bc2bdc639aa21766064789b84ac864a2e862fed7b11e8e7df3a01fe4187347bd16ac039caff41f71ad094af9384204a708d8b0da1ca40b461e4359f6665f9c5a
SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHqJQ/lFTjN4:X5dKTi61+Lm
TLSH
T100C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 64e57f613f1f4b870174d18a6e4f6c01f749568821e776962abc099ebd4434ee
MD5 26a0f597b1d0bd52abf7f4781e3099fc
SHA1 1a8c0675ca254279b8af5462b27cd6701602cf1a
SHA512 dcf0956bf9f55043665da890f0f0477b76f939e3d7bd3ee847dc2fe9f114c7f3812c8fe1351f438d59a966e19f0383ce3ae654e120ce5e7ae1ab06e475c8b8c7
SSDEEP 49152:vhtSn8EApI0figngiDn0AP5wOQ/lFTjN4:+X2iyphcLm
TLSH
T17B95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 080065787c9e8fd635ebc0af15dbbe1a68b193614c977078c3a168bc688aa74d
MD5 34da763cae84d5d7a66316aea7470ab9
SHA1 c0a2cf75b0c934dc49c8060a80cbe641c27b2b63
SHA512 0bd56f8a10ae7272837fe0560fdbbfb7caf22a93000fbf47b2a2f1757dcb9c78861762a2266e411c4e9f4258041b472a0a267f6d7522668fe4e5be7da8454964
SSDEEP 12288:j2cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:j2cnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1FF5523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e1148a84411cca0b598bc1ff5bc6adb809a4d1715ff2214c97b6dbf62cb11d23
MD5 2059fa1c108d998c5958855e1cdbb457
SHA1 24018ef10a4738f8d5293ab76993eb0123e7d64c
SHA512 3a6f3ab4bc4d9572d4cb2d683fa623341d2b9eac515508d5e68a51b36c431a9c5ef65ce6cb44ff12c65c76687df172004224fbf219dda479709433ac63489dc4
SSDEEP 12288:J/cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:J/cnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1DB5523797964F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 644d149980fd4b14226ae9442a8bdd17457d36f9b350ad8c82f5f1453f0e54a3
MD5 e683d37316cd457d79c1bbf3ef237a07
SHA1 ff224a72113014cc3c3a53ef5b518750d5d597a3
SHA512 e6e86b98a8a129848d830d426e07205c60f9a4b9708800a260a6c3f17aa4149119ca1670540ef536c56b2e7b29dacc18fc8031c869d36a630c3e0c903b32f24a
SSDEEP 12288:GNcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:GNcnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1775523697965F98BFA1706F14C838182A73B0EC6BFD1938F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 e6fc6df6546897b4ffcb4c09497371e35c954c7464a65789209a5b891b91180a
MD5 a01a220e507edf1bd634ecf305037599
SHA1 a29e84b7d5a7a452cb45d743ac2280c8a3c235a6
SHA512 00fe0f029627c1f86b41f01d0e876c6bf7242fbdd873ad2b3347c2010834f517ddd9f9e67051e419996fb4dfd99422a27c36417d73030f70d7a533d1859c5b01
SSDEEP 12288:tVEcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:McnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1665523693B69F4C7F92742B4CC938142E77B3DC6BBA1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7af6d9205d76d509bb62d7db0940ff004a2e9722cf2408beee5a0f81818c4d9d
MD5 0165400025775afa777ed1edfc58f3b9
SHA1 e82b0e5f3e5afaac67eb9aa36243e9a0b2a4be4b
SHA512 d4cec1bfd95dac81a80bc9b930ee8518670cfc5aa4c36bc8fdf37db4acf1d04213be958a2913c79a942ae3d03b9fc80eac47eab3aba9d26d75282acd9f9ed218
SSDEEP 12288:XscGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:XscnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1755523697965F98BFA1706F14C838182A73B0EC7BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d375a55a7137f5f0d1d9c863fcdef4f112b010f81fa3f658fbc3841d6acfc9d9
MD5 a767e98b728f8b4803b05150bd06ca13
SHA1 56b00f1f9c904e3b930c6ff2f3ffb155f3b567e9
SHA512 b215a45a0930942414c00748b9f27b4c90a2340108ee14a4be832101b1ddfe0279d131593653d96d3b4a9fd6c0db24654297a0c415187d150882a4b648ca37c4
SSDEEP 12288:OLcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:OLcnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1C35523697964F98BFB1B06F18C828182973B0EC7BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 67e618404ca3daecdb61b4559e51f60d8901e2126af9edfded548cdfdccdf259
MD5 f780292ba97085534266befa68c27d6b
SHA1 770328be14e65218f914c7993d99f136d67885e0
SHA512 23fced397d69a4e65fd9d9b00d61a94b5334777dea840536a4f4f7b5b3e0787fc01c180ddb18d3876c41057ce5c48ad898292728d2de1c54227c9fab49c80650
SSDEEP 12288:pncGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:pncnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1835523797964F98BFB1B06F18C828182973B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4ce6dda76eb34fce33629ef8ffa4dbb3d5a113e786a9fd06fca4d3dd3ac9e3e7
MD5 7d7f87916302dd9a514b3a17f91da355
SHA1 ba0b2c1233a2db2b27cb0e5e83ce7db54dc65b20
SHA512 44b0aa7bc451eb4da3047bdc92d698150e0f304b1601190b3c4ece954342a59bd2e5cf77e35358faf3bd9f392b44f946d22c9dd0f27a9bdb8349b60f49ef75a0
SSDEEP 12288:IiZwbDzzFEoS2cPvyfcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:LZM3zFVSOfcnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1D47501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f7171305ff00dc02c6c41fba51356ceb3675e9695e758b70d9123448aab538d9
MD5 9b2d86676cfe70e9581ec328b0aeb5cd
SHA1 21b69b97514360283543cbf0da61d56aa951f3da
SHA512 9be185130e4b0403ad5cd05f6b355fc34a88d3e5622d658dd9409f00cd9466e3027490b934a38bee7c7e6d0a72a9613d2237745cfbba3f9c8ddba26076a5d878
SSDEEP 12288:F6cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:F6cnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T19A5523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c503e71a99c035391d6a4af9e1e6fd44104677b77c06010a17f856b552e5026e
MD5 d6dce600f86ea387fefc1502b8c61b41
SHA1 7d33455f2d05b099a92155bfd64bfe4a91439957
SHA512 a8ad8ce655b45b9f679bb7e2bae0b2038938e3c77f630c077ef7988afd284d18370e9650230419ad93a2face4c6072d4bd8b9f48aaffe59a399a3014b47ef060
SSDEEP 12288:VOcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:VOcnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1F45523697964F98BFB1706F1488281829B3F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 715fbc2831feee8c413c634a3a01f1b74f17dd8b58f4ca69cd8bbdbf174b39ab
MD5 a47116492498e7a9d7040de8118ab523
SHA1 b0198aeecd859e3b6e899c6be8f2fcb50a53c74f
SHA512 3f1d5034e25f6024aef42742843c52d5066b86b69c21ee26db8501a764aff673ab95905d17d3409da9fc271b50b1034e12a53828c55ba2dacc39d0074d130b5d
SSDEEP 12288:GyPz5L8jcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:7zyjcnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1F765021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8589183ac1bc71a9b3a21fd3c689d0c17daf94722a24b8743ec31730ccbe43cd
MD5 bbbff1ca6651b70d5c639d0916b658ab
SHA1 f156bdb9f60825e56db77b2f1c70911c092a86cb
SHA512 91924f7daef305fb9d613642f9dcbc42b313c0101d953550d2fa4e7014840ad61513870cc27278579717c8730b6408998faa8b37e575458c0c1aa93f1e39dc4b
SSDEEP 12288:V6cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:V6cnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1C15523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 20a78f636316045688baf6d6cf7fc51f0401cd91da622d82342c55179fd9bb36
MD5 35dda21b13a7538ecb1080bffb1143ce
SHA1 ca109d08444044e7136d9cd64c1234bd441fed49
SHA512 aaa59cf62be5e18c3566247e1e8e62fd5be2458c41d4cb60c7578e4fd5556ec75b3604a2d265af3501fd90bfd936d224c332c0778272a4901b357c2b99cbdd64
SSDEEP 12288:i6cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:i6cnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T15F5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f9fdc257310d1a617e97c9647ac467b0baa5baebfa4b00f87d93679ae642a4fd
MD5 018d4408bed6d1461ee248e3d0a9afb0
SHA1 4257262cfc3c1e03b5eabcd7a8b778d98dec828c
SHA512 d0b57f7e6e304cb5ea278dd341c51935778df6ee0e019201281dcab37c8b11994f25d0c1a4b7fb82292d61fc137a812b4bcb205393a6138089df35eabf742bf7
SSDEEP 12288:+yPz5L8jcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:jzyjcnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1BD65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 d62d13f17893a75f9a4a7d0f97614751f868d9f6de06ec5ba6a850e4bff131f0
MD5 2ab29019b82d5fe8f9d4b5f6df1ac03d
SHA1 9c4f8b7b0ddf23814698f8a02c1ff356fb6bfe1c
SHA512 af9f058afc87707914325b5a621749cacc193ed9b4b11d780ff161777aa53f9a48b1bb41d9b1a716322efd472b112e5c3188d406c2d9ff1dbccf8569751aafb7
SSDEEP 24576:rcP4mcvIjkGOxhKP2l71nNKbrh/8KBicnQ/tbw/2Mkjy6Fr7g0oK:AP4m4IpOO67W8KvQ/lFTjN4
TLSH
T1FB65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 8a2ef19ecd05717cd84f90a0a09b5a88fcbf825a2c8ca8d2e4ef2b6f25ff49b7
MD5 94ff0ff63ff8a73dbc8084aefc388798
SHA1 72d77a3d36389b627cf82d1646c99b001b28b6fc
SHA512 d36eaace31d8a839c95810c7d96c0f02506767b73c35939588f6deb14ee0198c6f0acc567776609a299961040fc3c03115bfae597c23498c4a7dbe85e4853d4c
SSDEEP 12288:DssfKcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:vKcnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1B465F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0c4e440198921ba539bff55972c82eb241b0b14471c7ba3e2c747a7458d2d0e7
MD5 8be1f33ae762b68b8c410afea59758f3
SHA1 9c0a7dfca517b58dd81eb31f3131be57ba0c7bb6
SHA512 67def31b1a7a63b67a7d0c6f47d2b7e2166b7eb8c8a5b0ad534dcd93dde9e6609cb75d3de68003391401e1cd27ca67d654ce9f0e18d481caa577e46364c635f5
SSDEEP 12288:nqcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:nqcnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1405523296768F94BFA3B06B05882C151673F0EC5BF91D38FBB08222D967C3D41DAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 602e60ea4ef81712b678046022ae71460072f35283909753a666c2066d7bd545
MD5 76703a3936e4287ee436e7f9a7dd744d
SHA1 a3b58d3a3aeb5309175d7f82ea45421b5a1a6c70
SHA512 f12d8d36af1a10dff3c3c85b26e4fefb513214f869da3f480ec603d5286971ba91364ef30bdb2b6aec4c04960c4f7d983ab14d4d1f28b552681d855e71fe12bb
SSDEEP 49152:Ga0h2GEkuAe73q3pp46zwwQTQ/lFTjN4:Ga0hNYG4JwrLm
TLSH
T1A5859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 21521397e0640a58ae9f12bf1a8d2f3c11b5c5eac82e1dfccd61569edbbd55a7
MD5 43d07963a2a80fbe272c413d8510c134
SHA1 3418f49ada3d1766e61a64f4d373a0b0ca3e2c7f
SHA512 f5910ade05f6fe4fe755eaff3a360f32b0f7b153625f29104db783f9c7573c350a3664674d56b58f7d4c1c0d7d47d5a94e107ccc0f7b0d0202f1fdce483b25a6
SSDEEP 12288:zhbHjfXPcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:zhbHjPPcnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T19C55027D26AC20DAF63692BD88828546D7327C552B11A3DF2381827D4F3BBE41D79F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0c7e3873c916e5ac05819d99d074b1841d0d252d41c71a6dfd1d1d3e2879b00d
MD5 0b2852d15c329df4ca9238bef20ae56f
SHA1 018041585541da18f6faf686a7f39fc005ec70ae
SHA512 63af97575176ef0be41ea561d8fc6792f1d09955601ab8da77163a825e41912f377465047a356c4967e6efeec59bc8bd0ac1f85e3c51ea3c706cda6d43520342
SSDEEP 24576:J3YgnJcRTk4yti+R5dBR/XcnQ/tbw/2Mkjy6Fr7g0oV:JIgnaTk46pBR/sQ/lFTjN4
TLSH
T18145BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 786b21458c5b91c4773b30650b455a67f400c020663a569dfe47d1439b389358
MD5 a3a8799f70364d72640663012f292f3d
SHA1 79a7e4d91b751b0a7bbbfb46181b9444142f47ac
SHA512 4e2b4dd692ee853fcad8d0ddddd5db0cac7b05480b95c54e9ddb0eb05d413b859b4d838240e679511bee8998ba8023942f1475356d98d4b375e3ae43eda18569
SSDEEP 12288:Z+cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:Z+cnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1B25523686614F98BFA2B06F54C838146673B0EC17F91A3CF7B48212D967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 50249b1a611d3da783b06e0499a8115bd7f7c3439d0d17fbc1d3e33dec0c20f6
MD5 383ba1d1e91e3076363e947b623946bb
SHA1 5f9353ed39a704041b65229f0306d315c9c3abdc
SHA512 020f7c2a375e791802d4e4cc5a03d5ca1407e4f464b336696c04f406d6637316d4de4d216d4681fcc17fd348d19410ad8d53a96fc52f9b93ed6fa3b6da38048b
SSDEEP 12288:EOb4A4LWOsvAYFTBcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:pwL3UTBcnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1CC75F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 54b6ce59f1dddaf9c1366783b6598e0d3e27184e52980b2b3def01476cfbe453
MD5 938e194aa237b6afa26eae61e6338531
SHA1 b714c09f44387d3cdabf97dcbde7c690b1caf9df
SHA512 4989bfa966565b51970a9cafbdb04c11baa64cb70bc865c919699de37a0c4196d51eb4df02ce18d388b59ae6e4bf35077b9bffbf672320cdbaed3695130d74c4
SSDEEP 12288:fpFtCO1cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:sO1cnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1CA55022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF85C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 43441dd449c873e897af441443e985970238d75999b457b06d05508a0778dbed
MD5 930e2e57e1c731289b06cd7fc5b8de3f
SHA1 6d63b119452c0ab53bbc8c3866ceb366b7e41124
SHA512 8570f82388b8402909fc0dde071ccb7a0adf2e08fb39ffcdddefdfe9aa9bf612e5e75deb1290b77841fedb840a7b329473514ad0bad8eb1555119d81140e019a
SSDEEP 24576:k7NM9YqZqmWMUkPjZM48Mv6bEhs6cnQ/tbw/2Mkjy6Fr7g0oJ:k7cBWMpPjN8DbEhEQ/lFTjN4
TLSH
T17C659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 26e5c4590dae090a7d335e8bc717b797e03ff0ea90cdc71a3b9e7d62b788a0d0
MD5 bb20b0c84bb0495df4216b9a689ae59a
SHA1 f93532c3d49570570fb34692fe3e683f1321d9bc
SHA512 94612cb05b4871327baab61a0117ef2f1c896609860f6b26679e0d181b1952f38ec77703e983e0d4aadd8948103d28c5004db7da2ae988946fe9b78f14d69a22
SSDEEP 24576:cW6BApg2YuyuNDYTabvcdvNYf8km14cnQ/tbw/2Mkjy6Fr7g0ox:cF2YuHNETovAvNYf8km5Q/lFTjN4
TLSH
T1BC857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0dd11f24961924b359761e0ad0365b9008a11440335110808df5fb21ddd28698
MD5 6270097e927adba90c5de74e9e416ba6
SHA1 bdb888c0fd7616748c79cedc08ae08f6270266e9
SHA512 34fc640ada0b2130787f90a38c41efbcf5554d44c1d14acdf0be9bb7aac5f4cc00c187feb3c51ace75bbe81839f9d437cd9f58f63f7ea33a723256b140553b63
SSDEEP 24576:rAFs06+Omlf3NXEbToZcnQ/tbw/2Mkjy6Fr7g0oq:kFs060lVXuzQ/lFTjN4
TLSH
T14B65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 6ffcae2d4dc12c1ce9c098c490f0e87c5e4345ae95d8b8f52cbfd688a5325377
MD5 cc02687ea6850ee587eeb0170f6c204c
SHA1 e6d1004ee29b4708483529958ab61c55d8276e37
SHA512 a7c6ac3499eec7ea25e883b0403340d423be0a6adb4b65b414b9be253372f9a8a5af59e6679ec1a899aebad667abff68e3f69553511bf31ce6d12d2bf722e56a
SSDEEP 12288:KCJnJ5D3VkrqzxacGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:LJnJ5D3WaMcnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T13475D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e89008be9d0ed7c1e03fac445b0e610645deb88dec7cc54efabb53226fb22973
MD5 516f46bd7be41096b5decf559ac45a11
SHA1 618cdb68de774e96a01a7fc320d1002588d9b26c
SHA512 0bcfc82dfd2bbd64b3645800cc840472a40bcc5acafa7ee73b78a6dec7bb44f76196d29975352304e13f116cc3f316825a99c59a883c9c4b3fc2f3fb30602bcf
SSDEEP 24576:OEPghm6/7IIXdwcXrif7qQncjlP65i3VuXcnQ/tbw/2Mkjy6Fr7g0ow:Jg06DIKdwc+eQnSt65aVtQ/lFTjN4
TLSH
T1CE955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 646cab90a5648c6ada8d7c2a50eaf0f878e006d9fb25602d81d3aef131790251
MD5 5618f1d6ce15f47aaec6d158b554eaa2
SHA1 c456f4580a6b1358e10aca7124323f256d3d3018
SHA512 634fd61c925588bcd8b7d4da827eaae469f3b5f656521ce3ebbf85905eb659a769f0e596949776a2a51b685ab3443489b4bb84a3bab81a454c09518138097d65
SSDEEP 12288:dEP3RSQcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:+SQcnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T14555126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 bf167ac57ba45892213e27c3f343d78e35aa1f98f15603bfdca1243317f9b415
MD5 1abd7d4ee57c2fe57c1a9d62a57925e7
SHA1 15c53fe9a38f3cfa8501b23a385b2898758a60e1
SHA512 6946942e78ee5dff97d23b642b7c5fd660140b1efd4d7057da0e2305e24f8a5ce7a7b1eb322fb7ad190efee1134204aa814371ec3fc3120438bca19869638276
SSDEEP 12288:pjky/cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:pIy/cnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1516512186398F4C6EA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 44d341d9182d4dd9f9d3e4e1794216a8a2e5277d83d2a380f705feb3296e55b8
MD5 fdc3091bfc2b5901fefc062ccde50686
SHA1 2728a6c91ad34fa0987ac82790f1f6685b9dbed8
SHA512 64d440fbf37345d74e01a6977a2b67b1f2f5ab03b39825ff26dde88646cdc469ca938abba6a48d72d849ff368a3917a5697346b13740731aa501400b6e9d6fc9
SSDEEP 12288:H0lcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:UlcnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T19655236C3625F88BFE2706F448928542973B09D17F9163EF36886239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 744f406253eacd0845db9baac9bdbb4a6f2f24be7dac3f509e913094ce7bed00
MD5 65b25bda5cc3b28221c4d7b0b72c1fed
SHA1 078a8fd9ee752539dc0011ed17a78ba2aec35b69
SHA512 11b9a1e2bebbe254cffeeb0518016520d660a0566b6aed23fd2df92af3885c4ba5c74891758ae254988f2e484e39fd5c2ac653c062c1881206b2f6a50cf9f663
SSDEEP 24576:0Q9MxZKdcz9dw3ycnQ/tbw/2Mkjy6Fr7g0oX:0VKZxQ/lFTjN4
TLSH
T12D558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 c5f4f19456906c9745affa34f35a419b0b854cd22cef41d925273298f5cd7fac
MD5 8e2505c82960097ea33e34e42aa665de
SHA1 459b15a8917b954262cf5f1f7d4849d40dde9123
SHA512 ab827b2c6acd0a453341ff8107bb41ee16794e9066c16cefc6893dde0f2ba9a3a8179a58b9928efa85d4c6e946018cacab3f034991e94a5d5b25bbbd62ccc155
SSDEEP 12288:ZyoKo20Rple9pzcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:ZyocSApzcnQ/tbw/2Mkjy6Fr7g0om
TLSH
T18465E01FBB6D90A2E136813C88818645E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4397c01442b8f296f04531860025e18d2a27d48b35944df0b3c236878f64bae6
MD5 cddf33ff151479e4ec3337adf07170a7
SHA1 c67810bc1562fd6808cfde7be4eba335b74d7e75
SHA512 8e10b6d2a2c032db3ba48d98de4e07a2dd15e2f65934046a9661d0cac2b0d663e96e75e6401e96c431f613b930d273e03004717190901359827139f1e1bd91ad
SSDEEP 49152:dWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKAQ/lFTjN4:90zuNIpLm
TLSH
T1E5A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d3bad4485063b2ac5dff40ddadf9298588bfaec662212cd8c5f3f145a6c3496d
MD5 ff8741b44f30517c1aba3257a2b652bf
SHA1 5864362b1718adad38566ef519c0307018be7907
SHA512 83a82880ebc20d5977afa2dc3475bee3f00ee4aed7e2712dfb8d2e249c3a1184807cc3313a4bf85fd33f97d2981a8ac83cc6d0f0068f6e1325720caf537b47f1
SSDEEP 24576:S1QT7EcpfxR+N5AWAz3ooiYtjMqbQcnQ/tbw/2Mkjy6Fr7g0om:PTDxR+N5YzTfjM6Q/lFTjN4
TLSH
T1E255B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 984656a5b0d977aa6dd6290d7a36ce33d10e087289fec798768564809dda4c26
MD5 bd5650a50ce8cb2e6e5cc4a8a9f8bfce
SHA1 0d03172c71d09f58448f141466409afead217573
SHA512 8288702fb25712f9decb7abee59ce97af798118ef1ecbf77aaac6ce7da8a91ad71703397cc0883873fa15d6135fe3dc0cf216e2fee7941c703d33789d04620c7
SSDEEP 24576:vTMdOz0FFS+1mSLEcnQ/tbw/2Mkjy6Fr7g0oY:t0K+1mSLLQ/lFTjN4
TLSH
T18E75E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 4d9be7a17a139de452843f85fb7ab5f17bbe0082e35903d36bdf4cafa973de11
MD5 791df61956a73e845b16b707cde442bc
SHA1 43df30852f787a2ba39344c53279c0eee8cc991d
SHA512 3111c0cb0b323d4a8f7daf73b02f6c20ada39ad85f3bc55ae1c8e9c088be3921b7412d54f7dfeef13a7e70634ba4a095e8b87248ff6a2afe67615f1b0215a97a
SSDEEP 12288:G4TBcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:FBcnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T12B55122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/856-279-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/936-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/936-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/936-302-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1200-291-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1204-285-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1740-360-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-364-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-395-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-394-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-393-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-390-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-392-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-391-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-355-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-389-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-359-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-358-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-357-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-356-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-354-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-361-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-365-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-368-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-369-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-367-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-366-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-388-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-363-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-362-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-387-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-372-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-373-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-376-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-375-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-379-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-386-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-385-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-384-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-383-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-382-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-381-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-380-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-378-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-377-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-374-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1740-371-0x000002613D860000-0x000002613D870000-memory.dmp

Download

memory/1760-370-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1760-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1976-94-0x0000000000720000-0x0000000000786000-memory.dmp

Download

memory/1976-276-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1976-99-0x0000000000720000-0x0000000000786000-memory.dmp

Download

memory/2348-477-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/2348-8-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/2348-343-0x0000000140000000-0x00000001401A9000-memory.dmp

Download

memory/2348-9-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/2348-0-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/2348-473-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/2476-110-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2476-116-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2476-282-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2672-274-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3100-272-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3100-39-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3100-33-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3120-299-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3120-467-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3232-134-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3248-353-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3248-278-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3372-283-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3372-127-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3372-121-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3560-284-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4156-275-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4156-87-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4156-81-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4488-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4488-67-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4492-63-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4492-65-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4492-59-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4492-53-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4644-277-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4664-298-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4688-71-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4688-77-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4688-301-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4996-25-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4996-26-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4996-17-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/5048-185-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5048-201-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5048-468-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5048-245-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5048-300-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5048-351-0x000000000CD70000-0x000000000CD78000-memory.dmp

Download