9f35c91efe6b9565a4722e00c11cc6fdf971cbf6d69db44d6ebc01f06126bc73

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample260417-ege7bshx8s
SHA256 9f35c91efe6b9565a4722e00c11cc6fdf971cbf6d69db44d6ebc01f06126bc73
MD5 4fd6c1a23ebf2a25b596f5461a19d2e6
SHA1 4cb11c087f1891b880971db82f7770a11c485739
SHA512 8f1cac10bf17cd6a68c4171746915c6a1b516c520a5636799e03ba23bb93f8cf2da669e53e58ea7c39eb0608b80113d19c9cbecaffdee16c34ca0f6b380518e0
SSDEEP 49152:sgh8jK3xEPK3Hkcm4L8A5ilCfJJnB58MlSKl2HJp7tJqwYB+IZY0nGMAl6I19X:sMYTKXkcmEfJilJqwYB3ZY0nGM3o9X
TLSH
T1D6E58D6D7AED00D6C175E0B8CC022791E2B2B825473145CB76A46E2D6F3FEE49E7D620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3944	alg.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4532	fxssvc.exe
5020	elevation_service.exe
1188	elevation_service.exe
1308	maintenanceservice.exe
3760	msdtc.exe
5508	OSE.EXE
3524	PerceptionSimulationService.exe
4088	perfhost.exe
2040	locator.exe
4168	SensorDataService.exe
3560	snmptrap.exe
1148	spectrum.exe
1504	ssh-agent.exe
2824	TieringEngineService.exe
2864	AgentService.exe
5816	vds.exe
1064	vssvc.exe
4076	wbengine.exe
64	WmiApSrv.exe
5064	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\65abbd41fd664f35.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84265\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84265\javaws.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f32398f01dcedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000833d2ff01dcedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046a796ef1dcedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082f4a4ef1dcedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003318eaef1dcedc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e72bfdef1dcedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4352	DiagnosticsHub.StandardCollector.Service.exe
4352	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4532	fxssvc.exe
Token: SeRestorePrivilege	2824	TieringEngineService.exe
Token: SeManageVolumePrivilege	2824	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2864	AgentService.exe
Token: SeBackupPrivilege	1064	vssvc.exe
Token: SeRestorePrivilege	1064	vssvc.exe
Token: SeAuditPrivilege	1064	vssvc.exe
Token: SeBackupPrivilege	4076	wbengine.exe
Token: SeRestorePrivilege	4076	wbengine.exe
Token: SeSecurityPrivilege	4076	wbengine.exe
Token: 33	5064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5064	SearchIndexer.exe
Token: SeDebugPrivilege	4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4256	2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4352	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3652	5064	SearchIndexer.exe	111
PID 5064 wrote to memory of 5532	5064	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_4fd6c1a23ebf2a25b596f5461a19d2e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3944

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4480

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1188

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1308

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3760

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5508

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3524

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4088

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2040

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4168

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3560

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1148

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1504

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1728

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:64

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3652
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a173594e650aa92465289871a4d834660f52a21b95552220938b7e4cdaa84d63
MD5 96063b949e3fd5a593f24539a3a8e6e2
SHA1 fbea55ef6d7a861d63f47f21e289d1908a0c1dcb
SHA512 a3a4edd2258754314e77420429dcafe7d0f8febe792ff0f2d857359ef5bedeca42f04257582067027607e025f1754bbd043279a12ee76236dabe671683b7b367
SSDEEP 49152:xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnvtJqwYB+IZY0nGMAl6I19X:33q6HjBWJqwYB3ZY0nGM3o9X
TLSH
T15ED59D03F2D900E9E06AD578D7469133EAA2BC890B34B6DF0780B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 35bbf325fc5d0e32b8b50836582bed7dd367d3f74511bc58543872cf081fb704
MD5 47ff5bdcf6f5092c3e847c5bce86f6b6
SHA1 990afcea13d03871e438459f234a78917b76e675
SHA512 f4a591c40fc0adef63a65197ab4c0731a537a88670867c7b90aa5615fa2a68e47216c7d4849c82c0f3cab779539e90aa8285918622f7a82628875f574d298177
SSDEEP 24576:CXYfDtczAktJqjcYYTI+IZY4jxBRvc3cAl6I19G4:Jtc1tJqwYB+IZY0nGMAl6I19X
TLSH
T1A965F128B3E508F9ED678178C9A18412EB337C5547A0E7CB03A4992A5F337D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2e9b71f415fba072d2d4f0ed9f77c539819ea2932347cf5c7f8146931418313e
MD5 97e5cf2a29fa4a4eb2ab203255a9acbb
SHA1 eeb4f232f788ddafd8967bab0351465f1e7d9851
SHA512 7baba5b4def4edf926693afbd2f21c98be0a3e3b1f704ea17d12466fb0ecd325d896b494628546bf5a86b9cb8d50e5a4de7252c9b22ac1813f4762366e447ee5
SSDEEP 24576:P0Le5ji0hmxsrMXtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:PPji0ASetJqwYB+IZY0nGMAl6I19X
TLSH
T175859E15F6748335D073C0B9C5D2A69AEE7230861B308ACB4286D77C7E67BE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bdaaeb5d3538487a8f9e387deb0337b65dbe368bacb17214cb958607f5243284
MD5 04e82cf0db9f9dc356eb030aab32edbe
SHA1 f26f0c7cdc5859797302d3e1f579ce29504ff2d2
SHA512 8c8abb4dede243667d0ab6a3199fd29ad5cf38f384453a1a269d18b5dd5f2a586903211ae30137c1fc4eb629dee8b49628d66fe4b67e201a5d1f8c0ec4612408
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWE6q8wyultJqjcYYTI+IZY4jxBRvc3cAl6I19G4:u/ezSC6vUzPvxHjyStJqwYB+IZY0nGM+
TLSH
T1A9755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f02179aad899de86706e647822cf350bad66078a1bbe7223ba448c1a7c6b4d97
MD5 44ec504c3e09c714919c6c702b7ce396
SHA1 153ef280b2fe1c05363d28514d4a1c17a45a953c
SHA512 15e3e2b5d6022093f1cf34ea295092a36c38b8a5e36eb633a93deba5ac5018cf400482ee0beda1f555130d76e012770b7a5e2ee7faf0e26c6fdc3d2e6adbb7d6
SSDEEP 24576:SVbqPb88hv/l+6QtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:SVO88hXl+7tJqwYB+IZY0nGMAl6I19X
TLSH
T1C8559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BE5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 175c1a63b03f0f803c0a142b3be331bfd7a5bceccc655151ba60111b509d4c5c
MD5 d56c2fdac0cc4b6f90f02580a0ec3f8e
SHA1 8059278966eea1f25115e4068d0914fc6ce1b947
SHA512 710e921dcb3c20a1ff9339320ffdad90c1c97d54128fb6c544dc895afdc7233296f232acbf7dfac7451ecfd2c0e0bd10aed56a1c98c645a465c8293d79e3dc5f
SSDEEP 24576:ijztJqjcYYTI+IZY4jxBRvc3cAl6I19G4:AtJqwYB+IZY0nGMAl6I19X
TLSH
T15A45235DC31E851AEB1A4C70F2D890A36B3BBD5C0AB58ECB8B083D4E95B8AD4F095547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a4001a65652e749fb7c02b6e795632472b622ba5aa5fff97f8fa1266bf2ab46e
MD5 80e7d4486040aceb423dc4904e725cce
SHA1 d0f8a2cfaaade749888bd6fcd77241213d7adea3
SHA512 2b59a872624be104d732d3e67978a856bd1c48df8982fe5e18e98fbdf4a285d26f51e80e7698411f0e0e7b0d57ebfc0145fc21c26577db8ad14419acdce05ab7
SSDEEP 24576:kJIUYtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:kJIUYtJqwYB+IZY0nGMAl6I19X
TLSH
T12A65CF3BEE28ECD2C67A8DB85791C640E77278704F62A3CBD165820EDE235E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 86a88bef83236b1e83f6997d014a466e3941733cf2a5aafb49ddc1dea3dd335b
MD5 b948335ff0e6f607db37f300055d1d0e
SHA1 c3ebe9bf03ac2ba35ff89b4e2ee07a526a51d5ac
SHA512 cf2e8acf3e3e94329ee0124d4beea3c41ec2784f3f8ac8bf2febc078fe637a5fcff1f0089b5e7f0793abec8fb817dbc876f2bc663f461c5ed75bf477d4821560
SSDEEP 98304:XQvGAdlCEL8c/yRNw5CzJqwYB3ZY0nGM3o9X:AvyEYc/y3w8zvYBYM3o9
TLSH
T187266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8b13b2ec6fd4f22a8d0ff4aabcc27a821f924d4667ea41f5c03c6a13d89ae994
MD5 db10b2ed4a5cd86ab75b391745c40733
SHA1 08758ef3203420dd50d2bb65a29da6acd523e2bb
SHA512 68a0ac42419538b0294159af79bb7f23ef3d71bcc3ffe89fee4ab2664912a5c11782142212edc43c9ab6d49cd56b702c2d69a6ed376d1754f27dfd53fbb0d081
SSDEEP 24576:oXewsAjOtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:GljOtJqwYB+IZY0nGMAl6I19X
TLSH
T10075E031FA75D436C77F0CB12B66C716183DB9204FA11AC3E3A89E9E99702D12376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7ff49c192e2700f7ddaffb051bf9636d99bb59ef6e6a8a903dd8e165139ab268
MD5 4649ca75976df9be33cf7a1afd47e8f1
SHA1 d6f73b77653a928199dccc4e7049fecb838be369
SHA512 67ff8c1116fe96ef8cc7d2645b2bd8b37e8155afd635a9447d2391324a3ca2520872ddcfb437626911618c973880db7805b37f08943a78035508afcfdd6ad2f3
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHMvYBYM3o9:1UEtQevvqc2W1cpV2EI32Mm5u
TLSH
T13A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8f32162d265adcd18fbcfa591699714c6d2aeac129109449b2bafb445fa5b57c
MD5 559cd6d0589c6869b8c34105d462fa44
SHA1 4bab9f39b9fc1e7b10ef5f9ff999bf3fb26882b9
SHA512 60e0905a136cf574944c0a8826ee60602c7af3d48fae8183a652596f51f9cf3424a0e1d90eb665adffd9ffdaa3f112f9acd70a3c6a83e3c3a36daabea506a324
SSDEEP 49152:2CbRquA/m2yL5zLfFiV+XenmE3/zutJqwYB+IZY0nGMAl6I19X:7oq2VjnmfJqwYB3ZY0nGM3o9X
TLSH
T114D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cb7b96f13165adf4a8dadec94867453f98f0d8835e697d561bfbda3b934e8fe6
MD5 fb482513ca4aa26bdc532b968684f992
SHA1 70c7ce130d9843888b1783b5f24a96284cab70e3
SHA512 61ea64d2629192f55f9a8d51c26dc4027d08c1ddb5dcd51a90666bf68f30e509159b12e633a159ae2af257fecafca82b58bb728a47d7fb1044b2957c686feff5
SSDEEP 24576:QAhGLJIFoiwtA5l7S53ptJqjcYYTI+IZY4jxBRvc3cAl6I19G4:QAMyFoiq55tJqwYB+IZY0nGMAl6I19X
TLSH
T11D359D81E7F945D4F5B3AAB899B69171EA76BCA95E31C20F2150D11F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 aa0037b8c26869f86131178958ab3db3362b1cec39739f8c7ba015d5b6879ff9
MD5 369d20211e38c5d8d273b2fc3bab0882
SHA1 330becb2d88d607c4231bc3bcd60a5f05d8439f8
SHA512 7306e8ec5110a37b01be28d661e22d0bb41fb3f90802ff7d99f11f5d53283ba8e3021ad8f46c517082e847917baebcffd0e10e512a2d78c1527768add803b699
SSDEEP 24576:bwu+OWytJqjcYYTI+IZY4jxBRvc3cAl6I19G4:bw5ONtJqwYB+IZY0nGMAl6I19X
TLSH
T11A65F14972A90CF9E9678538C697C132F7B3BC052A61DB1F0760C65B6F37360AD29B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6441ecfd872f654e25fc502ac1f25a19ea87793a9697543a8ad2416a3d85605d
MD5 1234d788655cce6007328145f60bef6d
SHA1 85553530a951fd266b97ce783d23170084f57a22
SHA512 fc9dadf653d743a5fbcabd9ce346835240d1093f2d0e8c11800935bd366f5e9bffaf2bd4fffabb725756e9795247f8537467ffdf598d8f2ba71172a8a20f2b57
SSDEEP 24576:0ZuftJqjcYYTI+IZY4jxBRvc3cAl6I19G4:JtJqwYB+IZY0nGMAl6I19X
TLSH
T1B555125D23A850FAE6578578E6E08542E7737C5A277283CF07044A6E6F73AD06C39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ac54db5751d933b71942f28add130fa3a87184ff306a242f0518c6af1f244587
MD5 e4f483fe243598226df62573d013bb23
SHA1 ac3c240ec0a784bd3187fec36ce408fa0b3c11ea
SHA512 85b3a97c46cc100df4f7fa2ede67d3d56eb660c354a28879397c8547e6a78ac592755cb28e567ba15e6c2d1fdcc4ccc4a11a320cb4f9f496920cd35b0f389efe
SSDEEP 98304:yQRQyi36YOcPQLvw2gAf+PN36JqwYB3ZY0nGM3o9X:pQyiKayX+PNKvYBYM3o9
TLSH
T188666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 582c81a7f3e08205830114dbab9c18db37df2e3cfb3ac8253ee4ca92e2c316f4
MD5 23883b9c75e100d3a26b3f9dcf432182
SHA1 71af9736f36468f8c88f55f703eb6216f0d7ac07
SHA512 78dd81135364697b40ac3a0b9d4b67ccef9ea164bc81814cdaa9e9f976344ebb264c39c0105b99ab5f9a37157c1a6057a0c163265fff31f2a7eacc72d470d561
SSDEEP 98304:NQRQyi36YOcPQLvw2gAf+PN36JqwYB3ZY0nGM3o9X:kQyiKayX+PNKvYBYM3o9
TLSH
T1D9666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4b05a71b52a94401dadf7ea6a459bbfe8f29222f31d0257a61ef9ca6cce64fcc
MD5 eb387ca256722ae8e18f60d688ca57ab
SHA1 97530c2ca3d848005e61291488a817afcb10c974
SHA512 5a4df8034a26b3abcd579663f7bb6f1c41089be8b494536131770b6e8c6efc03c6568e89d6b57588d8b5586d766278d692c9b84312679559f2c8e7cc8544a243
SSDEEP 49152:068Qg55nhheWu7PNU3/etJqwYB+IZY0nGMAl6I19X:ethWRc/kJqwYB3ZY0nGM3o9X
TLSH
T164B54933B2F60099C44DE1769F4A872196D27C758FE1E3DB8505720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d625e54de82a298b5bd45f8a9ced487544304307b01a0ce36c62b2900ccbd85f
MD5 f2691850da2441f63511a3b16eb2b819
SHA1 3e02faf6a5ef8d26193acc9b89b82382b3b84b0d
SHA512 67e6f80249fe5a39f451e2e67dffc197d5a9953f79a900c7c47def438921c59c9db2a700fdcb43f2f55ef7d47647e3660787b8bbd4bc6706d0a24502582d329a
SSDEEP 98304:sy5112gYy5azzVvL69nLKnhZhJqwYB3ZY0nGM3o9X:tLIHmWh3vYBYM3o9
TLSH
T106167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4d7597156fd1839369835ebed0598114a2d9a144a807c79ff476f11163a4d946
MD5 21516a162f1f777ce8315df88b54741e
SHA1 e1d35689b5879ae5c1a3ae2be0ab5cb179be6b22
SHA512 00a2ad4d5f81149b537d920918a64bf3fa86518d723dea2381311f1e71abb321ccb239e5e4e5b682151c0130136896382122e1b914d2153563f6d4e9bbb6644c
SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl0tJqwYB+IZY0nGMAl6I19X:Ju6JmVxd2diJqwYB3ZY0nGM3o9X
TLSH
T1B9D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 97d73e181ae92dabca49a9b6fcb0608113dbd9664960b3ab6d86e1f192955cf2
MD5 00e38e4d2a4e1bb7840942343856c303
SHA1 548563cfda1753cad4c9d52b9910633ee2eede10
SHA512 4a7700f9c64417811f119f522449b604ce44e97eb5682b06cbd50ba7c6cb1d1b72c45287796bd5a29522338e632ebcf93b2fc5f661329ada157637c80d0249fe
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4x4tJqwYB+IZY0nGMAl6I19X:4mifPbRfJqwYB3ZY0nGM3o9X
TLSH
T1A7B5BE13F29900E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cad30e30f45f8a56294984922a642fe4df5d2594d809d70ebdb927c420aaa8f9
MD5 2d1e062800f39f703d8dc241f04e14c2
SHA1 738c183e8379df6d73308f43b1e0e5ff7580d4ef
SHA512 46b04b8e19cd0ee8fc5a2c704e5502c83d4425be0bc8df9049011cfd231a5824d75a4f2ac988ececc7c21ea80de85e1a4cb8d1671d09399a723e164ec6961279
SSDEEP 49152:NSuZQIY0Be2KRRVtOnks6NMHqftJqwYB+IZY0nGMAl6I19X:D5dKTi61FJqwYB3ZY0nGM3o9X
TLSH
T157C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a03a6b3ad59151dd240f321c4421a01bd040ea9f58e85163287a89f51f216440
MD5 caf7140109481abcf06f68b8b52d2b4f
SHA1 8adf561c2424a25bbe45c7ca85a5888aea8bf0ff
SHA512 db195291b1ca137f1a2fb9139222cde9bba9fd1ca150c5a8f6d22657b6af14c177ccbcd7f0aa9329d39321c1f2c2464890a4b21f3bea3d4fecfce1cbffb15e18
SSDEEP 49152:mhtSn8EApI0figngiDn0AP5wktJqwYB+IZY0nGMAl6I19X:nX2iyphrJqwYB3ZY0nGM3o9X
TLSH
T1D095BE13F2D900E8D05ED174C7468632EA72BC150B39AAEF0A50B6561F7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e9c292a55a9c54da94898845823705cbfbad053c42d7c7d84b17996e30045f5f
MD5 9e43ef2cb7118df043005e6736f252a4
SHA1 775b96c112188b6ac0221d8191f1c059a53addb5
SHA512 fcf6b484e9d0de621f56b73bfccaa42719ccfa11902801c615dcfe49181825e7ec67d874156308d75c5a6de4e8c6ae850f1b70fee65dc53a44a565c465129ccd
SSDEEP 24576:P7tJqjcYYTI+IZY4jxBRvc3cAl6I19G4:DtJqwYB+IZY0nGMAl6I19X
TLSH
T1FF45231DD21F890BDA058CB0F3C49093AB3F7D5D5BB54BCB9B0C280EA6B4AD4709594B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a289646b75ca327e1efcf1f397706f54b30176f3749d7069115955ca71fef1c6
MD5 603396c554d3d4fe337388510b817e20
SHA1 62e29cee14df172dcdb520f2894331b292ba93f9
SHA512 fda3deb5ed0453c19c6b204d5002a82a6409cfe4b8ae937fca7ded6ca19d8db208f3ed5a4a02e1ca6bfbe9de59500c183b1137136bfc139dd60d537c999ce5ca
SSDEEP 24576:qqtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:htJqwYB+IZY0nGMAl6I19X
TLSH
T15745231DD21F490BDA058CB0F3C49093AB3B7D5D5BB58BCB9B0C280FA6B4AD47095957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4b2de59e1c55e29af2ef99a61e439c8c10340cede19cc181ba67b28ea13c84a7
MD5 7712419c7e5694f1ecb597673b6d2fb2
SHA1 52741326d3fac42382479986eef644040b4a0d57
SHA512 942fdbd5b43e4cc778c703e3518bc90718ba6f138ae0d3a8351c38d8e6d504b2067b2a30b24c5b84366640a26f79f7918cd6b28757fe1bbd30f3c1082da71275
SSDEEP 24576:CgtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:ntJqwYB+IZY0nGMAl6I19X
TLSH
T10945231CD21F450BDA054CB0F3C490A3AB3B7D5D6BF54BCB9B0C280EA6B5AD47095597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 812becdb4561be56ad4a7b0aa31d238d5624d46a98621253db93a2092f1ff6cc
MD5 1bfd20ce6e8fb07df0969f6351eb4727
SHA1 4ee69afaa4f36a50803c6618cc0c117deb1eb30e
SHA512 3cca3f52d7477184a4f3face72c66712da21dc900a0cfe03ed022cd0e29006b223bc2e323190c74aa76dcc4b531199911f32d8b850fe3aac304915678a3fc602
SSDEEP 12288:pVDtAuJqji1vB2Z138bTItz0IZ1po4jxBRs2163cAl6IRb17mF4:ttJqjcYYTI+IZY4jxBRvc3cAl6I19G4
TLSH
T16A45231DA36E418ADA16C8B0E2D19063E77BBC9C5B728BCF8B041C0E5EB17D4B474A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cc19926962232caf6069be436e757909426588644425d30f44b13816fd3de4c6
MD5 2df49f5c9c51d2f6b089390d1c2f2731
SHA1 5b9e7403ae7fc1c63d2ab830dc3471ff98b567b7
SHA512 91a66e0a96d20494f7a991f102bb79ac419a290f5ff6b1ba572762130fe80776a25168867d8ae9d8fc1ed812fd362d90599ee9e9731b91c710f7bba6b899d4f7
SSDEEP 24576:/BtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:ptJqwYB+IZY0nGMAl6I19X
TLSH
T18C45231DD21F850BDA054CB0F3C490A3AB3B7D5D2BF58BCB9B0C280EA6B5AD47095997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 95998d0d16cf416dda47e2dab38a55d5ce48ce4707a810d2e7677495b5abc6b1
MD5 96eb2730630cf38a2b47db863f97a070
SHA1 d2baa1982542fdbeb675deb4af1f4403331c496c
SHA512 be5988f6a61357a528de7e2cd55ac385d8f4ced398324c146c018812b7537cc6bc42e265673dcaaf6bd49f152df5ef6c43d661285dbd59b503d7a9156d007891
SSDEEP 24576:P2tJqjcYYTI+IZY4jxBRvc3cAl6I19G4:utJqwYB+IZY0nGMAl6I19X
TLSH
T1ED45231DD21F490BDA058CB0F3C49093AB3B7D5D6BF58BCB9B0C280EA6B4AD4709595B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2b42f4232d45a1a6164fce494a5b67b973cc0e41178b12956acdbc4790bf99ca
MD5 f471fdc77cac95105d306255e4c6bdaf
SHA1 4c16947ee192dc06555525b92e79815c58678b8b
SHA512 472f3bae04f615771879f5045299a028c9301f012dabd9eed00f5f92f7270cab17d2d72ab868aebba9355bb58b03414ea7cbdddc49600fe99ba347c389fac66f
SSDEEP 24576:GCtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:1tJqwYB+IZY0nGMAl6I19X
TLSH
T11145231CD21F490BDA054CB0F3C490A39B3B7D5D5AF58BCF9B0C280EA6B4AE4B09595B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f4cd1fcce5f4b21b2cf80ecf4e2d84e160f58bab449433cad1fcfb27bdebeeb1
MD5 1de44fbdfb983fed6085ad1e89baef58
SHA1 c04f862ae35107f74262d9c8f39f2749e99d5409
SHA512 ac30c36ce23c80462400878b566b23e384093338d4efcc50ff6926626e2ffc2a2d384fd6cf6f80ac7254509ab784a0097f8a01a916c4ef5c0471567c9ffd933a
SSDEEP 24576:mZMYzFVSOKtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:mZMYzfmtJqwYB+IZY0nGMAl6I19X
TLSH
T1B7650199B35408F8EC678539C9558816D6B37C590BB0CA5F03A8362B5F733E01C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2eb6190c130b64111d6c820ce2a9c5c0049676945c68f1f5c0684714800457cb
MD5 df768a561d7c862332b495a1800c8e8c
SHA1 62c079a77251ef6a81f37fd2df1d497681cbb789
SHA512 af1a53ecf0d4f74496024329a663c7d098a622440eadfc887d7f350b928af29040b66aeb9d6d4c06be7dde9b610e4a9690664d01d48529ce5dc3c88b1fc96cc4
SSDEEP 24576:sPtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:QtJqwYB+IZY0nGMAl6I19X
TLSH
T1AC45231DD21F890BDA054CB0F3C490A39B3F7D5D2AF58BCB9B0D280EA6B4AD4B09555B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a265d7f0462d0ee1f1f3d023753fbacf3cff959bb0927b1d4a17115cbe0a4c40
MD5 11e9c8956d456a64a24ef76bb7ef8401
SHA1 d5a4a1e17266cfff4b54e49a57462df75813de76
SHA512 548a990da86fdb5da4c30ae4027cbc39cbd1a86bdbc2bc8e27870a0c8161b6944317c2e5d4e342e0cf55ff53b2abac15d3eab5a0230e6f9a463ec680d8d32994
SSDEEP 24576:hjtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:JtJqwYB+IZY0nGMAl6I19X
TLSH
T15A45231DD21F490BDA054CB0F3C490A39B3F7D5D6AB68BCB9B0C280EA6B4AD4709595B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e7e144ef2fd22f24ab082586acfc59ed1e47a889c5a3c39918ddf8d3971d4d47
MD5 11aac41bc33e379ee86108f972e2f571
SHA1 d7e93dd1dcdee7db15d7ee123f01190bcf4fc322
SHA512 b3546ac2575b09833d220bbdd3a47a1171540ee56cb3cb10391656def39fa4b4aaad13e16adecb2025ee79e63f03862f0a750c5fe31dfa476d09b3f42af27391
SSDEEP 24576:yzy+tJqjcYYTI+IZY4jxBRvc3cAl6I19G4:yttJqwYB+IZY0nGMAl6I19X
TLSH
T19C55021B73A620F9D5268134C9D11902F776BC360B708BEF5714067A2F776E0AD3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 82e429feceadda00af5ae78c0757e53d02a4d4586f73fc644cdbc9e3ed99f20d
MD5 0d15b46a357097499a78f941c8880ff6
SHA1 d2f4ad321de4794b4656182c0b8ab20e8edae60d
SHA512 86cb09e8b209d3bd7271a901e7433ad34129afde663a9a51575931185e46d2108a8f96b5c09724c1de1905c62394d50c84d46169aa286225caf880c69e04ce42
SSDEEP 24576:0PtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:4tJqwYB+IZY0nGMAl6I19X
TLSH
T18F45231DD21F490BDA054CB0F3C490A39B3F7D5D2AF68BCB9B0C280EA6B4AD8709555B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e0fe8f07b8f5ef1045fe4c520209698d21b4079558fa62bb20af0f01b8b293cd
MD5 323c63bb43c2ccb7a676f03f9720dae2
SHA1 e9276f407189b2978ddcac07b8a809b019f2395f
SHA512 b5117f490ec05377c56679371b2357606a9d9c94d4b6beac7c31430ba56dd3fbb4ec96c249bfc90a6fb0911cb7864f30014117dbeb83e72c828f92ea56c0e98f
SSDEEP 24576:yPtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:itJqwYB+IZY0nGMAl6I19X
TLSH
T10445231DD21F490BDA054CB0F3C490A3AB3F7D5D2AF58BCB9B0D280EA6B4AD4B09555B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6282bebbf61b34d1bd2accba8d4696c58682c635ef01be95ab5849d904ec0e60
MD5 6559a46e8b577605e82918cfa2774752
SHA1 ceb1e24c0a4c62472fe4869d8346def20e8f8d97
SHA512 848128c663fffa002e46cd46207a547b7198566b70caba00c62a8588d4931e8a94f5d2bcf4a325c6f8cb683f47ca8dded3b967eb637adbf8135bcc6b7898f969
SSDEEP 24576:vzy+tJqjcYYTI+IZY4jxBRvc3cAl6I19G4:vttJqwYB+IZY0nGMAl6I19X
TLSH
T1A155021BB3A620F9D5268134C9D11902F776BC360B708BEF5714067A2F776E0AD3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 bee1b22d920b03fe1e21e3b12ab8892e7ac215ea18873a69c5cf9f6ea0dbad54
MD5 bcf00b3d44e24ffcc8df1fdbda770cf4
SHA1 5d2a809164e0ba5ca6f5bd9b5228f34ee25c0368
SHA512 39f53f132e676e2411b0e2208f56de513fe751a1c98bb15db8c61e813c1aca752270b79009e01224e1c8d61f25db560d8f5712387d34d64293db07bbdc3cdab9
SSDEEP 24576:+cP4mcvIjkGOxhKP2l71nNKbrh/8KBntJqjcYYTI+IZY4jxBRvc3cAl6I19G4:5P4m4IpOO67W8KVtJqwYB+IZY0nGMAlV
TLSH
T1A065BE2DA7DC0096D0BA917486A58A4AFAB1742E1F3286CF1160933D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 afb67586a69b5134f7dd21eb8ca023ade2c7ec4ce09b90c088644c5f9f87f69a
MD5 fd8b91fddd85c94336da8afe611868f4
SHA1 f790257ccda68e31668aa8de4f00ec8383e17495
SHA512 9431c62ef6b7b449776afbc5bd21d3f158be0e46e2ef4b370f76b067b48970dfbe7bdb8b6cf1664e27bee2e712babbff7e358dc60fc222427fd9d5a10ffe1244
SSDEEP 24576:RftJqjcYYTI+IZY4jxBRvc3cAl6I19G4:NtJqwYB+IZY0nGMAl6I19X
TLSH
T19C55F019D29802E9C16EA174C7958642B7377C6987E1D3CB57C0F83E1F766D0ACEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e960c8bfcf61225c819f2432ce350e124d61325f9b853b18c5cddbe6e5319f83
MD5 cd7f142c6879ee4d909a0d8ecb8cc9d2
SHA1 bfb38267fc24a1d1a223911d9c4a66640c391157
SHA512 f377e10e76917d85fadaaf7cbd4fac3e015c0d9a9b831e5ed012d902e825dd49062a18df25139c5e39eae58c55ca40ec44ced0e6ba4139d1f73da6e81b9510c9
SSDEEP 24576:J/tJqjcYYTI+IZY4jxBRvc3cAl6I19G4:J/tJqwYB+IZY0nGMAl6I19X
TLSH
T12145231DD35E890BEA6A4C70F2D4C072273F7D6C1FB1CACB9B08291E95B4AD4B46560B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e56463adaea19cb618e77a2d7e6301336d2d2a899ea7aa2c1e7cf70b4f928e44
MD5 f16744d78e0f37de4d7a4cf5c48cdc11
SHA1 db788474487f067e2545642d33e54499706a7ef0
SHA512 585630eb88f5c7f0e3b54a58b3c75b68c9cd457dc99accf4437f824705465cb2d5c9921d7ccd87e3fb7b42a37c02a10cba8134b4377d39a50ca23dd7a634abee
SSDEEP 49152:ta0h2GEkuAe73q3pp46zwwQBtJqwYB+IZY0nGMAl6I19X:ta0hNYG4JwMJqwYB3ZY0nGM3o9X
TLSH
T140859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 3ad98380f9397521fd6734ffd2e3ff4af0a3ce8215486b0bb614d16a9ca47e98
MD5 b9c49ac0b9cd89fa84e64c0ca09a28be
SHA1 568a704dae428271c33def3dbf0b7e8dbf450121
SHA512 91b428b254ab4c51d8eaf2aae077133bf916693d4383bccc3c23573baf19748658afb81ce0e4c6ac9225e70cdaadabe3841f79382481f250e4e6a8bfb3850445
SSDEEP 24576:ahbHjP6tJqjcYYTI+IZY4jxBRvc3cAl6I19G4:ahbHjCtJqwYB+IZY0nGMAl6I19X
TLSH
T10C55117E62AD0099E632D5B8A2D18107D732BC291B2197EF1785817E4F3BEE46C35F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1302fe2b903416b7ffc8be7053269da2c92abe93b087f16720f69e5997a211d2
MD5 f00d1b9fd6141492068bcde1740e72cc
SHA1 9e6492fdc4fe46e89f77841119c76dac1d409038
SHA512 4a38dd79bc91d28acb0d33727b352056730c8d543134b392feb247f573aa345ede625b0942c4888e7b164437106bf1428334db2f62d5f1714178af9073071333
SSDEEP 24576:K3YgnJcRTk4yti+R5dBR/ytJqjcYYTI+IZY4jxBRvc3cAl6I19G4:KIgnaTk46pBR/ytJqwYB+IZY0nGMAl6u
TLSH
T1AD45BF2DF2B910B9D8AAD136854143B5FB71782D1F209ACB0170C538AF1AEE85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 5bbac115fb965b6f110fc377f2c72598307bd180756ff9b7c411018c40b6de40
MD5 63dcaa666140a26739e6fa6d6c80191c
SHA1 a466271bb0e260affb491884b6cbee801f51b0ec
SHA512 aee367a9448f4c6221ccdf12a6045ee0ee3a703dc0a3963cd69425e4abc058bba2fbdad96b17f3fbd55f0cc7f51ad0afd895bf905118257561336c4af63e850e
SSDEEP 24576:9TtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:9TtJqwYB+IZY0nGMAl6I19X
TLSH
T1C545235CD21E890BDA158CB0F3C49063673B7E5C1BB64BCB9B08281F96B5AE8B0B5547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 3c2d8445d82ebc4a7ac9e42fb2299cd992e95c689d9e79144712523a96e7ce94
MD5 966b155cccc196f3daec816be8b1eef4
SHA1 07ab5ae78d6d6a3a5b369591fb441d26b7feab59
SHA512 f141610dc3094772d68c81ffe5b7d5dda5d1c56105f94401e8ce8f276d60f2e8ea8e2209a020ffcc99a14ded13394754f15b2894c41e69068ff278aa97198f3a
SSDEEP 24576:3zL3UTktJqjcYYTI+IZY4jxBRvc3cAl6I19G4:3zL3UYtJqwYB+IZY0nGMAl6I19X
TLSH
T1F1750119E7A900F9E96BC13CC5A28513E372B85D0764E7DF03684A6A1F637E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 6da59327c574fb8bfa2f4bc843703442d93d85c5482c9b10b0c99eaded85388e
MD5 e63ef209705d07dbbcf80a10440340e0
SHA1 03dc55c65c32b041bdb926cad57a2adb72150d7c
SHA512 48b5dc18434a1adc009795c8af78ef37bbbd6446d296da717cc029c5c0306c59c868a2e317f39f85e45149ca9a416d73cd066393433b8a3f217616d64e866b04
SSDEEP 24576:vO4tJqjcYYTI+IZY4jxBRvc3cAl6I19G4:vO4tJqwYB+IZY0nGMAl6I19X
TLSH
T15A55022D33AD00E5E5369578D6D2820AD772BC690B2257DF0780847E5FA3FF86C39A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f4735ea5bf0a0f3093ec6743b173b1e5c793f5f44ce2b7328f4b22640bc58397
MD5 3ab9f45da6d9519c410e378c00526a05
SHA1 02537541d0d3e12da6443fca94e23d9f0e2bfb5a
SHA512 d3c88f6c0e028cde2a41373be891d0c9fbdd04d4c6f5844e06fd6c090da8758f37424bcc80748dd1b0009d8362bf751170e5a6207881eed9a079243bdfa5acfc
SSDEEP 24576:E7NM9YqZqmWMUkPjZM48Mv6bEhsPtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:E7cBWMpPjN8DbEhatJqwYB+IZY0nGMAz
TLSH
T1CC65AE2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1252833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e42287db7f78bbf073ee21a6638df7eeb9ae2ea2122d4415804a9d37189d198d
MD5 c270f6db9f883407e3ecbc50fc8e38aa
SHA1 de0064326ccc74adb94ce8cfc6efb98869907271
SHA512 c2bbf7e50f28e37e5f0bf7646b93d81074ce812c3a4930ed00f8b3bc35ce1f5ef4f8d44f55d655a857b7b242bced3b48292953b0ec5afe6c8c3baec93305d186
SSDEEP 49152:FF2YuHNETovAvNYf8kmvtJqwYB+IZY0nGMAl6I19X:g6BCf8kuJqwYB3ZY0nGM3o9X
TLSH
T128858E2927ED80A4E0BBD27D85F6D146FAB2B8551B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 fc8280cda72ac61a0feb337f194e06842985a46a7e2403260f590b59c1354edb
MD5 37065e16d56e9a090e6d32ed9700d988
SHA1 10971fef6e258fa38cec059e16d6fdf7b3452b9b
SHA512 e6b41e40e7cbae981e5c23a03d22d6f09cd2f598a14edc5256e03d2497a1a8d4a2e5fa788c1c17d42dbcadeaacb697349cb704157b0f5c332e9e9d771fb455c1
SSDEEP 24576:pAFs06+Omlf3NXEbToMtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:uFs060lVXuhtJqwYB+IZY0nGMAl6I19X
TLSH
T11465BF2F62AC00D5D07ED17D8A97C91AF7B1746707255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 0206d5f0238815a6fec01181516824a046b9d28853ff3f45b841787a104d69c8
MD5 b201b6204c0d6de4dbbb747aa54221b2
SHA1 71ef4bf8d147cb81d394bd664ae7ac95a85cfae2
SHA512 2962c3b8762fe1aa0a4116b908fbc58f882826ad363a46491ef544fd480e12635f59dbb2697c2e75c07998a16d64424864aa2b89d8de35870e2d2b14e4a82ab8
SSDEEP 24576:8JnJ5D3W6htJqjcYYTI+IZY4jxBRvc3cAl6I19G4:8JnJ5DG6htJqwYB+IZY0nGMAl6I19X
TLSH
T1C075E02DD2A810E8D4B7C274829A1756FF72383D2F226ACB1864D5357F12FE0A979F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 552d37c173c9502a8d2610948bd6ce9be139bddce1844384b98d4809910d3f15
MD5 e8578151d8d3365367fde73409520f1b
SHA1 c843707f7d370bfe1bf5d6a39efff7bf3208b538
SHA512 32b2a25ad2d567455aaa4947018d43d198dec60db646a051fe542dac9bb8e481b4dce1ece8364f6d8be929700e06491ccb58f910d41577f285504da0709b952a
SSDEEP 49152:/g06DIKdwc+eQnSt65aV7tJqwYB+IZY0nGMAl6I19X:4bJqwYB3ZY0nGM3o9X
TLSH
T16C956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 c7ab772f385146c3bc0c9f7f93822f8bd4e9b0245c4f6eba95e1253fe35b8d8e
MD5 3cc8ed41e0f250995ca85135ee987aab
SHA1 3ae0f6001797cdd261bca89491a69e58e96ddf0a
SHA512 dff815f3f727667c7e1773d674172354f1f9ba5d9f6e342ff785cbab7c3314d34da00bca8c10b02813f6a8e168fbd882a591d0e561045e218b67d597986e6549
SSDEEP 24576:gRFtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:gRFtJqwYB+IZY0nGMAl6I19X
TLSH
T10955126D63AD60EAD52A9478D2D08146D373F8741B626BEF4741C13E4F77AE86C38B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 397ae385a2b5a38bc25eb185f234122fb663f476de67aeeef4a3fd7a43cbf680
MD5 04900dc73c286fddcb3964fea151feca
SHA1 b8681acdbd89215d8cd4cf76a66a705fee35ddcf
SHA512 5caa3e04d1b2f340bdd092da02962c73307b1d1459989caded33db931a6cb615230f3d19abab5d571326b1cc2f30b5093721f38a4cb05fb80924223c6cc40a4f
SSDEEP 24576:bIyqtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:bIxtJqwYB+IZY0nGMAl6I19X
TLSH
T13A551208A39C4489EA754974E6E281A19B36BC241F3197DF5640FA3F6F76BD4B830B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 e47a402c966d5afb15712bcaa5ba2b255eb920328e480c73f0ba215c4c047725
MD5 e17739785a524e94437b5a60441bb7e3
SHA1 a4fb6657534195e4e563bd275cc0fe0a1c215f5c
SHA512 ce836bca91b878228332a41c470cb3715c11250098c6cc2870b78dd8661340d687880c79cd6b38dbb2708fce843a1c050599a627a1bc09b42ae3be302ad53428
SSDEEP 24576:iotJqjcYYTI+IZY4jxBRvc3cAl6I19G4:iotJqwYB+IZY0nGMAl6I19X
TLSH
T17A45231C922F451ADE064CB0E3D49063673B7D6C1BB15AEF4A08A83EDBB5AD4B0B1D47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 f42da784d5943911f417dda3f87f4cb2fc54e2ffae9391886c955d6cc30aad1d
MD5 0f45a10d0c49d0531f3a90a3a55105b6
SHA1 708ba792b4a948a2b850c0a5b43e5a680f748365
SHA512 757d7701856799d2c5f69d122d1567ffd038929f276e581e901b3d292266ee63daf5b12007d90c1e5fd43b836e708ba951b6c9efa4b863c05bfedebf88f66671
SSDEEP 24576:4Q9MxZKdcz9dw33tJqjcYYTI+IZY4jxBRvc3cAl6I19G4:4VKZ3tJqwYB+IZY0nGMAl6I19X
TLSH
T1EB558C2DABE9099AE177D275D5A250C3A633B4301B31D6CF2448D03D4D7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 621e3cf9667e6136597e1066c278b261a227f6d95eb22568017c79d59e8867aa
MD5 9fbcb1fe0525f7c47e04a9543b6280ce
SHA1 c2d0d8de088e0137eed65c45cc2d9ab887b14aad
SHA512 ed1a8ccdaab788ec262f67cdb1f8c933c8c7c5e08006be62d9ac677f4f29a0a07ac1454337b452aa83c6be5c2ef07ecfb71e31b76a8ffb5d7381d743c519dd13
SSDEEP 24576:kyocxApOtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:ZocxApOtJqwYB+IZY0nGMAl6I19X
TLSH
T13F65E01FB76E40A2E166813CC9858246E773B4341B6257CB5681C73E8F77AE8BD34B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f16212831f953fac37503718c01c3cc3e5af6f9052b89b373a9172b4fff7ae3d
MD5 4a946455e2c5e69a6cee54348d08d9b4
SHA1 9b4facac0249eab9a15cccbc7ef1e877055b2da7
SHA512 40b6f63a34f5b9d1ff8b6bd496a8a4c555a40a8bc2589f7850345e5d7f16fb974f1c4a7f5896b3f35d48e515e11bded9a81f0ae11c14dd0b9261d1efa3ad40e4
SSDEEP 49152:gWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKOtJqwYB+IZY0nGMAl6I19X:S0zuNISJqwYB3ZY0nGM3o9X
TLSH
T107A57B3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d35b1feb433c7e42587c317f4c7057170cb617648842b1624b3c5331da6d3fcf
MD5 fc8f0b93f199139b545712df0ee5e819
SHA1 fe086d5bc4697fab0921564695a78e7fcda59459
SHA512 a7ac49fbb0c5b7680c868a1f1b5c5a342d2d30084ba6e217bd024dfe9b06fb950c7fa9a4a65947da1c684996182c8a691bb283b4cf01cbe2c32a1d16be7d2dbe
SSDEEP 24576:31QT7EcpfxR+N5AWAz3ooiYtjMqbFtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:KTDxR+N5YzTfjMYtJqwYB+IZY0nGMAlV
TLSH
T1F155B02EA7F905E9D17E85789B23C512FB727821033193CB42A0C17E1E6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 6723f562295d0df73a3b3ddf2df2f27e116de4b7e5cffd6384478dfed08d48aa
MD5 da4b5b9e4dabab72f4d9235563481df0
SHA1 67522ee89e9d6fb56239061f4029467f1b671122
SHA512 8879a6208d75ea6f88b25f56a7a1c3fea10a3cef8162b3be395b19cb8a979e08055c10b133c591a84e104f8b36ef54791accd3e00461e396ce7ca06cdb77a1df
SSDEEP 24576:LTMdOz0FFS+4mSLJtJqjcYYTI+IZY4jxBRvc3cAl6I19G4:Z0K+4mSLJtJqwYB+IZY0nGMAl6I19X
TLSH
T12575E13EA36D04E5E57BC17CD6438906E67338650322AADB0690C07E2F9BFE47979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 83d92ae4cbb7af3317935310514fd82c2860b0283d3a96cdd21fbb8c43601153
MD5 b6aa7b016de526a616d15abc87e86005
SHA1 b5f0fab04187e5a34e1eeb825c80a9361768687f
SHA512 fc753e87c37ed1970c88ef229efea1fcc1916a69edd21391510a18ae400af97dacef6d9926a7f9e25b524ed6271da538e5ed99b9cb1be3af35d0579d2ac9de51
SSDEEP 24576:YktJqjcYYTI+IZY4jxBRvc3cAl6I19G4:YktJqwYB+IZY0nGMAl6I19X
TLSH
T1B155221C63ED2099E9228570E7A641529732BC3917715BFF2A84C97F8F76AD4E438B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/64-206-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/1064-202-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1148-126-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1148-377-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1148-120-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1148-130-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1188-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1188-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1188-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1188-222-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1308-69-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1308-62-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/1308-67-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/1308-57-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/1308-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1504-397-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/1504-143-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/1504-135-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1504-141-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2040-128-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2040-360-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2824-209-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/2864-150-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2864-149-0x0000000000590000-0x00000000005E6000-memory.dmp

Download

memory/3524-91-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3524-358-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/3524-97-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3524-90-0x0000000140000000-0x000000014014C000-memory.dmp

Download

memory/3560-129-0x0000000140000000-0x0000000140137000-memory.dmp

Download

memory/3760-72-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/3760-332-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/3944-101-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/3944-13-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/4076-203-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4088-359-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/4088-109-0x0000000000540000-0x00000000005A7000-memory.dmp

Download

memory/4088-104-0x0000000000540000-0x00000000005A7000-memory.dmp

Download

memory/4088-103-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/4168-427-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4168-131-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4256-71-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/4256-9-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/4256-0-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/4256-8-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/4352-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4352-25-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4352-102-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4352-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4532-32-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4532-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5020-41-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5020-34-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5020-35-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5020-208-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5064-169-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5064-185-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5064-207-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5064-204-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5064-356-0x000000000C910000-0x000000000C918000-memory.dmp

Download

memory/5064-429-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5508-82-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5508-84-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/5508-76-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5508-355-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/5532-385-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-379-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-402-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-401-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-373-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-374-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-375-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-376-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-371-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-365-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-366-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-362-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-361-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-399-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-400-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-372-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-368-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-396-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-394-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-395-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-378-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-398-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-380-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-384-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-369-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-387-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-388-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-389-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-390-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-391-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-392-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-393-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-386-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-381-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-382-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-383-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-370-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-363-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-364-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5532-367-0x000001347FFC0000-0x000001347FFD0000-memory.dmp

Download

memory/5816-201-0x0000000140000000-0x0000000140147000-memory.dmp

Download