13abf04347c30feef7a45e455a40f4cbfad5d313081d6bc949d69f11655203ce

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample260420-rcfnhsgt21
SHA256 13abf04347c30feef7a45e455a40f4cbfad5d313081d6bc949d69f11655203ce
MD5 6659fc1c2391685d7eda6d6ce2e3abb7
SHA1 3bee4aebac338c60221d9dc4fe393e722ab55e5d
SHA512 5b173b7f70acd72da2603d140efc7e621de4ce23b804264ab61db34298ac9409f092592061e49f66f0ecececb72a8970e44db9b6dc28fce0a10ad52d9ee127c3
SSDEEP 49152:Cgh8jK3xEPK3Hkcm4L8A5ilefJJnB58MlSKl2HJpcR8OScKGCzLhK:CMYTKXkcmgfJiQ2O9C3hK
TLSH
T1B2E58D6D7AED00D6C175E1B8CC022791E2B2B825473145CB76A46E2D6F3FEE48E7D620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2672	alg.exe
3772	DiagnosticsHub.StandardCollector.Service.exe
4952	fxssvc.exe
3112	elevation_service.exe
3896	elevation_service.exe
5368	maintenanceservice.exe
2764	msdtc.exe
4824	OSE.EXE
4664	PerceptionSimulationService.exe
1132	perfhost.exe
4344	locator.exe
2256	SensorDataService.exe
5872	snmptrap.exe
1800	spectrum.exe
4444	ssh-agent.exe
4864	TieringEngineService.exe
5240	AgentService.exe
1508	vds.exe
1172	vssvc.exe
4728	wbengine.exe
5800	WmiApSrv.exe
1628	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7f147c4766859a32.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79593\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79593\javaw.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010018665ced0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd2a4f65ced0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000830c0a6dced0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e93c8165ced0dc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4952	fxssvc.exe
Token: SeRestorePrivilege	4864	TieringEngineService.exe
Token: SeManageVolumePrivilege	4864	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5240	AgentService.exe
Token: SeBackupPrivilege	1172	vssvc.exe
Token: SeRestorePrivilege	1172	vssvc.exe
Token: SeAuditPrivilege	1172	vssvc.exe
Token: SeBackupPrivilege	4728	wbengine.exe
Token: SeRestorePrivilege	4728	wbengine.exe
Token: SeSecurityPrivilege	4728	wbengine.exe
Token: 33	1628	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeDebugPrivilege	5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5696	2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2672	alg.exe
Token: SeDebugPrivilege	2672	alg.exe
Token: SeDebugPrivilege	2672	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 872	1628	SearchIndexer.exe	110
PID 1628 wrote to memory of 3536	1628	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_6659fc1c2391685d7eda6d6ce2e3abb7_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5696

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4232

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3896

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5368

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2764

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4824

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1132

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2256

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5872

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1800

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1312

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5240

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5800

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:872
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8a4637c4d4625b0625800fd3063fee290f6f0e88bddcb1c1f9ee90bda9832648
MD5 c75e8b2c08b124dfacf60bc356509333
SHA1 20b0f4f51eecc86e63fcfe50364ba6d36dbc1d46
SHA512 7dd0454156786ff649f2e58a7c04e9657ee0f7c3367642959f0a85fa6d5133ad193d25269e6686bc03152016340d4bec01012b0f583a27aeb7cf522735f14d08
SSDEEP 49152:ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSR8OScKGCzLhK:C3q6sjBV2O9C3hK
TLSH
T12AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c9174078e158135cbfbfeb3e6eaad555a292bbe8156ca4651c642f93f9dd00ab
MD5 688d49e7f1977ee37723abca35b08f59
SHA1 d310c7215ee07aeab050012bb12470377c62c552
SHA512 f45cf2eee4e003e9aab70a559dd1dd805301471061ce90c74f5c8e7f9b02b65f6c2ae964d2af5f421e1bb22fab3c83560097718550b5801b3545ad9442c93cc3
SSDEEP 24576:wXYfDtczABzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:Htc0R8OScKGCzLhK
TLSH
T15C65012973E409F9ED67823DC8A18511E77378554360E78F03A8A97A0F336D89E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6984b364c8b662c9e4f90a2d0e5bb68d71eab38ad61a91a6be57d9a2b270cf13
MD5 02a32db00ca3822287516d95b7d19538
SHA1 55c1399208fa9c39ec577079558b1e185e0e13cd
SHA512 ea265ed7eec38ebde42cd882ebf704c84d64d3445cf0167c13605e6289237cd462953186e1d5bd73c2a11a65a9c2f93e87b5c5445049637d95f404029a0c366e
SSDEEP 24576:+0Le5ji0hmxxrMqzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:+Pji0AjvR8OScKGCzLhK
TLSH
T1CF85AE16F6748331D073C0B9C5D2A69EEA71308657308ACB4286D77C6F67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 402553077e1c943c7b804f3d76437f0c40ce3d90b14899ed4079c11a1f387522
MD5 fd88a0a86ba44d8254ca2ba74306a301
SHA1 2c56de9c00dbb30a893eb3478fccc00cb8e710e1
SHA512 54fcb0d7c59585447f40227939e0ef6345ff298555e6c59065c6aecf8ecbc287b5fceed1e57c051feaadbaa398a6b60f93a2c81470901a5bf22f99a533c65404
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWn6q8wyukzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:d/ezSC6vUzPveHjyLR8OScKGCzLhK
TLSH
T17B755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5a395b9c2d005525b4b3b3aafc2c673a085696f6ae1cd0437b50c49282aeae3d
MD5 579ee9ea3a4da1445b556a2ed8e2091f
SHA1 d909124a5893dcfdbb1720f784fb06faa1e9e5c2
SHA512 d6fc4a08c22128e38d9d1d7bbdfb6aee3b43a7546eacb721d734648e892596e69d273f7607309d555246bf63a50f446ca8d8b97aa7720b2588926e340e641a04
SSDEEP 24576:qVbqPb88hv/l+YFzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:qVO88hXl+sR8OScKGCzLhK
TLSH
T1A255AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2F67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 96e0001f0ae23d296850f194dbc865341642e26d8d9e76a8b4c08e0cfb54d38d
MD5 05e5df368508abbf3e01955721eecf49
SHA1 4b0c35983a637af5cb072f40508025451883300e
SHA512 484165b905655afec324a45b6b7a410fb2bda09e015831ab1d199b00c8ff48bfb5b0652dcad4b604e1ce02af176f7fdac6a7fdb5da4942f07dbd4e44237041ed
SSDEEP 24576:xL+zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:8R8OScKGCzLhK
TLSH
T1CE45230BB1B886E3EF56823A11FC41F66245BDBD9090470D923CB6FE873D8D9D55A382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 72e57bbd372208f37c21902021347e3f43d0267275d2bcabab2d5ab7520f4a84
MD5 637d3812beb2305a76f18c3f7da5f9e5
SHA1 eee4afc613f9417c2ae6450a8808c74b23cb141a
SHA512 9c51804d42f796d2909c7d859a600c8d668f4a372ff60f84cffa7e9ef838af41ef1256419a9b658fdf6ae3da412dc01c43f115d73be639c1a868aa42b8884e0a
SSDEEP 24576:dJIU9zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:dJIU9R8OScKGCzLhK
TLSH
T15165CF3BEE38FCE2C27A8D7956918240E77278304B51A3CBD174924EDE235E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7d1590ab809f9da8c8c6353d2e204a24f56279a986360692135b60d1a3855604
MD5 61e6199c08f95211e56dd64aeefd34fd
SHA1 0dc5c0bb5909fd9e413ada892f4a9aba0f4d899f
SHA512 a000771655f2597ff5001761fe7c9365b3630b18584e3b0e5ef5ab249d4f74419fbf8142e667576c10023f53fce23db02aed98140a66a7e3a9fb4d328beb4153
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THx:OQvGAdlCEL8c/DRNw5CU2O9C3hK
TLSH
T1D3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 65ca8b85e90fc535aa36d0908c9590040d52d09a7568080a50f372a4a4765ba7
MD5 3a47244fc8839af5164ec017f4be39bb
SHA1 d35f4ea4983982128e720de7339169790b954496
SHA512 f16e2f87ca23c67bb00277f77a0a6609415e920e73d2e8439ceda0545a1a3f5476533168b63c56b1a32c7ac60dcb29ac3e86fbb491e54c69322d42039736cfd4
SSDEEP 24576:G0ewsAjfzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:XljfR8OScKGCzLhK
TLSH
T1B075E031FA74E436C77B0DB61B76C716142CB9204B511AC3E3B8AE9E4A342D26376B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 85b640056051e6348134c15ede31f182c8270966eb04a73f6fde7c1154240d84
MD5 56234fb14defeff15f4c7459c81991bd
SHA1 75cc0934350b75eeb46deef86b6cb3f096b4eab3
SHA512 8778287ab371441f427a410d162c85257f419fe43d2929be65ca4c7782b9f3bc162cdd30834de4643cd8e79194c881a2a577326223d3648638094f2a90d938b0
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHWkC3h:cUEtQevvqc2W1cpV2tI32Wksh
TLSH
T1ED474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a7d361f6b89b338046ec97eb068b1e0782462ff36baa7d26b97af23f7a8d6f83
MD5 97730e2bb1750385be975845cfda7aea
SHA1 5d3b79a3e70ea7e6ad09f6c9c603786e32f99ce0
SHA512 0a5694ca0b18a0bc4488a80962b4c2534686cb8a4097d871a1dc3207ddccf99cd98e9070706a82f89f409d7f6e1b6e54f9f7cbc13ad1a5f2020c75d843e32e08
SSDEEP 49152:WCbRquA/m2yL5zifFiV+XenmE3/z/R8OScKGCzLhK:boqHVjnmg2O9C3hK
TLSH
T1D6D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f39e2bed6846b97adf4571eab096dc6c6cba939c150c29fc6a38e1d5a6010ca4
MD5 dfd5ff9819a46c4dfa606342151646eb
SHA1 68310c38da8448ba75a8b2853207dadc05f83c3b
SHA512 18413dd18fa3fa9d02e1fa66bf956c85ee597fdfa164926c6003146e0b393c2191a03f8d10317cdf1c42f74cd835a67734292677617cfcb20ea12d5fc8544554
SSDEEP 24576:XAhGL3IFoiwtA5l7S53AzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:XAMUFoiq5QR8OScKGCzLhK
TLSH
T143359D81E7F955D4F5B3AA7859B68171EA76BCAA5E31C20F2160D11F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5e977b8de5e14d3384b6af91677edfbb04a48d8d08fc25143d36fd8ad9579845
MD5 20285f00bb4ac87f40b69f6d41443065
SHA1 050bc266c9a9fc11992119ec45ab2412c895b2c2
SHA512 9ab8fe33b5a9392fce7a51b2631f65e91bf296daa97bac2b535d510e3e03dc907e51d7593881878b49c9847a81087087b1c460a0179dbe4e9e80db09e7f4108e
SSDEEP 24576:Rwu4OWrzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:RwvO8R8OScKGCzLhK
TLSH
T1A265F14A72E40CFAE96782398597C136F7F2BC162621C71F1360D66B5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 dc4abc0d6e16fb8bb0caf9298d4d7a36783bb4a41b85e6cf1a6504a63d97b9c4
MD5 d8f8eea2b6ccc9c9d7d38faba1208b34
SHA1 45d71141f489eb4e2af32dd1b21cc1b21f14b37d
SHA512 35e558fd0566d822247c6b00a0c6c4ab5b5f1dacb7334cf972bd4e0a1cc9198e1afc021dddafed7fee01224f31f39a0ffb20df3f12da65847b4ce3f3f2b3d398
SSDEEP 24576:xZuCzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:NR8OScKGCzLhK
TLSH
T1C755124B32F461F6E653823D84F44695E372786A633143CF122872AA5F37ED59D3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 988dacbdc9b3ab4a34485de30f6ca88a5e5ab1d16f4d5658898968db699626bd
MD5 322357e821130453311a1f79832c54a2
SHA1 99ba0c2712a9f03d5099f920f725619bf5cadc80
SHA512 2b3eca53a1f562cc8740a61aaf6e4fc5c97e0263809fc97e675c5330fc5abd232e9d2c236406f85b678d2ae4602129f06e407ca76527b04b8301152ba41a2d5d
SSDEEP 98304:IQRQyi36YOcPbLvw2gAf+PN352O9C3hK:fQyiKa/X+PNIkC3h
TLSH
T1CC667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 91b13640c7ad8c857c4abeacd4a2436890e55b55ec8bde8f3a1aa9352ad6a2e3
MD5 9a103e00789c34224f6a23996e389753
SHA1 5a16df50d375b81c75c6a8efae2ad222cb3d8e7b
SHA512 97e0b72e0ba97a78da9fbd6c8ef992fe33072fedd8641d863d99e5de3b04a9c41412a192e2123cad0cdbcf04c59ffdb416011003dc98db3aa26e7b16f39571b6
SSDEEP 98304:FQRQyi36YOcPbLvw2gAf+PN352O9C3hK:8QyiKa/X+PNIkC3h
TLSH
T10F667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 28c1672261ecb53788a904add8d81fa26e70f118aee8b8b8f2a1a8b31330cf8a
MD5 c831911814109d4b9d1b01b72905db3e
SHA1 8aacad4ca4ae4f50926196a9468d7ff826aa2472
SHA512 bdf5a7768219ed7aecc5a9fcffe96c3e2390452f9ae83da587783489ed2bfc1cc3e4a64ab171358d5ebb006d97d3b04894df50b73857dfa73667290e3259c583
SSDEEP 49152:U68Qg55nhceWu7PNU3/vR8OScKGCzLhK:+thLRc/v2O9C3hK
TLSH
T1E2B55A33B2F600A9C44DD1769F4A873196D27C758FE0E3DB8115721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 25740aa72cb83ce95f50dbac70e71b196e774ceb9b7766d96e0ff88b297b8740
MD5 9272d439f86c6458f801b9f09f3a4627
SHA1 1b6865b033f7343c9b4190e0327f62d5e96ab47a
SHA512 ab0f219d70d29436ed095d7ceb6fcfbc6ef82c1d9ea0313432ede046e7b1d341302f3fb2f795428c4f9f87b2f95a17689a8450af9b59a8462e943c947f8c14b1
SSDEEP 98304:2y5112gYy5azzVvt69nLKnhZ+2O9C3hK:nLIHEWh9kC3h
TLSH
T157168B13F29901E8D01DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ddf3f3de1df2cca072f556eaba487774bdb2a3a5ec139f34113c6855e5cf12f0
MD5 eec242bc7d707809cb70b15cb014360f
SHA1 b289d3fe6cf17604cc7ca9b0baf84ce814ab9353
SHA512 1c61378e8926b3531263d3a53436b4dcda14c2d6fe3c04a75034a8ecaeca8271c77b2baa0f288f0724b06c8d35101047ca0c777adeda4d4d97dcb276e810327f
SSDEEP 49152:6B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glRR8OScKGCzLhK:ou6Jmdxd2dR2O9C3hK
TLSH
T128D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5f21786c7333d57efe445645be4f749ac400be2b047d3d3162d9e9c4c718834a
MD5 e07d769e0f3e8937e089420b286778ae
SHA1 0ec7da384d8abb0635bc4315c5be47d3562bb70b
SHA512 03518f50e5d9901a32aa2128d8d2a7d7601d5b1e5a1ca53ef1b0cd909f6241ea16ad9c3647ca3e3fd0ea79e5d1053fc47b8bb4c769c9b7367d280756c2881667
SSDEEP 49152:f1hpsNoJpF1A63U44CwH7R4xdR8OScKGCzLhK:fmifPWRg2O9C3hK
TLSH
T1EFB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 486193c7dbe5acaf1cea908fdc89f9aecfab753e57a276eaf196d1bfec12edc6
MD5 a646567ef7d294b5df8188f667631c79
SHA1 c664da2802324c2dd0603ee369a0edc653749726
SHA512 147281d4bd400c3c76d70b4ade6b1931a5d86556670c13024fe53836590d2f6995bc2c023550f873bccbfcf70e6e282c03c374c124c30aef68be0e782e3930c5
SSDEEP 49152:ISuZQIY0Be2KcRVtOnks6NMHqCR8OScKGCzLhK:S5dKii61C2O9C3hK
TLSH
T16BC5BF03F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9503d8f0c438330bb0e281f165fee5880a4ffde9c72a23a91b40b9db87c6456a
MD5 54383238f294ca29bfb9de9746c44799
SHA1 4243264910a0a18ae4278ef728e74a28662d588a
SHA512 ae0f1363db67a9bdb60dadb02be97f70788a017ecbf97e0005e22b1a07fdcade43344e4ef80f017db5b1a544f9b8f07a6bf49d60a14b933af54978290d2dfff8
SSDEEP 49152:ihtSn8EApI0fig3giDn0AP5wBR8OScKGCzLhK:DX2imphc2O9C3hK
TLSH
T17895BE13F2D901E8D05EC178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 648b21d8735ed6f229b1b93ceb7cf74e52784d5d1fdadf1a081e8ae8ffc7bc06
MD5 af683026f13ba03c369ceab5205d0a78
SHA1 08eac323d5a1226274c941336eab026f3995aca7
SHA512 ee980f9192fc01dd1d445859fb97e9adaea20242d965676da55aa98acc070830a8bbb1be9b714871e86534c73a20773e5edea85748a3c301a0adc0af01de2e9f
SSDEEP 24576:SWzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:1R8OScKGCzLhK
TLSH
T14C45230FB0F887E7EA01823A11F841F6A2497DBEA051435EB32D71FA8739CD9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 da627057b55fb4bdae7c5faacab0f180372f6acd0408350f9466521afcde5623
MD5 c738cbf497864ca1d33a59af18f8079f
SHA1 7fdf1143f4bc57846b25a9666c53c135c34968f0
SHA512 86dc788441354d43e1e0c84ccb895cc0c2059dc4a77c765c2b3024d249e9d0360d361b17afab6eb79a4abc81dbf1cb1e756a225f61dc5729a77b6e95ad5e08db
SSDEEP 24576:YTzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:qR8OScKGCzLhK
TLSH
T12245230FB0B887E7EA05823A11F841F6A2487D7FA051435EB32CB5FA8739CD9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a6b64ea01d3332122acff5db3b309df5e6669e58764bfad625d65d2c6c52b4c5
MD5 c028dc750e8f944f353646a179e45ed6
SHA1 97e6705b70df15ada1235088693796b2b8ae1c41
SHA512 5e2977f7d0867f81cf9950bb0d25997bc1cc034f8049458c5ff95236c52d84f5a70d01ed7d88b8bbdb77379c9d075a3d10feb814ccd47a03e54c72aae4f0a0cd
SSDEEP 24576:gVzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:ER8OScKGCzLhK
TLSH
T15445230FB0B887E7EA01823A11F841F6A24879BFA051435EB32D75FA8739CD9D55A3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ed3e0f14398353e4049f0ce87e725c66dff20851cc3a5ee09a7a0251cc0630e8
MD5 95d92a892cdc0f26cb8713aa2e931f33
SHA1 4474fe74b94638379f0d9e879c8a66e3f2f91e95
SHA512 fd8f1a6e9378fd1c300bcb09c77ff520962213aefc983274bee4a6d36c0799fdd1ab0543110436720031a89db8f727c73216e187755692837e7896065c764a69
SSDEEP 12288:XVG5zOQ5IvbFljqpayXyZQuX/9KB0GyR3sKf6FCv7yqXh1v0XOU6Gs:2zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G
TLSH
T17F45230B71B846D3E912C23941F941F6E3A5BCBEA021439FA31875EE4F35AD8D939781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fa7499a2e3faa5f2bfd3ad55c8c3304b4bd6453bfbd71438768763b8289f96f5
MD5 fb6d1cbe29f46245f976d99493e60cde
SHA1 1587396c3147c4fe1b87cc627133be76bb2ddd14
SHA512 6f76142abde2e4cfa968cee8280f7811f2099eef3f7d341531dbccc43f40f7c3790eca78c2587602923fd29a3cecd8925bfdae1966237fe8bd28b985b45cee66
SSDEEP 24576:RozO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:yR8OScKGCzLhK
TLSH
T13645230FB0B887D7EA05823A01F841F6A24979BFA051435EB32D71BA8739CE9D55A3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2445b1f2e30a95ae48c258e4685a35405aa94fff9cefda52f65e80a461c22311
MD5 8777a8af96efab00f9f3d2f12d49ac78
SHA1 5d0be7f200b460613065a98f862a9c7cd199c5c2
SHA512 64b1925746d6c9b74b3773cfb22f45aa3fc8c1a4bf8c3877188fcb98d12b043c5853ba9e2ab397393a8344bc414791590ba40da3d54a65292b8801a43d5ffa43
SSDEEP 24576:x3zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:BR8OScKGCzLhK
TLSH
T18245230FB0B887E7EA05823A11F841F6A2487D7FA051435E732C71FA8739CE9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 61e43e4c67efe357741dd77e589780d227d35d54e5d44d12f9c56ee780201de4
MD5 66ec9dcf0e9f6d63fa6cf8e6d723b1ed
SHA1 cdcc20045ce013c46b934cc84dfba0454affa36a
SHA512 7c123629156282b9bc7eda45c1fdea60f8dbb53f58464d03156ea1f1f34b5ff6c7a05bce632e10b305dd79a3b579e65ead273c09909ab5303bf24d7ffb1d85e4
SSDEEP 24576:Y7zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:SR8OScKGCzLhK
TLSH
T13245230FB0B887D7EA05823A01F841F5A2497DBFA051434EB32CB5FA8739CE9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f4506ab2a66ded5904273b0e318f43f9dbcaef2bb7096be57db4ca491e029ffb
MD5 c6e6f84801c428ac3a6403202ad05f08
SHA1 316ff8fe899c5525369ebd1523ff8d12f5782a80
SHA512 4ab259e3991ffc474c0fba59a18df827456deeb3b892d0e9bc6c51ed623e5c43610293bf846a52795f283c2ab43cc3d9b223f2eb5fc629ae3990f92d8b5857d8
SSDEEP 24576:1ZMRzFVSOzzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:1ZMRzfnR8OScKGCzLhK
TLSH
T18A650295B3A00CF5EC63823E89658956D2B27C6A0670C61F13B8366B5F333E15C3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 babc1a5711ba691d823c6f3a183010c7433ab9b6a4c4d5b64b210eaefbf855df
MD5 f2388bfac74f22eaf29398662c6bc137
SHA1 ac8daf4b9d5b03dc0014b6dc489c9c6b9afd171e
SHA512 9bad7965f79b66f3d98d257b35c2af9a566af092cde4d855759c81646900fda8656a83dac72e28eb6ebb86a76b1ad3f5f08a876d210c3657d8ef0e719744f2b0
SSDEEP 24576:VyzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:gR8OScKGCzLhK
TLSH
T1D445230FB0B887E7EA05823A11F841F6A2487DBFA051434EB32D75FA8739CD9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b9540b2a51f41c8ff906b9867a9fcd6b986c7a203a9bdfa82d1ecbef3279a35e
MD5 9d56e0915fa5092486017591cfaf0e93
SHA1 68861a67ad9cbc2f5fb597e9ab58896c6e8fa54b
SHA512 17ea389c01f906941173d06219843fd2ee4e22ca42813bb4e1c59eaa45790a9f052af0d476a26d6df11e9a1ef43c5409f29afeae529c9a93786530cfaba1b32c
SSDEEP 24576:DuzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:iR8OScKGCzLhK
TLSH
T1DC45230FB0B887D7EA05823A01F841FAA2487DBFA051434EB32D75FA8739CD9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 383a8a5b4e04dd623c29be823c6c12e47455dff86cf140aa496a85715ea2af4e
MD5 2fec68ca79f12653529e1d0ea104bbc6
SHA1 a9ac9e68b5cae397bf6dab2841ace5ef530e89ba
SHA512 829a4bf2cf0f4d26094dfa085ca5b7e47c2a46005e043c5e5b6cd55d4d0407adb6db61fa8093e17cb9a7c740c1af025355aa6fe8b041f27bcf3957f9b29d0a31
SSDEEP 24576:5zyPzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:5cR8OScKGCzLhK
TLSH
T19755120B72B431FAD527823984A50A52F375783A47208B9F536867BA1F376D0DE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2319cb5c6abc77968557e310770fcef59241e816836313525d427946caa2636e
MD5 da08aef68c1de50dabbdc9affb8e8f4b
SHA1 634ab672f9967e7f6565c844fb94e9ddada02889
SHA512 6aab49d6703ea5838572124010bb91b205ba6315785e2361d44e4fe91ecf528775a17ccf37d8c02ffda809a2a0f06e8be7cee34a6ed62fad0b897ac414673bd8
SSDEEP 24576:iyzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:rR8OScKGCzLhK
TLSH
T11545230FB0B887D7EA05823A11F841F6A2487DBFA051434EB32D75FA8739CD9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 30d1cb92c4cb0a8c0f13e78311b6002c5ad849d8ce658194303399e4169083d7
MD5 dd9a760686ffc37e2419d6bc8cf8a0a9
SHA1 50f2ad0606028525855f9c7234b362a919c2d2d7
SHA512 05fecd15250c0a1e83414e56cd5ec09ab5822688f786c9e810d2e736737dd1ba12b99d768afd75566c7298a55c1c7aface0f872904fa6aef615796067035539d
SSDEEP 24576:xyzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:ER8OScKGCzLhK
TLSH
T1D145230FB0B887E7EA05823A11F841F6A2487DBFA051434EB32D75FA8739CD9D55A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 28c787a1b73e94edd965f84816bbc0ed36871d77009bddd397c3f1af8413895c
MD5 b8f6996e5746b3d06c6a63a9f7eb8be4
SHA1 385c476e697160564e4d1090a52b5fcac06d1c55
SHA512 e065667c40e449e2d0ac577bb5cb046d761bccaf551fcf1d1b76f39fc742499944f5ac92c204ca80beb9b9b3c02b1fc146651adbfbecb1e60b43e80b49248ea4
SSDEEP 24576:pzyPzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:pcR8OScKGCzLhK
TLSH
T1CE55120B72B431FAD527823984A50A52F375783A47208B9F536867BA1F376D0DE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 fd8ae2e08ba4474c28523f2964df827e2a6eaffd7efb96ed46e2cfdebaa81210
MD5 3db06e021a80e847a9cfb0d5b8951a43
SHA1 801784a844edd90191d9cb10a1205ba0506d185e
SHA512 53ee45213270029ecbcd91fd64499f60eb91f9725e624a928fc712b9a5dd5efd177dc1fd012a3016f6184b738c7b4da1aef7e7fe9f5532dbc79b7e9085486363
SSDEEP 24576:McP4mcvIjkGOxhKP2l71SNKbrh/8KB6zO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:nP4m4IpOO67N8KUR8OScKGCzLhK
TLSH
T1A765AE2DA7DC0096D0BA913885658A4AFAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e4ae749c97fc6b193db5ce94360ed1efbdf094c198aa98dc756ab3b06c34eb38
MD5 a42ba21b496d7250f121cfe0df70be2d
SHA1 35792d30283c0d5100d5a1ac36cf62c56fd51957
SHA512 7efaa0898ddfd675e2166b45d613fad253c39f8aff8cad3652821fb94619962cd9ae67374fd22087feb9a97f2b3a08a2b2319a57121053898bd32e5c117ac74d
SSDEEP 24576:BCzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:sR8OScKGCzLhK
TLSH
T10155F10AE2A842E9C06E9239C7954691B3237C6983E1D3CB53D4F57E0F3A5D09DEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 beafd7beb2acf01773976c542d22fef929dbaf19ef619eaac426ac61d8e1db3f
MD5 619f1d3cbad1ba30946668b0514dced1
SHA1 6968a051c9e6fcb0e966d35391cb8e3316251bad
SHA512 ce3ef6582b6fc7a2d13e23c1db9d1619c18326259f146e62d266dfc7d3d22e4b65032f4ad4fa86c33ee7ca8e27025e6a3c938aa5e2bb19035abcf6a73399e0bd
SSDEEP 24576:TizO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:TiR8OScKGCzLhK
TLSH
T1A245230BB1BC8BD7EA66863501F881B5720D7A7D9450824FB21C72FE8738CE5DD6A346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 04b420746e3aed60be9510bd882cc7b87f8a3d006fa6409484a50049541adcf1
MD5 d3abf52c5dee03fc5f511629c916985b
SHA1 97df16b8bd6de08b60ef73a834c61796b02eefc8
SHA512 42f68b9b8cb54aa4a6b0a208610574ec6e0f91df1da8b631fd76a41cd011a5cd554809275b7f71913017755fca6a47e40caf5b5fba7446234c096bb5bf807e4b
SSDEEP 49152:ba0h2GEkuAe73q3pp46zwwQoR8OScKGCzLhK:ba0hNYG4JwH2O9C3hK
TLSH
T10E85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE48D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 6995e1bd9f5ee05acf28fb1dd4ecf2a75161805ee2602a4db5dfc5135ebc7372
MD5 2768694cf0373fbe0b45e9fd983b4020
SHA1 f648a26aefe09c2e2d06bb60ef4a97165826d57f
SHA512 d118b3bcf3212bf2b66260cb1642cd662bc6979c4e90057bacb011c1a76123df8d25f08e5d643e54187f7f3f845b26d5f323bc3a5cf0bc37f45fb40fb72c354d
SSDEEP 24576:ohbHjPjzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:ohbHj7R8OScKGCzLhK
TLSH
T14A55126E22BC11D6F572D23D41A5814AD331B83A131193EF2395A2BE4F3BDE49D39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 28ae1cd8f58c65bb3d51a8daea3ec049c71a30f2e8c84ade7dd51e754dbc2325
MD5 5576598395f49de1a151e815db2f48d6
SHA1 46af7357cda653bcad25fba3714314655ecad2a7
SHA512 2b6cae4c506a934fb2e6a65d191338f280badbf470b21b6354d9434cc10e8441629c9c7791b5a75632ca6bd52e90041ffdf3ab7cc60edd34d815e56b978678ee
SSDEEP 24576:U3YgnJcRTk4yti+R5dpR/rzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:UIgnaTk46ppR/rR8OScKGCzLhK
TLSH
T1D745BF2EF2B810F9D8A6D236454143B5FB71782D1F2096CB0174C538AF1AEE89E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 d5616fca2d44880b64126155baedee322150b2bd9d5eb6e4346a858049123584
MD5 049c0a2c1fcbaadc1d2fb993085fbbfe
SHA1 04514932a4b9827869dd4c1b04bc26d0943a32f5
SHA512 9134e1cf3a2f1eafedc96f9c8c0879fadb20db81af5195686099882ed96e03e1b1869c6a05f0526741725ca45ebf818ec33b41de1f3ee56b12210507f0f8ae86
SSDEEP 24576:0ezO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:0eR8OScKGCzLhK
TLSH
T14D45230FB0B88BD7DA15833A01F941FA62487A7D515143DF622CB1FA8739CE9D57A381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 ffb4721c5042ced6bf91fa7dd96d35d2c51611eb9e558eab65fc477e3f8e42b2
MD5 25933f4fa18117c255a8617f87458197
SHA1 dd39284736ced25bb0452357cf4c855d29f97755
SHA512 782310ec48004d5a52ca42c313ea1cfe3a0e72ace08787ba203373c8a8f608692b020795b92f9421b7cfdf89b32ff5a63961dc87e181e47f6b6d1967bb8d664e
SSDEEP 24576:zbL3UTBzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:zbL3U9R8OScKGCzLhK
TLSH
T18E75F159F6A400F9E967C13C85B68626E272B86D0360E7DF036C5BA51F237E58E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 66df78ff6f915bc491c921cc82c2f72d608cf88cf503fb21e1572e98e99ccf63
MD5 9d2e67e0e6d3f64ec871b2f6cb4dd491
SHA1 428c2766638ef5dd46c49b4b44fc1558dbbcc8bc
SHA512 79d8979af685973a0f99c4c11581cbd5b4c69df09bf11a59a45fb90e7ac9bf77c8e0fa25421723d57fa12bb7e3a373ecd23e6d71263b2d2efef3888362d425b5
SSDEEP 24576:xOdzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:xOdR8OScKGCzLhK
TLSH
T10555121E32EC10E6E536923D45D6825DD371B87A032253DF02A4A1BE4F67EF8AC3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 067f3852adc71142a5caa2607ad0b518e3e95171fbd51f1f9c7a94e32a99f83a
MD5 48d6c87f269bdf7f1b43f9ef56920046
SHA1 2854499a3080e67735abce3e36beebb3b412a204
SHA512 2365d3752dcb232a91f4733f8e1e46ecbe6ccc403b8b11c9a4d3f3d175f397fa48513bd67fb89e311e2862f51d026fbde05813a20b8645157c70aee94537655e
SSDEEP 24576:37NM9YmZqmWMUkPjZM48Mv6bEhsyzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:37cBWMpPjN8DbEhDR8OScKGCzLhK
TLSH
T12D659E2E6BEC81E5D576C13DC9E28246F2B1B4651B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 57d575ebd5bf520b5d963442ae0dae2e632fe1408a09540f2c396b6159dea668
MD5 0249e208c1a51130513d8b820ffa2bc4
SHA1 70b73ccb6fa9819a9f6d8eefa3f1d62e5736d8df
SHA512 e39c5577da2abcbdcc1afeb261ff382c9922079966cbdbb74a82f852fd9643bf7c5cdfeadbde6819de96a93963f0ba561c2fd35c4af319b30d758d3c0e4dd24b
SSDEEP 49152:pF2YuHNETovcvNYf8kmSR8OScKGCzLhK:c6tCf8kd2O9C3hK
TLSH
T14E858E2A27ED80A4E0BBD27D45F6D246FAB2B8551B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ead33a6b5dbe6652273fd7963c145b2b1730a5b3817aff08bb3b4e1c2801ff39
MD5 24df71d65e6f637296cddc7f354d1d7c
SHA1 aa0a0a979d2121f033e856f995c2c1e968de76c1
SHA512 aeb995e1674b8674a1e3a316cc388c65f669439f4105475da5fc062ad992f7000c17b4932fa2935cb4385f95dcd806510404a210ec97a25dc9374962d2e61349
SSDEEP 24576:uAFs06+OmlfkNXEbToZzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:nFs060lwXuIR8OScKGCzLhK
TLSH
T18F65AF2F62EC00D5D07ED17E8997C91AF6B1746703215ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 b6007457c95e04ec74250014f8caeed592c3236c73062994c9ac284f67b32ad5
MD5 0e5f327c50f61c698968f3b08d83ddc3
SHA1 6751e1bafd19bf02136bccc83de91145fdd05523
SHA512 f8d148b2f236ea60c62537b23d263da4371e2d7fecdae5d31d712d384aef706440ee9eda1212f4097e7cccf8c3cce79b4d980ad011f3b5408d2c6b78aca82d85
SSDEEP 24576:sJnJ5D3WtIzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:sJnJ5DGtIR8OScKGCzLhK
TLSH
T1DF75D02DD2A810F5D4B7C274819A1796FF72387D2B226ACB2478E5353F12EE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f5c773dfd17e9915b9f8e99e48d5f6c754d15c0046e1d178d3c33c41893d9f1b
MD5 05e492a30ed237b6b0e8c70531f241b7
SHA1 6bd8a2da07f0dd4bd65dc4e0a18acd3e16614c67
SHA512 291b6d1b5be497fea037e3ac0de6710addd5c7fe6fa9476198fcd49478f56c44c19fdbfcd553efc7c5a7471bc51449e648b4cb6e965e787daaa04d56fd0046fe
SSDEEP 49152:no06DIKdwc+eQnSt65aVWR8OScKGCzLhK:oM2O9C3hK
TLSH
T1A4956C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 d88e5f83a21a2a4a54a52f3749df59454d199bd18791ba135a2bdb33744df8d5
MD5 076bbe7c0a9633164aceb81ac9fcb86c
SHA1 590cb396977772145185c78159675b6f64528679
SHA512 6286ca640f92127d935b40e0aff480327a92a34bdd3ddd53a83387389addc6624b227c3dbe0fed48e5a3042822acf1d9c785faf3512b699f6441bd0dc2c81e82
SSDEEP 24576:orEzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:orER8OScKGCzLhK
TLSH
T12355125E36ACA0E6D526813D41E08295D372F079275223EF12A4E27E4F37DE99E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 5c403eaeb8b5514f40a3061f56703c56cac8ee3c5ae90aba0d202d128bd06363
MD5 a41e59ac5863cc4de64a20676603c4c3
SHA1 6f110b7822d2b0b20f3c7b83fe7d54829887dfac
SHA512 31b764f0ac678a883acc92f20bc62ac1e58d4e3a89ff1629c8e36f4fac40575736b5942ceeb2935005f15ff4daedcc25fe7700c7accdc9feb7c96f8f122d61e6
SSDEEP 24576:YIyTzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:YIYR8OScKGCzLhK
TLSH
T10E55220A73A891D6EA76423C46B681E59B34BC345B2043DF6194F63E9F36BD4EC35B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 13ec8806599e9c3f0933d27a70fcc19ed1bfd8118edff7758e553c6b4813124a
MD5 8a13a5473230aa544c75a5f74050fbdb
SHA1 fd40c03d2039c52c4bccc19aead3c1cae0ba0fec
SHA512 6a764b2ab57ade2f7238c3840ae89a76e3a4c935ce293820d4eda16c7263b29c0a86bc88178ac8162964d5a2aa81472b2103176eec302ed24e4af6e1993816ad
SSDEEP 24576:PNzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:PNR8OScKGCzLhK
TLSH
T1C345230F70B896E7EE12823D01F842F6A254797D521112EF62ACF1FACB398D5D57A780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d1afea1e41533d8518cf6e61c4ce41e55d535e4030a77c028af171e2c6b29808
MD5 0fd2d3955854c3e39da971ec0cd59238
SHA1 e35b01eb537302eacf58d674ce4f56983e96bd23
SHA512 8ca1b2db1c16e85daf592116316a609829cb75cfd2d1379492f17302afe38aa31e35f81883af9038bc131c147d35eca6479c4566921e7f46354fe60c95fe0e99
SSDEEP 24576:SQ9MxZKdcz97w3KzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:SVKXKR8OScKGCzLhK
TLSH
T15D557C2DABE905DAE177C23995A250C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 e5c1afd35c552c5584fef2250a89e9d9b9720aef600c4a6f676be4dbf5608f2b
MD5 ef7d93944afb231c52d0014662e337fb
SHA1 c69db2bcbbbabfa2683a1cbb0cfa26d5b83599ca
SHA512 4491d2067525c87800958fd8d35d0044e832df29928a745f49c7c85e820182b0f3124a20833426eee709113eeac546b81711b87b299cde0120e274da79db7974
SSDEEP 24576:fyocxApfzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:aocxApfR8OScKGCzLhK
TLSH
T13A65E01FB7AD40E2E166823C89858355E773B0345B6253CB6295C33E8F279E9BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 25b82121bf559395533fdc01b42838ca3abe88189755e63582ec65a9014eed36
MD5 1378d55d1ff8c1d438e7e668f0135ea1
SHA1 1fc3856f3971d70afc8fa4d19eaba8f54afc97b9
SHA512 87c00924095a7f4deedaabd0512fcfa1f5fa5b20442e4c8c68013d5d13797094cdff4e84e73f9461953b48c452adb7d1d46c2351310801f852dbb8d4e22d5d87
SSDEEP 49152:IWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKfR8OScKGCzLhK:q0zuNIb2O9C3hK
TLSH
T1D4A57B3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b19a6432e1bd1ef0296052d154d456f83ef685d60600fa5b6358b3af7e0d31f1
MD5 fd5aa71a1564a078f50e9214eb5fe27d
SHA1 3c9e88b1b84b12c48007e780f1095cff43d4ec34
SHA512 3b358875b2cad6e429de5a1a3de3956a45e8186099049d98031214542943d52b35e43fb1a359c9ef3a590e762fb440a5e232bdc0aa369c739ee44fcd3213493d
SSDEEP 24576:21QT7EcpfxR+N5AWAz3ooiYujMqbEzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:bTDxR+N5YzT4jM9R8OScKGCzLhK
TLSH
T1DB55B02EA7F815E9D17EC5799A23C512FA727821033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 bdaaad89ed51fa1075c0baefa2a597b44de8e2a24b24daa2859a4428a96f6501
MD5 76009773f788c3cf0b4712e164e84c7e
SHA1 107a83ce072a319b2ef366800fa69467296ffa86
SHA512 dac95901cff3737b6f7a53567dce6682682bfb7c9fa2b960825c875b7023851029650feb999c18b5b94a6c5800558d713f03347fcb1938a60bcf18a2d7a18a01
SSDEEP 24576:3TMdOz0FFS+bmSLgzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:F0K+bmSLgR8OScKGCzLhK
TLSH
T15475F13EA3AD14E5E43BC27D96538906F6723476032266DB0290D1BD2F5BEE4793EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 8b224c48808851a160f16bc27564299d1776ad76ccc34949dcf728522e185a08
MD5 65ca5d3d2c4c52b2d7ddcc931fec5716
SHA1 bd2f9c10f97b636c67e621412e8af404c3a6cdc7
SHA512 792c036f6c472620b319b95c60a02281225f33e96e44243a5bec25423ce7479c2eb28bf689c2fcbc79ff496fa4a5a437f00753d2f188167fc0fa70cd0eb51363
SSDEEP 24576:RBzO2IfjbyXyZTcB0GyDfrvuQh1v0d6G:RBR8OScKGCzLhK
TLSH
T1B555120E73F825D6F922823946B941A69270B87A132153FF31E8F5BE4F369D4D939702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1132-126-0x00000000005E0000-0x0000000000647000-memory.dmp

Download

memory/1132-121-0x00000000005E0000-0x0000000000647000-memory.dmp

Download

memory/1132-360-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1172-221-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1172-215-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1172-368-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1508-367-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1508-205-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Download

memory/1508-211-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Download

memory/1628-482-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1628-278-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/1628-371-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1628-296-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/1628-262-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/1628-252-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1628-457-0x000000000CC60000-0x000000000CC68000-memory.dmp

Download

memory/1628-246-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1800-161-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1800-364-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1800-167-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2256-461-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2256-459-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2256-362-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2256-146-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2672-22-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2672-13-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2672-377-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2672-19-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2764-93-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2764-372-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2764-87-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3112-48-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3112-462-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3112-57-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3112-54-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3536-463-0x00000286CD9A0000-0x00000286CD9B0000-memory.dmp

Download

memory/3536-471-0x00000286CD9A0000-0x00000286CD9B0000-memory.dmp

Download

memory/3536-469-0x00000286CD9A0000-0x00000286CD9B0000-memory.dmp

Download

memory/3536-470-0x00000286CD9A0000-0x00000286CD9B0000-memory.dmp

Download

memory/3536-472-0x00000286CD9A0000-0x00000286CD9B0000-memory.dmp

Download

memory/3536-473-0x00000286CD9A0000-0x00000286CD9B0000-memory.dmp

Download

memory/3536-474-0x00000286CD9A0000-0x00000286CD9B0000-memory.dmp

Download

memory/3536-466-0x00000286CD9A0000-0x00000286CD9B0000-memory.dmp

Download

memory/3536-467-0x00000286CD9A0000-0x00000286CD9B0000-memory.dmp

Download

memory/3536-468-0x00000286CD9A0000-0x00000286CD9B0000-memory.dmp

Download

memory/3536-465-0x00000286CD9A0000-0x00000286CD9B0000-memory.dmp

Download

memory/3536-464-0x00000286CD9A0000-0x00000286CD9B0000-memory.dmp

Download

memory/3772-32-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3772-34-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3772-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3772-442-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3896-62-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3896-69-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3896-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3896-479-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4344-130-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4344-361-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4344-136-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4444-365-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4444-178-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4444-172-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4664-114-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4664-108-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4664-359-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4728-231-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4728-369-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4728-225-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/4824-98-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4824-104-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4824-358-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4864-182-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4864-188-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4864-366-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4952-72-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4952-38-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/4952-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4952-59-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/4952-44-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/5240-201-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/5240-203-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5240-198-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/5240-192-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/5368-480-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5368-357-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5368-84-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5368-80-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5368-74-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5696-9-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/5696-0-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/5696-8-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/5696-56-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/5800-370-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/5800-241-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/5800-235-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/5800-481-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/5872-363-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5872-151-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5872-157-0x00000000006F0000-0x0000000000750000-memory.dmp

Download