42c55a07e2d96a1ff10ce2c37abbf50cab97b3ff1f410d251b068df3d3a0499b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260425-vrml6aew7x
SHA256 42c55a07e2d96a1ff10ce2c37abbf50cab97b3ff1f410d251b068df3d3a0499b
MD5 538ecdd537db8de615e62474c4a41721
SHA1 61465997ad126a0aaa68aea2f1b561232b5ed0e8
SHA512 c86629a1e96a146335669e6818a27084a3af77066475d564600c3a6d26ae626d345a5b814bdb19641b031372374b7a570fe74792584c16992ea20ba4ae6c9bf8
SSDEEP 49152:3vmHGcnO2EvU/bMvo/SHEif5YL8NnjSzjNCWTPp8N7s8SJGADmg27RnWGj:3TvUko/SzSj0I8NiBD527BWG
TLSH
T14A1629ADA6DE00C6C070A4F4CD065795E2F2F864833149CB15E81A1FAE7FEED4E39664
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2724	alg.exe
4708	DiagnosticsHub.StandardCollector.Service.exe
4124	fxssvc.exe
3956	elevation_service.exe
3216	elevation_service.exe
560	maintenanceservice.exe
2524	msdtc.exe
1620	OSE.EXE
4792	PerceptionSimulationService.exe
2584	perfhost.exe
752	locator.exe
768	SensorDataService.exe
1172	snmptrap.exe
2732	spectrum.exe
900	ssh-agent.exe
2884	TieringEngineService.exe
1636	AgentService.exe
4144	vds.exe
4416	vssvc.exe
4436	wbengine.exe
3952	WmiApSrv.exe
2252	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\341631dcc8368bef.bin	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f9d2997e9d4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c922198e9d4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce709e97e9d4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081ffd198e9d4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b59a6797e9d4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000e76297e9d4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4124	fxssvc.exe
Token: SeRestorePrivilege	2884	TieringEngineService.exe
Token: SeManageVolumePrivilege	2884	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1636	AgentService.exe
Token: SeBackupPrivilege	4416	vssvc.exe
Token: SeRestorePrivilege	4416	vssvc.exe
Token: SeAuditPrivilege	4416	vssvc.exe
Token: SeBackupPrivilege	4436	wbengine.exe
Token: SeRestorePrivilege	4436	wbengine.exe
Token: SeSecurityPrivilege	4436	wbengine.exe
Token: 33	2252	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2252	SearchIndexer.exe
Token: SeDebugPrivilege	5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5000	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2724	alg.exe
Token: SeDebugPrivilege	2724	alg.exe
Token: SeDebugPrivilege	2724	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 460	2252	SearchIndexer.exe	109
PID 2252 wrote to memory of 2548	2252	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4932

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3216

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:560

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2524

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1620

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:752

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:768

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1172

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2732

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3792

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3952

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:460
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b9a99143d6094b16ae2e13fb5334de8359aea414bf606db1f62b47741934fc3f
MD5 3891ce75853d57572fefab8f0389a5d3
SHA1 57cfc01661476137e0d247b71be40d2d0ae3cee9
SHA512 268783598a8970086e9d0bc974121d53edc1f5cfc90941f0d6f1a438540a7f3171d123eba93dc91c418c7c8f66933dad14d12deafea8f41791b46aa4cced7781
SSDEEP 49152:wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnLDmg27RnWGj:a3q6sjBwD527BWG
TLSH
T136D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 53c8da0d0654bb1220173b5d13aff0dfaeb9ad60fb710a2efb31e8110d6f8e50
MD5 4d54058150fd82622ffb92623cad0e9e
SHA1 8d862208f328010ba5a5a2c4788ae8e52bbc6e37
SHA512 7d13552d04ccb9450233f5fa5880b7562216f5d9888dbe6eb8880837f37c8396ab0b00d91daa806ae1c3076dc51296d24ca08cf717f426d0f4d05713f7aefd13
SSDEEP 24576:+XYfDtczAQsqjnhMgeiCl7G0nehbGZpbD:dtc5Dmg27RnWGj
TLSH
T1AA65F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3c66ac871a3c397891f016dc9decd4134db874ebfa393b91e9fcd905318856d1
MD5 3a68b7f9fe75dcf012846365027edb3a
SHA1 fe6cf72f437c04e87d5e75dff2a494eff17e179e
SHA512 810128d0bdfae148893ccd383af76b8a7cd3f3eada9f27c5219e939e9b9163d592b52443a6a432aed05878cb2d3ce145d1445d21691574e1d5e1a2b84617f26d
SSDEEP 24576:Q0Le5ji0hmxxrM/sqjnhMgeiCl7G0nehbGZpbD:QPji0AjeDmg27RnWGj
TLSH
T1C1859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3444fe9f3594f07ffc69b03e3a0d8aca8ccbedc63de032f60fcd68f8a868e91b
MD5 1239b78677fcae67978dcb728a228b42
SHA1 36ee93a05b919abc75764d8ba56fd102e0c194cf
SHA512 f725c4b71d9a2363ce6951f1ecf3c059248486eac6a52b11d99d668b41ddc5c53b2c359db91ac66f4d4f276c8d1d3e90569dd3569219fb04c7dc3a4407dc07de
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWn6q8wyuVsqjnhMgeiCl7G0nehbGZpbD:X/ezSC6vUzPveHjyqDmg27RnWGj
TLSH
T130755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ad9d1e255dd9682add57a72887ff386137dbfaef566e7faa68f83325a10c9126
MD5 b82b3d84b7a71a7aeed63fbd3ae652b3
SHA1 a10dc81f7ab648b4d5bbdd614fdba0975b220210
SHA512 4312b1e1ce7a2192ca9a7b54e30dccb9ebc477ac0ea9415571e31e9f82e9f22dda77ee5319fda160809403f12292032c66d8e714d570e7d56da92f634b3667d8
SSDEEP 24576:aVbqPb88hv/l+YksqjnhMgeiCl7G0nehbGZpbD:aVO88hXl+RDmg27RnWGj
TLSH
T1F7559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e7b4460526af32528341a6049644db9e8c8043ea3d77f92bff6df49023b7f6f2
MD5 de549b19feb89b7722eaf2807bd13bc4
SHA1 d46803ccd83a0fc3e1e092a3ba3e41b038905079
SHA512 d09e0def8ba74f4571b3f3cc72d70fe79c33aec459c7d8064bd345fea5ed7ff08a32c19bbc248db00a2fc209e79644f37f7748ed1f4d304de99db3fec8357d3a
SSDEEP 12288:+LTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+LTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C54523BF864C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c6176a3c286d6dcc82f22bf8ce46b7a9d6c122c2fc7bd7c181835478349e11ca
MD5 03482052e8567aa887901c2d76001ecd
SHA1 3311d9e1b44e2ca7c8c012236a93e627857719ca
SHA512 a685fc97eaf2f5039fc53ea50956ea557a99115ed2321c5f3cd7656234ff1823ed8391912480eae6eb56cce8824a17effe5dc38f6d6a66ff8c919860b69be595
SSDEEP 12288:9eBNUbTVO86UsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:9JIUssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F065CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6e1849eb9d4d42c7b652804af6dd4c1b7295b32dd9179bb6e16cd93d7e58f117
MD5 e00b7de730579273aa24eec68ac7e81e
SHA1 21db4b1a86f8c3e274955b3f2c7182a7b5199920
SHA512 fba8a8ffe7a60c0d7ee5566c5d943705886e4b594d9dbfd64556ba5a22289456323837579910703fcf31ed0be4f77d0aa1752652eda16443df87054831305048
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THD:aQvGAdlCEL8c/DRNw5CZD527BWG
TLSH
T175266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 78e2ee410786f63c9370cb0ff8d5031c25f001c9adb7304cf9f5d042ee0277a6
MD5 dc111e9bb5fd5f691c0d42a1012c31a3
SHA1 05b37c4efd54e9e82c7725a4292966ca447b4012
SHA512 9124963dfb6e419081b9d8184325021af2fafef04ceb5e8c4f3a6500078bdffc3436378df1f511bfef6dda02fb14d44f8f694dd8ae99b1f5ba5551d4821aa443
SSDEEP 12288:bAwSfxL/2Dc3RDLLmt0LDQewsAjaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:E0ewsAjasqjnhMgeiCl7G0nehbGZpbD
TLSH
T14575E031FA74E036C77B0DB20B36D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3a5cdb6215f99b5e6bce4138f5ca56b2b498fb87aca77b1c21fbb8d9b34a9a58
MD5 1a13b95890b215fe9c3db1e8d1eb2e63
SHA1 2e7c37e928a0c39b33386cc4ff7f4c0e7c84fbb9
SHA512 d8649d2e9912548a53c67473e1d6c86d7fa7c3c6838204ee91a8639454e24f6123fc58e05572499e3cf27a32a587cbf2a5db0d0ce76fd8eff28f79cb8c379653
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH2VQBWG:gUEtQevvqc2W1cpV2tI32JB
TLSH
T152474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 46e5a8cadc5ad43d429a53b5fd04a20c0bfa99edc25ed7dd1c672da0742033ed
MD5 3731763c9640fdbe6f283deac94cc68e
SHA1 d9260d96572136bb78e8ef2a608550b119a3aa00
SHA512 6be8fc088d0ff6338e71ed1c0e2182bde5a4a28434c93b3e0daf861168eefcf7b6112baccaa47ff6fd81ec0480d210ebd700d49d211ee7ca44a926ba16a0737c
SSDEEP 49152:LCbRquA/m2yL5zTfFiV+XenmE3/zODmg27RnWGj:UoquVjnmlD527BWG
TLSH
T107D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 91ae157e4f90255f445f51fbbe02d86760a092fd69b70afe5eef7d312317f12a
MD5 ce71349f89c473d3ed9aaf013a527907
SHA1 fab28b81e38a61573563a5f838640d6ab98dad0a
SHA512 f9e7555e768b2d48d635720c6261ed3c45e7a0fff96c0096dd2161f7fa9064f0be55d6b7b579f9f3bf583d35f6fd9a5993c004be0979856e60a4930c828186cb
SSDEEP 24576:lAhGL3IFoiwtA5l7S53xsqjnhMgeiCl7G0nehbGZpbD:lAMUFoiq51Dmg27RnWGj
TLSH
T19D359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 fa65bfe6993d55b22525eccd8edb9a4794a72d63526bc878853e614c987ac5ec
MD5 46a1339c686bbaf72a915c20f285d8cd
SHA1 54e1904d58798f9f1e6b75243b56ccc1d0c1333b
SHA512 47dd41aee4af8d8fba7add058bf5d357a5e611005691b6d2fa288f33ee7cfea4eb3ea790ad6c0f4af8d881098f1409cc9d8891e3bc801fa8294b9aa338bef223
SSDEEP 12288:Fmw5HEjsChNVBFgl0WDm+C1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:gwu4OWGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5b47c429b8430c72606de8b30b95218f25a2c55da5d595c2b2e6571ff6e560d3
MD5 97b488be811f684656ee097b77d13044
SHA1 7bd9f17eb6656387f26727d173c11b29b50ba780
SHA512 4b7cdbbeea23c67dfe40528857a8e3e45ec535901e133b54737c56cd2c18478d8242c29667c2ca30f8d8f966509e46111cefd5af08ad502dc3b3d2195eb8cb0d
SSDEEP 12288:GeZ1IyqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bZuHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E5512AE239820FAE163417CC5E5D609E7337C52673043CF16625AAA6F73AD44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 87d832a1c5415188dcdbbb69130a01cf6b015272b4a24ae577694b14e7688465
MD5 624f0685957e1ee8e4ed0dc2d2e69500
SHA1 151627f1a8fba2e0b3db8332d886c144be540f15
SHA512 a9e811486e85661be781e8e8a24b6db6befa0ddd57e5427c15fc8f558220f10969f48bacbc23f6f28c8ebdb8971a349e40d5360a56953035d4f9cae852b8244c
SSDEEP 98304:gQRQyi36YOcPbLvw2gAf+PN3kD527BWG:3QyiKa/X+PNUVQBWG
TLSH
T1DC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dd93793b11671b0de9156d4ff7a2c945f64f760497d41be7c10750c0f15f764a
MD5 417ceb7aef7a0d0b32ea92524b494a2d
SHA1 6c97621815f000ca2c5f1d323fac0f8b4343569b
SHA512 38bf87c46ec5ea680b06877a78f334c8a973844c394f61573ee461f26e7b740f6375289ac96edda9d4b08932e7fabe907ce367a8c85f81076598d380bbedb540
SSDEEP 98304:TQRQyi36YOcPbLvw2gAf+PN3kD527BWG:CQyiKa/X+PNUVQBWG
TLSH
T1F1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2b93ccb726d458f63f8b767ebed7cb7e1837c62a17bc654e761c589c2e81b856
MD5 331b39858daabc0f799a2b7b096fd65c
SHA1 b632c1cd6550ed2dd4d737d83b406447c85e318d
SHA512 e908d48b49512813ba5d26d43ea8708138e8dbd1e06da36eda8dea22341c00fd338876f5441cb8af0733c499e890d3faca22f5d7e7abdfb2ebe0c367e992775f
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL03sqjnhMgeiCl7Ge:g68Qg55nhceWu7PNU3/eDmg27RnWGj
TLSH
T1AAB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 47c72241df2500c5c5fda24304ef8717958405a10f5a544cfa9cdb4c827bd061
MD5 43c23d67297febeb292dc625a153845a
SHA1 88eb4ef223e07e4975b000c68534ae463165ae90
SHA512 958142bd3a6c685292c1cef4edab1f55cc19c43089052ea8c9f661adc7f11d85f4a9c0ab9284780eb6cc6f547c2ee273de2b8748beadae2f5c646e376586fb31
SSDEEP 98304:Py5112gYy5azzVvt69nLKnhZXD527BWG:CLIHEWhNVQBWG
TLSH
T19D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 80b27ac087db764d0bd0318da4f15566a3ec1cfc1160210af884868767e58ec8
MD5 029d1b2d2d2970ef6ca0dfa1fef8ecad
SHA1 5780e51e06ef5f8ccdc94ce1d5e7d5e138d370a5
SHA512 32f4da8c8f13945530d8b0dd5e440d6cfe8d2a6147218d86a219b7c511bcfcec409d75e9bd55721b7624d0e305d8b7f6b947025a7702daf8f9835dd8416a7bd5
SSDEEP 49152:/B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl8Dmg27RnWGj:Bu6Jmdxd2d8D527BWG
TLSH
T1F8D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e54035c36eedf9cd0aa08c29b86e574b396b885e005d10e03b62ff9a4fe6f1e7
MD5 89543a6533953e5d68d134c8131e265e
SHA1 e28417e00fb3ecf48c6f466521dad49ed8ee09d2
SHA512 824701aba5f1f5336fa3f543901629114403bdaab16159eb51b7fd504a49c8dfe89efccfc95671b0b25e7ee24cb27fb0fba8c31002a99ea76e465018ba1b5395
SSDEEP 49152:v1hpsNoJpF1A63U44CwH7R4x4Dmg27RnWGj:vmifPWRlD527BWG
TLSH
T114B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a12ff5348f31377840b2cf0a398f1857b8eec274e716d16c17fb4654a1b50801
MD5 a556aa636c632b567e558285fb48d2c9
SHA1 29c88b129fd82bc11dc23a612d4d8cf3dbf0cc5f
SHA512 599205c91f8213d8f904f5390c5a60600832a58768d17bdd46cffaca5d6777c2190f9d2d3ae37f31ea27468f2ca9ed35cfabad9ced34a84a8644adc8053a1a2d
SSDEEP 49152:FSuZQIY0Be2KcRVtOnks6NMHqbDmg27RnWGj:L5dKii61bD527BWG
TLSH
T1DAC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5951e82b6fcc3006c9fd52ef5e8763dc1ed6ce783acee438c00c4264702052c0
MD5 dbb24a377e29789b43880af2f676ce10
SHA1 a1fa2c7df6de5903dee68fa1f18d657ada0dbe41
SHA512 6de42372e204ed403e4a613d544592c8578992b354e86576c85e5ccc72b072cd2dae411b75b4d7cdae3048e3f5f2ef341d9e8cae9c764eb01c9afeec5e65e656
SSDEEP 49152:HhtSn8EApI0fig3giDn0AP5wMDmg27RnWGj:WX2imphhD527BWG
TLSH
T1F795BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 95452faf12b16b943b16e748cb65ed53d0fdcfd8ab2261e5f0ce2f043693312d
MD5 2186e128491a4f92703d896293619f2f
SHA1 6326cc4d794b5500c2f1a6634ad15e965d3fae89
SHA512 ba975cb15cd565324a56dcfbae0d37fdcddb1581917fa407d726374d25d3f28e7a30e504353c5bef6414ccac8fe2ba60c9f8869e5936e346819521c4d09d256a
SSDEEP 12288:nbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEe:nbsqjnhMgeiCl7G0nehbGZpbDM
TLSH
T17B4523BE965C41CAE52648B5C3E5F10DAC073E5BE92004937A5B7CBEFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6faea1413c5eb790e9590f56443125a6ff7259e01f772a674aa5d2d8637bdd69
MD5 b1144e09abb5bb89cf094d965d05bb06
SHA1 c5c2d2a88a33c2903a1932ab401b3241cc3b6e36
SHA512 51ae450f319fabfa24b9aecc4f62df1b1261126fdb763c01ebfcda55f3c5e5a0cfb445e0cedfa1fd4ddefe093d395eed8055f22286b426de8921023e72c3ccfc
SSDEEP 12288:jeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEe:jesqjnhMgeiCl7G0nehbGZpbDM
TLSH
T1924523BE965C41CBE52648B5C3E5F10DAC073E57E92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 044d821c6d7c60c72fb9e35667893ede39c89f69257f49e7c070bec8bf7bfcb1
MD5 1f2bc43d42c87d7bdacd7e97e9d6e890
SHA1 a2868e00468b8f418a99e54426916acd8d779c54
SHA512 96b129d988839fe4ee21ecba6dfeef3ce1e9b5ad0a939cc62de2daba901204517a03f348244b0582df93c7058687638e144cdf7c63431bf75ee70216259d93aa
SSDEEP 12288:+UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A4523BE965C41CAE52648B5C3E5F14DEC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ba55db0fe085113f35351f733bfcc2302c301c7921ed5760b78bb512f7ad13fd
MD5 c1ede2b7de43a80156c7fab2b6d47c26
SHA1 cf0f16b2d3349799fcdfd61feccc2adb08e4f988
SHA512 a772297bda21b99d72f08ce2ddf9492bd1c9d304a00e70fdff9929976a5a63ded66dc07b9c212da8da3247915838fb28d65c6aa395691364264a33424285dc82
SSDEEP 12288:cVRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15145236F675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 77505536d03eb9ed6a73cfc9b9db09eb03237b30f4655197a38e47d1a533f279
MD5 681f996940e4d724e230bf118b1c49ba
SHA1 2043f3d3fd416e2668799dbb8b716a1a75b5e6b0
SHA512 15b0f21bd41c57d8310b1b1f917ab3d348c433b9ae26086198997166debda3722ed81e289e13917bc3b7a5feedddf8614335f9a3e21ba18b06496d5d4ef376e1
SSDEEP 12288:apXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:apsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E24523BE965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8380b6101a4de92a07d7ca5f2d2de54f9ba9a1fdf47457f02cc847c10ee02a9d
MD5 28c4608db66b81d292542be14c676aec
SHA1 03c582bc2b9ef7347e621d901244803986987727
SHA512 e2774489e5da52a216bcf62c496e9fb8f264e1b22f49f7f9e14dbaf87fe5bcf10ddc640251f35ddd5ff23a90c5d386c6a0cd7c50d14f16008a6e244fdc0287ea
SSDEEP 12288:KCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E4523BE965C41CBE52644B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0d145c9d4d64d5aa9ca5943f4e33183925134c374e4e4020ca2aa3f491fee240
MD5 82b40e3585732141762a43d46877af4b
SHA1 f6edc31c15ec2e33e518335b5e72dbcac4c706cd
SHA512 e69e70fd22f9626740b06fb049991d5053159b01f4a006473abf87da5290cdd8ddecaacf5292f4313e16c02c59d7b48e1dbbf0806d9c21710663913380b11945
SSDEEP 12288:X2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC4523BF965C41CAE52644B5C3E5F11DAC073E5BE92004837A57BCBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d1b83a7d6e33289e2d4f8e67353a6c60b9b1567d78887a38f722645544607c08
MD5 92b4e942d612240e101e106af75e6e59
SHA1 63d27f1f9b090a65c7123d3c1f61f10d87101169
SHA512 af3d8b006bed0df26fe9cdb2dffb4e4d928f66928cbf0f2ec7003fd93c256a41510209fa40929e87f3a8149f5e50c86f0b4ec9d6762a744d76e9528121cd6c72
SSDEEP 24576:sZMRzFVSO+sqjnhMgeiCl7G0nehbGZpbD:sZMRzfWDmg27RnWGj
TLSH
T18D6501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b2a883e6f2610257dc8fb007cd94d1bc3daf93749431adeea398e8b9f09528b3
MD5 164cc09dda35106d6cdfd1722da5bad4
SHA1 c0d40c8740b569bc2e216fc3df3a8e42eb9c8366
SHA512 8adff60dec0fd8e313d579ff7fefe504d3c21d298294cc24ffb22fab637e0d64115a45511ef0e5a1aa84b1f1301976a0ba8cd1751953e39c67a671353deac956
SSDEEP 12288:UXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1824523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 28b846f04bbace7fb6a06acafb971e66c7b722083f8b04dd9ddb84d3a7773c36
MD5 440117689b547a0800eb365d7589b15c
SHA1 45bfb85118e459290d8f84903bc1ea28281083ff
SHA512 27b6bc0af02b10a4fba60cbecd03cffcb9081e4bdceb7507104fcd75be00f567879de2dae5d6913c4ddde8a1748f2eba935191a0427472f9ba45a92e5bda4eb7
SSDEEP 12288:rjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D34523BFA65C41CAE92644B5C3E5F14DAC073E5BE92004837A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0a824ade664903dbfa1c979b98aa63e534409d630809d0b2d305275def8d1312
MD5 31553ac77d885e87988491093d136739
SHA1 b2c8b999386e2f34515a451fd76d5a930e57cf02
SHA512 54406abade1e5422f486657f7dc7575990290bfedaa8ac963cae3985ee2fdb52aa3b06cebb5e5a9d9444ed5e498f85228478fca83e5d22f991ecba99384f4c24
SSDEEP 12288:byPz5L8qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WzyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11755125B73A530F9D1378178C5A29A06F7327C3247204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 bb7c47184ebde7fa96b9a5f0a5022a6f8163c6faf9a5033f56e403bf337e8d60
MD5 7b2fac0435fdadd67568563550580f74
SHA1 d1a84afd2355314406b83ce80f7a5defdd946cf0
SHA512 80a5c9d4cb6f6811681da6c1d9b67b253657c7a9d617d81f2069fb66c7b32e057e3bb056e7a08c60e48ccdc82682073d6e3e722503a95976a6981072db3a7a36
SSDEEP 12288:QXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1104523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cdfed3a44060e759f9629de59dd5ebd6d40fdc7d73b185abec118fb60850cb55
MD5 306bf5773ea494642e4578cdfb9b8ea7
SHA1 66cd94de4ef75495e6f91c84d7fbba6bf98fca7e
SHA512 9ee8a8314798d0d4a70de24052a677825aa5db06b5d142c85d96e9be517165a3988d032f9ff9f8d6b65788e2664c98ffacbcb40b31d717cb80b62ba57c6426cf
SSDEEP 12288:5XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5XsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F4523BF965C41CAE52604B5C3E5F14DAC073E5BE92004837A5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 50dc0398434c77cabd25db5120ad4dc46fab01627462659de2c9f770dc3f7907
MD5 c4d21db4b06e98042e6941b2cc177794
SHA1 e7bee449c5ae1c5acd6078083484eb7051168389
SHA512 509b9a44ef959061503b57db7c529d9f5a2d781b4ea5152e0fadac4e387b62b73c83e2399e26401767a76baff55264b0e17a16c976b9f17a4c6e045394d31d2f
SSDEEP 12288:eyPz5L8qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DzyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E255125B73A530F9D1378178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f4d3710bef8c3759f9cbd4c72875cf46e4f4e2b6557c8f7115c655b560715677
MD5 0654e4874308b9e6a605db8fa224bec5
SHA1 0b0169c9520db4a7868726870494a0d93324f780
SHA512 88b90159c19b1238f065941a0c108e565b0c243eee536c4f1f084cb39d10cd48dd40e440cb72d9ceaaa9e24e134773440bfbfa46ca880ce87f0b32ec31936982
SSDEEP 24576:ycP4mcvIjkGOxhKP2l71SNKbrh/8KBvsqjnhMgeiCl7G0nehbGZpbD:9P4m4IpOO67N8KZDmg27RnWGj
TLSH
T18E65BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 d894f671e23d10b5e0324087a495de295a0b8b3443c913fc49ebd0d4a732cd24
MD5 462d21d1ff2db16d13f5faa4403afa43
SHA1 c4c3aa40c2880bac950892352f02f6520becfe42
SHA512 0bc88635c0092ab6a477875d4425a368716dbd43cb5776c0c3bd103b8c94927081d4aad7a308af61e6c26481f0a7cf4b074b8c989d6503e0196186b3ec38075f
SSDEEP 12288:UbsfHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF55015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f91fcf6cece70b3afb7bf6995fa4641ba89b16429b6a257f656ed17092f15c78
MD5 d95055d6f810030aa3268b8ff060f849
SHA1 d4a651ca3f47f17078741c6d1f72fcbe01e5cbde
SHA512 1b52a23e51ce888d900822920ed636983aff8ad01f87f68d85247a178ae981f13bdfb333852755ae7f16643f24001b912abbdb53be8239d45385920ec05daf60
SSDEEP 12288:0nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0nsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB45237FD35C518BE57649B082E9E02D681B3E669E204483BA477CFDF6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5966afdbccaa491a5060338f9dd5d6038a019d16800b68f3cf63f2271c276700
MD5 cf075634ea6d23711d850b48f3b651bf
SHA1 a643d0dde587b0753fd5f21aebceadb4c4eb4d98
SHA512 ef32307be6c0d7b63e5e7e9344efade5bcdeaeb46e0b070ac3d2301d962c499b4f8110905e5264eed794878a65d8818d78652c81139daa38efdce7b474e7c65b
SSDEEP 49152:Ia0h2GEkuAe73q3pp46zwwQtDmg27RnWGj:Ia0hNYG4Jw2D527BWG
TLSH
T11F85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 2b29094da9d81effdf65d8158271a110cf489231ab8076fe3b195759570eaff3
MD5 ce21b6f92ad88413e2cda3e5057bb844
SHA1 879b995a0cf27d47a2757a54f7002eb9dd3c2168
SHA512 c34ad7ae2adc52778904706263eadec2cd684a6b499d4a10ecc3cd8997874839a9ae8080459e51a8bbb9b4f5620a94d5b2de1d81119761e59b5b46b17569673a
SSDEEP 12288:mhbHjfXOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mhbHjPOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F55127E12AC20D9E57291BD8296D10AD632BC261B2053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 18e5144db1ea1c5f699005825441bd0f3748fb140f788c1a07bcc9965d80141f
MD5 f38a5340f03ff2000daca0a8b999b3b8
SHA1 3c2f5b4eaf19e9eef550980ed7014103a705161f
SHA512 13767ba98d1377ee7fa33d86351fd5d11d69fd4ec1deb405cf0a5d9124fccdda3305b16e156bf155af74fc7d884d17ed3198988d3728fb5fc36aae1aa79cde86
SSDEEP 24576:X3YgnJcRTk4yti+R5dpR/GsqjnhMgeiCl7G0nehbGZpbD:XIgnaTk46ppR/KDmg27RnWGj
TLSH
T1C145BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 0b0a5eea669ad9e9644c0545840341b1bc99f11a9aa2dda206ab20d9499af643
MD5 093fd229c234ea4f60c27b3fc4d96310
SHA1 23b2bcd1abd493f52a8f92cbe2658304b9476847
SHA512 2a523c9fe3c5f8299cb47d52989c46104e3c5a4e0bffce9b732308010c6d2ca085d0d758c28bea5ddb87c5f03872c583913a709d62c68893dfe2f16520d2c3ac
SSDEEP 12288:ozXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ozsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C4523BE924C51CAD93649F5C3E6E11DA8073E569B2004D379A77CBEE7B18E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 3f04c3d8454284f9a88f57e91a94799859e54eaa40be535ad10a13fbfdbc8303
MD5 c007aec8d7ec67836c5b75b972ea5087
SHA1 3e09ca07f512023a6726538ccaecd5345c8798e6
SHA512 931e5ab8c71ef658cb270715aaa10e6556430006261bc5d3cde3857d8f3da672ca0679154e9e14ae86289f5ee392650a33cf506677841087179d32b4c8c1a026
SSDEEP 12288:4ObfA4LWOsvAYFTQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:VbL3UTQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B2750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 2f45fdf55eb9516f70d14f10211378a8e12bc292c9134b745938e7f137c369f6
MD5 5cf04c964d1982b547568d9569111d3f
SHA1 c8bf5916b186e27146c70f05f90e85809f953ee0
SHA512 4f2a42b43ed274f81b98e905eb2f80de0ff78eb8465e3337159aa4b516c5d8d63cd8007c80cdff8214cbca5519d095476ef242a773c76adb83f61e495a462ff5
SSDEEP 12288:qpFtIOMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hOMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16455022E33EC10E9E536917C8692D20DD6327C660B2117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 402a302853dc96cb455d6edd66b5eb68e11736593c044d770967fc42b8c8e9c7
MD5 f2d84947b458ac0eb6b819da30cedf68
SHA1 9ff0fc2aac459b055877300bd1a88e959f6d6e04
SHA512 6108f843c78dae39e1b7a403281f029bfde7106b2de05c3fe8e9b355dd9272d099a4ee6308ff823ded50465ae4d1ee023b20cae0e7facd46de18b8036816e520
SSDEEP 24576:B7NM9YmZqmWMUkPjZM48Mv6bEhsXsqjnhMgeiCl7G0nehbGZpbD:B7cBWMpPjN8DbEhCDmg27RnWGj
TLSH
T17F659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9ced8c9938560ccd1de2dda55f9c96e7f15f6355b9bb334f026ddf5ed273df1e
MD5 523ef6e1f8711eba7b8d9b3a59a346a5
SHA1 ad4a8b90eeb942bce96a6ebeea62c650493217cb
SHA512 92d340e5d023db458612e565bd3d669803885ee1c8604a2e2f6b3ef1e494eaa11805819460f27b82b8b43a6993ccf536e957b03a559cdee3266bfccfcb9d2bbb
SSDEEP 24576:mW6BApg2YuyuNDYTabvcRvNYf8km1tsqjnhMgeiCl7G0nehbGZpbD:mF2YuHNETovcvNYf8kmLDmg27RnWGj
TLSH
T1D7857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 87a66c84d1fe228fc9ba240be11a5ff00a9c5188be0c1accee02baaddb171127
MD5 1f0a87776a2c66d46fbc11098a353b3a
SHA1 7f1801b26abcb9959db3ee5833a84a5e18db37ac
SHA512 7ebce726aec8ad438c3aa2b2df9732ef446df77fcf87b900a27ac160897a030e7dbdac82c402f897a8d959d5dd4cbacae432630be8c2038d8a9bfabefa8b292e
SSDEEP 24576:QAFs06+OmlfkNXEbToYsqjnhMgeiCl7G0nehbGZpbD:lFs060lwXuNDmg27RnWGj
TLSH
T16665AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 18b49c7e40fc15f2af321c85ad3ea0c7b764970c145d5b3472119fb270e8e1dd
MD5 d2ea4a10e7a7d81a901ddf7f6bcc8279
SHA1 bdf2b90794932de41c041fa7b5ae0b8c0f59352c
SHA512 22763d540542d86c7a3989eb78c8df84dae5cc5208e39cbb02af01d419f239041d1c227eb2e32cf146230ba4999b9e189f2643b6af2903b92fc82a1778ed3189
SSDEEP 24576:4JnJ5D3WtJsqjnhMgeiCl7G0nehbGZpbD:4JnJ5DGtNDmg27RnWGj
TLSH
T1A275E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f59ab99685a00e4d0186f48cb1cf9789776b75b48f97ea1433d102d294e8d1af
MD5 de6558ac79005622c44295913a68a808
SHA1 2afd3ee26b7212bae35d39e07ddd3bd94ac25f1b
SHA512 15173f9ce691aa664750605acade81841b502250e42b993eba21cd6e76f28d527ba48e2f5fde4e4f8cb6dd7d73e6954fd09de3e7ac6bf2e6a2bab64092710e78
SSDEEP 24576:gEPohm6/7IIXdwcXrif7qQncjlP65i3VuGsqjnhMgeiCl7G0nehbGZpbD:fo06DIKdwc+eQnSt65aVPDmg27RnWGj
TLSH
T12A955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 a9c9640c5f1aab433d74e69d6f27860e4976a6c7fedfed18246fa586db6fa433
MD5 c726b96ee1053e59fc62f4ede1dc28c3
SHA1 aeb936412992026e42e0822143ac4f3098d44b7a
SHA512 7c0bb7af9d05261c3dd92011f474e4a33d3c94a33d9f1e0c2692ec6048c149c52f071bff4bf3bd642ee42a65d9764f83af255c271ae285ab69163ea91c81b0e0
SSDEEP 12288:JEP3Rr1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ar1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B55126E679C60DAD536907D8291C209D733F4716B2127EF1692C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 2684c6807b418653bfd4d0e1a93942feacfbe1b1da074de44cf40a440571574a
MD5 cd2445b1bba61b0bb1f229c5f50abdc9
SHA1 3a289454ed316c7457a168465b2c3cac4c34cf41
SHA512 cce68f62ac073ee04349be1dd433fe0e1ad1aaa3c68aec15cdd58dcebcfb724d3b0df74561142fc0f4bee1668624925dbf0835bc340caa112d033732fe5820b8
SSDEEP 12288:FjkyeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FIyesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC551219639C60C9EA760578C6B3D1589C36BC319F2046DF6191FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 d2579609218f3883417e9ff89bd6c2cf5ab11821ed7cdc8980d2c71147aef580
MD5 1f79f43f41ca72039485665cff69bb48
SHA1 9914e0f5bea030353ffae5b345eba63d8c2ca8fd
SHA512 404c31ae72df12affa7cbfd0000adc44dd90eb78049e1cd392ca8eab8ee6c40f190d31f399effb177c1b8a646d125ca4f2542c625b86218e67ce0896ff61e8f9
SSDEEP 12288:hFcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ncsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13445237E525C60CAE93645B4C3A5E10DA8133E766B2014E739E7FCBDEBB24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 30f6af669524d9efd6d2c0841067949764e48c73d1a3761a84c75d18eb7df4eb
MD5 8e0a2063e44bac9d0de8c23606d11450
SHA1 a42801cda7aacaecb79052190a3122ac8279c2b8
SHA512 1771492fa141c86fe8472d75413eaf36fb7f7902fd5c94404eaf9634ec70c0b515aaf89308e72c769acf95873ee69e2e49b2b09accb634557ce765b5fadb4449
SSDEEP 24576:XQ9MxZKdcz97w3fsqjnhMgeiCl7G0nehbGZpbD:XVKXDDmg27RnWGj
TLSH
T148558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 3c67ee7374ff0ec41a2e9fc8f1a9b131269157a3f0cb32dbce66669e050552a5
MD5 428a24907acae0e0a721505290750db7
SHA1 9ff730b60823bf661ce1b8c1ec6fc88153e67b3e
SHA512 298ee4670cb900e2180bc36a61669fffaee2b1a67d77c66f9fddadedc1dcdeca050cb772438dec46ae4be744f50aaafaeea1f0463582362e6fafe21d2dd3a7a1
SSDEEP 12288:5yoKo2HRple9paXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:5yocxApasqjnhMgeiCl7G0nehbGZpbD
TLSH
T18265E01FB76D40E2E176813C8985C249E673B4315B2257CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 35ad3933a48740fecfa01b0e05090e945f4c0d13febf0c93c963be2fcbc3f4a9
MD5 dbc3c34056367cc2e62e47cec4c867dd
SHA1 1959b82e6e395f3efbf71c622c490471f4a16788
SHA512 8c6993c6c9c68bd8b1b53ee0f8e898b295589cfaeddbb82ce285922673f89bd2fe6d58ba73df70b9f3fac48d4c6f4ba16d21298e3c60313b0bd91b306ef380e4
SSDEEP 49152:6WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKuDmg27RnWGj:80zuNIaD527BWG
TLSH
T175A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 173a8d02903f7314d5b152931dcf6c9186e27f947fe97ec4a9cbfae964e84e27
MD5 3f50c83e7962e254c31c22e5244c089e
SHA1 d79ca108c2d7a81ef1b74ee00dcb24aa7435679f
SHA512 78360939e8c6ca502ad3043045822a75a36ef9053b350eec667c74d82f06cb5ccabb19e7e4e2015c44cf4c0ad99300f85f24908fe67a81c7531269eb8ae8ce9b
SSDEEP 24576:h1QT7EcpfxR+N5AWAz3ooiYujMqb1sqjnhMgeiCl7G0nehbGZpbD:kTDxR+N5YzT4jMYDmg27RnWGj
TLSH
T1D955B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 634fdd32c2ea809723067d3804b1806e016178930be0966c288a7f00672b8f6e
MD5 110a8eb63775a83ee40511d7b0118b7f
SHA1 0bc266f8456a7c6cc5df1e56d2bda2f68d5ee335
SHA512 4ffabc0af753955baa2ccdee071cd4c6eac29025611dc5a0a6e589a2f70815a218a4f830a74d2dc227d07e9db2826fadfe646b97b7db975b973fb5cc7d5cea20
SSDEEP 24576:UTMdOz0FFS+bmSLRsqjnhMgeiCl7G0nehbGZpbD:c0K+bmSLlDmg27RnWGj
TLSH
T19975E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE47A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 2563695b4fc38869312ac37fbbbecfa7e7a67718be918f79fd23f755facdeb3b
MD5 811bb1589b2360b0daac024823628e8d
SHA1 581ee7c884adb4aea55e683edfd7bfde328ef7b6
SHA512 f6a4c8ca172d2f87983cdbd19bd643b4d60e707d8b78b8e49614508487a90b8c9bb4f8b97141960e21d77e1b459749a65306c4012b191e40b4de07e9b90d1c99
SSDEEP 12288:547QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E155126E63EC20D9E4325574C2B6D1099432BC76272015FF39E1D9BE9F729D48A38B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-83-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/560-88-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/560-91-0x0000000001BD0000-0x0000000001BD8000-memory.dmp

Download

memory/560-90-0x0000000000C00000-0x0000000000D2A000-memory.dmp

Download

memory/560-77-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/560-92-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/560-85-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/752-133-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/752-348-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/752-139-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/768-143-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/768-482-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/768-349-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/768-149-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/900-175-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/900-357-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/900-181-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1172-154-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1172-354-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1172-160-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1620-106-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1620-496-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1620-115-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1620-112-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1636-208-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1636-207-0x0000000000D50000-0x0000000000D58000-memory.dmp

Download

memory/1636-195-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1636-201-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1636-204-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1636-206-0x00000000005B0000-0x0000000000751000-memory.dmp

Download

memory/2252-251-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2252-299-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/2252-530-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2252-281-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/2252-370-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2252-466-0x000000000D2B0000-0x000000000D2B8000-memory.dmp

Download

memory/2252-265-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/2252-257-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2524-495-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2524-94-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2524-95-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2524-472-0x00000000006C0000-0x0000000000861000-memory.dmp

Download

memory/2524-473-0x0000000000980000-0x0000000000988000-memory.dmp

Download

memory/2524-101-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2584-378-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2724-129-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2724-13-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2724-463-0x0000000000580000-0x0000000000588000-memory.dmp

Download

memory/2724-462-0x0000000000BD0000-0x0000000000C6B000-memory.dmp

Download

memory/2724-21-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2724-22-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2732-170-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2732-164-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2732-356-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2884-358-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2884-191-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2884-185-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3216-66-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3216-471-0x0000000000D50000-0x0000000000D58000-memory.dmp

Download

memory/3216-465-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3216-470-0x0000000000D60000-0x0000000000DFB000-memory.dmp

Download

memory/3216-73-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3216-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3952-367-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3952-529-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3952-246-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3952-240-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3956-62-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3956-468-0x00000000006E0000-0x000000000080A000-memory.dmp

Download

memory/3956-54-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3956-60-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3956-457-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3956-469-0x00000000004D0000-0x00000000004D8000-memory.dmp

Download

memory/4124-50-0x0000000000F70000-0x0000000000F78000-memory.dmp

Download

memory/4124-51-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4124-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4124-39-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/4124-45-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/4124-49-0x0000000000780000-0x0000000000921000-memory.dmp

Download

memory/4124-47-0x0000000000450000-0x00000000004B0000-memory.dmp

Download

memory/4144-216-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4144-210-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4144-362-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4416-364-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4416-226-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4436-236-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4436-366-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4708-375-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4708-464-0x0000000000450000-0x0000000000458000-memory.dmp

Download

memory/4708-33-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4708-35-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4708-27-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4792-347-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4792-120-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4792-126-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5000-460-0x0000000000790000-0x00000000008BA000-memory.dmp

Download

memory/5000-461-0x00000000004B0000-0x00000000004B8000-memory.dmp

Download

memory/5000-8-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/5000-65-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/5000-0-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5000-9-0x0000000000440000-0x00000000004A0000-memory.dmp

Download