42c55a07e2d96a1ff10ce2c37abbf50cab97b3ff1f410d251b068df3d3a0499b

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 4.0MB
Sample260425-vrml6aew7x
SHA256 42c55a07e2d96a1ff10ce2c37abbf50cab97b3ff1f410d251b068df3d3a0499b
MD5 538ecdd537db8de615e62474c4a41721
SHA1 61465997ad126a0aaa68aea2f1b561232b5ed0e8
SHA512 c86629a1e96a146335669e6818a27084a3af77066475d564600c3a6d26ae626d345a5b814bdb19641b031372374b7a570fe74792584c16992ea20ba4ae6c9bf8
SSDEEP 49152:3vmHGcnO2EvU/bMvo/SHEif5YL8NnjSzjNCWTPp8N7s8SJGADmg27RnWGj:3TvUko/SzSj0I8NiBD527BWG
TLSH
T14A1629ADA6DE00C6C070A4F4CD065795E2F2F864833149CB15E81A1FAE7FEED4E39664
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3628	alg.exe
4984	DiagnosticsHub.StandardCollector.Service.exe
5044	fxssvc.exe
1344	elevation_service.exe
3208	elevation_service.exe
1304	maintenanceservice.exe
1640	msdtc.exe
3700	OSE.EXE
2016	PerceptionSimulationService.exe
236	perfhost.exe
780	locator.exe
4456	SensorDataService.exe
1000	snmptrap.exe
4092	spectrum.exe
3124	ssh-agent.exe
1068	TieringEngineService.exe
1452	AgentService.exe
2844	vds.exe
3492	vssvc.exe
4548	wbengine.exe
2116	WmiApSrv.exe
1432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\44a1765889fac755.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\java.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060274e9be9d4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008098c09be9d4dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018bee69be9d4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a73e049be9d4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048d4bb9be9d4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080a1ac9ce9d4dc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	5044	fxssvc.exe
Token: SeRestorePrivilege	1068	TieringEngineService.exe
Token: SeManageVolumePrivilege	1068	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1452	AgentService.exe
Token: SeBackupPrivilege	3492	vssvc.exe
Token: SeRestorePrivilege	3492	vssvc.exe
Token: SeAuditPrivilege	3492	vssvc.exe
Token: SeBackupPrivilege	4548	wbengine.exe
Token: SeRestorePrivilege	4548	wbengine.exe
Token: SeSecurityPrivilege	4548	wbengine.exe
Token: 33	1432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1432	SearchIndexer.exe
Token: SeDebugPrivilege	4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4560	2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3628	alg.exe
Token: SeDebugPrivilege	3628	alg.exe
Token: SeDebugPrivilege	3628	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 3388	1432	SearchIndexer.exe	105
PID 1432 wrote to memory of 2444	1432	SearchIndexer.exe	106
PID 1432 wrote to memory of 444	1432	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_538ecdd537db8de615e62474c4a41721_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3076

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3208

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1304

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1640

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2016

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:236

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:780

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4456

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1000

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4092

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3256

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2844

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2116

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3388
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2884 2692 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2444
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2900 2892 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a940aaff1f664d070c12a16b386fd59c4518b00cbd95e8c1c2107da76254a037
MD5 3f651e746f7db96669cd967a61518454
SHA1 3190f9cd855a24b485dfcbf0bfbae1eeb5079ad0
SHA512 0d4965b8322861c5248157e883a7afb95d43b5fbf1516c9e1471dd2ce72f17e12d4236f10c61bdb858ac4e9eee7c94b95cef1a27563c293e3fa99e91c9ae337b
SSDEEP 49152:fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn9Dmg27RnWGj:d3q6sjBmD527BWG
TLSH
T1FFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e8ee8c6cc1bb27b4a8bce4d3f4ef5bc90f7f0ce5e5e81493f2dcac0cb081ebab
MD5 9e93742d2fd1106f874492e8afff68bd
SHA1 ac8c5d18d3c0b8b7a72126c67165249162f3cbc0
SHA512 0a58bdea58493a07e1478190942bae3ab32175781063fb8fa05114845734c5409905fcc2c4e22aa047147836041a581c3fe1273520fb6bde8c73a5f93c2030c5
SSDEEP 24576:mXYfDtczAesqjnhMgeiCl7G0nehbGZpbD:FtcbDmg27RnWGj
TLSH
T10C650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0bfd9eed60f03de45c3f7b3bf42c5179e0471f214b6204702c3fc2b42b433553
MD5 66d988f3114d5d30b76ff9d8564b57b7
SHA1 b80bb18d54a79347a4e18500aba87d2cd17dff3b
SHA512 350e37aa3a9c6b4747a50f8af5beb85703010326bc223df6c50e2a6a2473b2de3d1d88facdc84f3d3e44c142a178aeee365bb6a9a08c873eda2299e42ee89c6f
SSDEEP 24576:50Le5ji0hmxxrMxsqjnhMgeiCl7G0nehbGZpbD:5Pji0AjMDmg27RnWGj
TLSH
T1AD859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ba499eda507339e73c1b3cb92ae226fe258c99519b9224d5d8775ba3aee9d6f4
MD5 1a61de2443a0ede1275c6452c111221f
SHA1 8fd607e51b3fb7b3ef0200c2c9d9b4c62acccec3
SHA512 8310340147f49bf5f5064bf660185b08765dbdaea135953edba6e2b3f6a1260d3b9496706fb41d6be826f990dad9310b1fe6ba3d6041bfa850c28e144ede1d26
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWn6q8wyuXsqjnhMgeiCl7G0nehbGZpbD:7/ezSC6vUzPveHjyYDmg27RnWGj
TLSH
T1C2755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 825422518b797037299c95fc218f2275c62967458a5ed0d9c3b9318072446030
MD5 5ffc48262fbcddd99ff8c2307464bdf9
SHA1 c653183d119f71ccab029755ea32dacb81470e3a
SHA512 19bb1277464654fa9dba5245b6ee2432f1d0ab6b6671d373e8dfcbe1a7796092fece546155b806b391fa166bfcbff2bb1064cf971116b4231998bbfbf157d09c
SSDEEP 24576:TVbqPb88hv/l+YysqjnhMgeiCl7G0nehbGZpbD:TVO88hXl+DDmg27RnWGj
TLSH
T110559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 169c2f7bae0b7530aa06c053d28e7ed47dccd4ef36efd693f1b1ac383448c125
MD5 97b493ce9beb0fa79b7a419ec8ec3188
SHA1 f04437d9dd6e43412108c26290f4d405f7aef1fe
SHA512 f34e89c6fc47605ac635e66557de50a6a22550a1fa51bc98ad3fcb896edf6e0ca24a3613e64511c40398dddf393e0cf9521f260fa3908c2f1aecb06b8380750e
SSDEEP 12288:9LVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9LVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E4523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 249d0948ccd71cd13dc08132568c27476447f421e440ffa41496bf8f6687311a
MD5 2dd6edf3e935897cb96430df791bcce0
SHA1 eb394fb69922843cf548067c54c7f86a19db7849
SHA512 aca4959f53e92bbe81916e395c8f4c3a2e8f1b3115f65023f761842fa890f6d86261bc0656a553fd0dffdd7f1e1339559c774aba95e125e7e8c4c86d88b01390
SSDEEP 12288:7eBNUbTVO86UqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:7JIUqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19665CF7BEE28FCD2C27A8DB85791C600E77278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 acf77fe5b123a8286855a8a878f1de7a0b6f28b18e1f3e781c5e2994e2b59015
MD5 b4aebe60730b99931197b395a137588c
SHA1 86c9c5184988a925ee811c0989346f5451f59d8b
SHA512 c36e1d50ba1463fd60736d4f70bd9d4a265009dddd0ad58b10d557d9590c66c72239ff12c5dcbc9fb27b01993e14388c568e4df85efcc8000623ffcfe14248c8
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THd:TQvGAdlCEL8c/DRNw5C7D527BWG
TLSH
T149266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 a2934e9ec98eb941287abab11dfcffd38029f7e182d40e9829336b69928f597d
MD5 08cb425c768a51d53a3a6f4dbbb750d9
SHA1 d15e5b9efe052e62ee873c34dd9fcbb207e39093
SHA512 68864514e8352fdb80814a77285411501f65dcfe92c45d0dd931770ce6482f84da9b0dbbb5a1ba633b8091f4a5d13ed7e9692877929fd1a22e87a7f9c7c61c40
SSDEEP 12288:JAwSfxL/2Dc3RDLLmt0LDQewsAjgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:60ewsAjgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19675E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7ba29cf7c00d89ae0b0204e0aec502b446042744518caebdeab12ffe1e7824fc
MD5 74ce15c6a78f9c672d8af51358b7b9bd
SHA1 2054a71b4c4b5443a9e2e023e816c469fd7a5715
SHA512 cfc3d574b2924f7c2451ae4c518059bde6d9b62d222192ec700289fdc72fe5c668201523ddbba6bd3d30139803d146678d8a79e8e0686f90ba3ca1a4c31ca245
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH0VQBWG:dUEtQevvqc2W1cpV2tI327B
TLSH
T1BE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1398ffa06d5d9af7952ddd47f75d1259f32f153ea73b73c0fa67c8a7254525a0
MD5 17b6491141ec636da9c1a712624381c9
SHA1 6f3f1157650fb04f410580ea4803dc9955c92443
SHA512 472bf243ea8b143a01c80a4edc30d3923ac5d8e5aadace115f019258a418fec5cfdaba79127566e28811fd24809fdf4cfc85fb9a7f92350466cd331fe56eb006
SSDEEP 49152:sCbRquA/m2yL5zTfFiV+XenmE3/z8Dmg27RnWGj:FoquVjnmnD527BWG
TLSH
T1CDD58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ffbd8c3f0cf74b4f5b014ad7c0fb326c4098a4a42bebc755bda1378bbfee0e0b
MD5 c29618de52079f68015a0d16c9f1684f
SHA1 de4150a49dae862096c690f3c4ade482331c7b33
SHA512 586f62b7c6d8d2d958ecc8dce912eacc1cc3b17d8091466b975c260dd135cd7bd90b864f02705df061c80982f8a320d87a6691cfcb085e09e8e6080cfc9be1f2
SSDEEP 24576:DAhGL3IFoiwtA5l7S53DsqjnhMgeiCl7G0nehbGZpbD:DAMUFoiq53Dmg27RnWGj
TLSH
T1F1359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 430d3b3416842f50d57ae37c82110736926093915f16ea5794107ee84b67ed78
MD5 cbf6628c9e69f311299f9a87e67a2104
SHA1 c0dc688d1bc134821ce0687bd41fe8ad67edbcb2
SHA512 86aeeb6b068791cea3f26c6efbae7631a13929e4d4aa965c1b0f2cf645d7d410fb58f92e1b21245dc14d16ad6202307b28b52eb6b1221c1f5a4cbe638c0c2f75
SSDEEP 12288:5mw5HEjsChNVBFgl0WDm+C3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Uwu4OWMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F65F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d332ecf071f970f9467ff3bc1c42802f8724daa0c09c4e7feee3583af1411725
MD5 0da82cd788971c46da83122c20a5e0ba
SHA1 4831776d510011fde9c6845d17811220389e4917
SHA512 47be5c7de20960de245a6b0f998f2844d99e55b62f533b9d71a3c70072df32aa3fcfd113b1550ea223dc0c6539a69de220749594826fdd67a3c75716498124da
SSDEEP 12288:/eZ1IywXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mZuJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1195512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b48de0c58b6db3f07b0267760b89aeb6fc9a406155190644dff38af46459dad0
MD5 5303f35a74c0f4535955e07ac1075426
SHA1 e622f299d6dde4b7ec2aff675f968465f5176027
SHA512 70f34bf91bd476a772fd709143de6c018b57a70db7b653020ee03365602021979f90ae6c8d27a2f3df9832e2f05adbe86a5e665f3345a9fa38a6b11a1baef666
SSDEEP 98304:TQRQyi36YOcPbLvw2gAf+PN36D527BWG:CQyiKa/X+PNqVQBWG
TLSH
T1BE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f2cb35ce224f5b0b193c8cafb4d0bf9f50f1d754ec511f2894412e0c40fb6617
MD5 e7f2f3acbbbfb371a7504ffc7dbab4c6
SHA1 2a0d2d6931988224f85415a078c177461cf43e6b
SHA512 42c153379647690650460237a162fca78384d76e810a7369266d44dab2dacbdae8fd651c0deaf18c278a9b00f4c63fea4d1652ae2c11b9b4758158142e3c96fc
SSDEEP 98304:MQRQyi36YOcPbLvw2gAf+PN36D527BWG:TQyiKa/X+PNqVQBWG
TLSH
T19F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 eea7b3e88755a7f522fe1088adb94cc074be43c7bf1f17295e72e4c614fb5866
MD5 49a7010da8592d320eeda5532d604db7
SHA1 daeb28ee986d0110c8d655838f67479c268462d2
SHA512 bd7a0b928d6cd93e7ca4045990993806fe1b9940f513f7bacc2aa75747b2714bd0097d3d7f3866a1620e82be5c4389350ae2bff2f3c1ab86ed98a8878ea6c25d
SSDEEP 24576:VwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL05sqjnhMgeiCl7Ge:R68Qg55nhceWu7PNU3/MDmg27RnWGj
TLSH
T1ECB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b5720a0d72701a2d13709604e1e032bab666d439abac04eb949043e5e4da4a7f
MD5 ef3cb86738744169b0b6055c06a9d8b5
SHA1 12c457dd01e27ec43a7d0bcee74bdbf06683be6e
SHA512 1bf8e1d4b9138c2ccfc74edca524d4600440c769563462cdc78dcde41f6d4029b73b68894f02cc892a44aae0dd0ea06275b06003069821ba0dcfbcff2636f614
SSDEEP 98304:Ry5112gYy5azzVvt69nLKnhZJD527BWG:sLIHEWh/VQBWG
TLSH
T12A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2cb403a7e51e26be5e13310c8e9f93634d73786d3b0f1f778b52976a95e01c65
MD5 40b92adfd970e5549e4d386670253529
SHA1 db42bb585ee698ef9b811a7b9e0baf53c9b15d0b
SHA512 54f64d5601e7c1b04144c2faa881501d9ed6d6401512e4d8cf6e2350c2cb71f2d54896012a13eae605165ff0e51e6c8c5bd49532715bb03e5350914108c4f49b
SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliDmg27RnWGj:zu6Jmdxd2diD527BWG
TLSH
T1BBD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ab0a7604d9bfe85b383e6e7fb9951b4b4b5ec10c4066d739d6474d41ff06faae
MD5 ca4b33e88ee161517a9224d9558ef16c
SHA1 227f77984aab4bf87190488be4cfc0c52c2e0d62
SHA512 b9a1ec3e89b4c3a21ad8bf3e1eac8ab760a9aa96c383be4449c52c3d0e6066a9ba2805892d4f77583424755a5aa9f36d67e4e284f24467719872b3138763c61d
SSDEEP 49152:q1hpsNoJpF1A63U44CwH7R4xeDmg27RnWGj:qmifPWRnD527BWG
TLSH
T148B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f128dbdc5c6b258616ff69273c33935ce045280948b15426078c568521581a4c
MD5 d4e8398b6ee979ffae0eb021af4b18a7
SHA1 5b3ed6a566f897abb8c7d5072fcd6906dd23b962
SHA512 095a3f6bdce3657e92c9f7a28674c4cc9d53454137bd269a3a81e4732bc8e2d9cf8502ceb9a7a9af999a30eda5bcdf53b592f1615bb1ee2d8558a59534f13b85
SSDEEP 49152:VSuZQIY0Be2KcRVtOnks6NMHqNDmg27RnWGj:75dKii61ND527BWG
TLSH
T1F9C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 993e37a1b23eb727efdf418fdcd4aa2363605aa95b3b173368769c1db0324372
MD5 42ac6f83264bfaad85d85188c0abef9e
SHA1 81aa11daf157f30122a0efc7ba4bb5c06f90dcb4
SHA512 7b93c3f955b987895e3f53ee40cd28c8c108a219c35eed21700e9d668b6dd279f0023435559c4ebc5801d70e5b4fb01e411ed93944c7cd10ec88d9daf8953a29
SSDEEP 49152:zhtSn8EApI0fig3giDn0AP5wyDmg27RnWGj:yX2imphTD527BWG
TLSH
T11095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c7626a9a1f41e9921a816f45b399ec02016fefecbf603a5327e16348599a019c
MD5 d78ae85cce1cdc54bb76050789027640
SHA1 345c6be9343c27baeea065de938b908963491933
SHA512 020887c5eed1163ba9787e04a61d1f579ebf46cecc325904662699a36b218680071011af3aaeed4447dbbc6239972b85a2427aae2b15c9d5319287705e96584b
SSDEEP 12288:ptXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ptsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D94523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4eef35b2c862700687d29f49d68f7affb3a25df5ce722efab5d5599348d4cb08
MD5 91385c2f50804c486acd6ae07a0aab1f
SHA1 aa8e464f5a8caf790121152a0093dbf606059bb6
SHA512 892c798128efb9644258d347e9ddf1bbfe8586c22c9f7682385f8a84e958d7003b8c2e6cdd4e29ac5b07708ca0dd3ec1b2c9b9300ae0b5af57d1dfc0555463a5
SSDEEP 12288:j0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:j0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B84523BE965C41CBE52644B5C3E5F10DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7fe4f146e997876cbe30ede54aebbafdfd08226fc40538baa18ce1b684535821
MD5 39ceb63f40ed1554caa91f5c257f983f
SHA1 70a2a752ffdce2c8f98a712a4f3f5d7283093999
SHA512 7ab42613dd658e00d15b1768b12ce6b5d3b15b0d4c7c4c746c87e22878e52b887b71ce23b087480957abb1c8d45727cf90c990ac300d0d97955bb8bce5fcd38d
SSDEEP 12288:miXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:misqjnhMgeiCl7G0nehbGZpbD
TLSH
T1844523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4e6d1773800ecf0a8a762bdea2a4e7290f8aaecc6ee37d74fb09c2b6cbfe1f2d
MD5 5ced1c1dda3ad0e29d5fec1aba2b1525
SHA1 373e240522d74e242f628462f650c7f04edeac38
SHA512 e824aae84e013cf36a0fd227953cf9ad9e55a523c12f6a57287fe6f716e88299f7d957e626001fd7b7a1219c08356c025d093385721c4fcdf1aabfbaccc26c8a
SSDEEP 12288:7VjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:psqjnhMgeiCl7G0nehbGZpbD
TLSH
T14445237B575C01CAD83285B4C2F5E11DE8237D96E73005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cac79f23b07597bb966f6603d95056b925eaaa53ec458b06f01da2f2963fa4d0
MD5 de72b83360ec0bffb5d5eacd40cfb081
SHA1 641e35d8158c55b3656bd8e2a4951fd348861cdb
SHA512 9b7ff916f2cec720aec6b258bf15513ffd0898a184f9c3179ca985e06f47b6428f910191115074e8413730df27c72032ca177c6948119f18f2c06c75be70189a
SSDEEP 12288:BrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1794523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 87f4b5cda152265adfd5660c2d9010803430800802a80907fb02d3bc7ad981fe
MD5 7043f682a23d2312067d8d21c3ce7e74
SHA1 d0d2cb4bca4152232ecc5d6506286f25715f390f
SHA512 c517f2a7ba31aab27a4ce9f2973ac102c3eea8def09a784a06d7cc2135532a29349a63c97834a4981d353ff5d3b91c6803e75a92225f50d9076eef32357e7e4f
SSDEEP 12288:+YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1724523BE965C41CBE52644B5C3E5F10DAC073E5BE92004937A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0b4139dd38b79b75b1f3bb6cbceed7427a52b02d292e1f263965769158aa1005
MD5 404d6880caee88166173eb453407959e
SHA1 34c61136ee932c4e4e4a7f4ffe15c5ce8745518b
SHA512 c5f902b7eef7eb0111a43637f59f777380a727c5b3f16e44c8dd4359e2201c935ad7d8cb30cddf2cdaa650c36ad0ecf862354d39fb1a02570b44a4c8ec22cd4e
SSDEEP 12288:T8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:T8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE4523BE965C41CBE62644B5C3E5F11DAC073E5BE92004837A67BCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 1861397c0edbd7ecb643d832ee4e5a780e3ce6fb71e35ab610796001620eba88
MD5 1c959d7258eebf59cd98ea17746c3153
SHA1 c4aaacc4257569b8f148caccffb35a146ad981c8
SHA512 4d57cb63924f2495fde90a9340b0571ba0d01a8e91910a543b0b3d4703468bace1e9ca23021ab373eb809c0672e887db62b68ce82215eedfb97d80aa6c61e444
SSDEEP 24576:bZMRzFVSOUsqjnhMgeiCl7G0nehbGZpbD:bZMRzfUDmg27RnWGj
TLSH
T1276501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 87a4173dca3071b9cf64d0691ad23b5335cc6fee7c5def70db187f5ed78645ce
MD5 fe00fc0539268984b3f087e3142d11b8
SHA1 2961277eba067f0ab36c0906b3b7f3ac44ae8ede
SHA512 46af9151c767ce5ca36f485a01571ef42e2c499674ab237ed9ed4a7d3d9c704e42c8033fadd8bcbd1fc1c6fbb40e82c44a2ad356aa2630a0b5ce1f60afe9a72a
SSDEEP 12288:iZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF4523BF965C41CAE62604B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0b7e25a29cfe210c688699ebf9aa31a22a0fcabb5c54bfc6a2b362f203c7fa2e
MD5 3f3bbb8206b9f01b5e4e4d5f6fe1fc4c
SHA1 b0b4c918c6d23b8abf9a74306fb66a3ddd170cb0
SHA512 6e4300fba47c99bcd7c14932ce40925d33c7cf52ecd3faf89fa7d5e33a2fd28d2da8670c41af1def15ca5a0cb2cbac5d1d40cee6a590899ebcf057644ca623ae
SSDEEP 12288:elXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEo:elsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E44523BF965C41CAE62644B5C3E5F14DAC073E5BE92004837A6B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f4a3c26382708a66fc1e4412416bd4dc6ee77c73905493c66a6c38dbd7933858
MD5 37ac9ae537d9afb9a95b9b4aa8e7a29b
SHA1 e935dfddc9497274845b9a832e30c55a28f36ef0
SHA512 822b3122fe03e33832d4904eca971932a0c757b0cc825f931944b4636206bc26e765297e780db29907306596e1f14ea33bef1b95dc252a89d49c3cd5a8683085
SSDEEP 12288:XyPz5L8wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:azywsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB55125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736904E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f1c137bb402c325ecb64faecec3a7788cac0d3d2024e1918ce08ac5a8996957e
MD5 f4ec6e16af6ce3e14497e3f4af860c60
SHA1 3f1139b414da56ee48dcde3ddebce1188d916004
SHA512 0df1a5f8d63bbea6fcd9361b90b068642a1b8603357614d81d5002573dc8bc7b49e47085896df9cc42729efc15db63af410b10ef0eb3dc65d33249ad5ab67c59
SSDEEP 12288:7ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F4523BF965C41CAE62604B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 74ac59a22f649f1ad9336eaa66b7d6f8cfaae746c90d36160eed9a713a85f90c
MD5 a30c7dda4d5085be81666c46107e8ca2
SHA1 16aa4d8bc48cb6b314e5116cb4a0a42dd0f074b4
SHA512 8ae1a5bfe1be8673ff8e064aa6de73e6a64d48ac48998c82488b45e838a4211903f81d83b9b1e2f92ed74a83ec974bb1b5fad49fda8e07e6e21f8a7042815e8d
SSDEEP 12288:PZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 bf3172cf24c0b53da4ce88257a8e291e35970b967ca927200d912c234f82a9bc
MD5 322175f18586fbd8c582dc1d617f158f
SHA1 5d9a3754d393092a0bf2c508ca7854d4f51883cb
SHA512 139c343c304ac338d5ca208938591b30c183e46b9f7828e700da5288aa1e8852b06cb4c4858d38dd56492bb7666e5bca15b10692d010bce7b9a9047b2bbbe9ee
SSDEEP 24576:XCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAmsqjnhMgeiCl7G0nehbGZpbD:XCUZPTY+8Wg2lIL8lrIUJLWwfDmg27RN
TLSH
T1BD65AE1EA3DC0896D4BB81358A51CA06EB32782E1B3196CF2160C77D6F67ED54E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6875997282371ada1eb542dda6756affa3c02e73b98287594a042137d226363d
MD5 bd3df9f85d67f9df4ca8f109097a115a
SHA1 fc1e79c5d2246b8ac27b5468d6d4b045aeae5ad3
SHA512 597142f0b4936dc1b1da1b9289364238ace264d4c41bbcadf94d5bfd728cfdb58e3205c60fd2ea669a6900161f6b94a2f7299284fbee31f22a7244b83448d3f6
SSDEEP 12288:QbsfJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ee43f987f0b7767bd15c917a9aef0a5492682916af77fb6003edfe2c676502c9
MD5 1d81aa9ddf018bd5862d041ba9826b27
SHA1 aea5ffccfcc68f398f906e3752ea4d39104b70a2
SHA512 e621126ceeaa0ad6923237627d9e4e6899229cba8dfe3b61f4de95cf741fa7ffb96b3112c712b9d1247897171325cd13c4c88b4bbef8f13764d243d618096440
SSDEEP 12288:WCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B45237AD34C518AE57649B482EAF12D681B7E669F2004C3B94338FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 97880939e5085cbb482407d27bdf74b6967f62971594935c3e44ba62e32d99ee
MD5 ee2a568d66a819ee0483901991ef7938
SHA1 c856fc2e3223c6072e8ea6ff9bd7538eacbedd50
SHA512 42d64c8d32bf7443e4e0bcf736f4a1a1216bdfddbe61b7fd634f69afd62bc59deb14cfe92d474c73f631dfb51a6e379c72d529d82c7377d30efce85bf496e7ea
SSDEEP 24576:Y8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCAsqjnhMgeiCl7G0nehbGZpbD:JRZwQCyiHiQEaiPnMlDmg27RnWGj
TLSH
T13285B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 8c0f337fe95239603d9e3b8a001fa45eda8f4ef03f54b73ff6424671ef7737ba
MD5 75a991042518c717d4e3d62baa72f06d
SHA1 0d7d772d0f8503ab2159a50e06334ee4969a2c1a
SHA512 e940012fa8a7ba85101de4bd1c625451a6224785e28aaecad4a672c826388f229ce0dc999d8e806027bca5b072ae52fbab69233e1097674c8d2fb9b35ad556e6
SSDEEP 12288:LbxA1U7KSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LbxA1UGSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E55123E62AC20E5E176957D86D2C10AD6337C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1a7ea07413733ca34e569e021b4ddedc5d2b8546794390cb7fe988d47f156733
MD5 3d91c3247972ff6d0abf79f775c69a8e
SHA1 211221cbf13bdc7e9db2d2bb4cb309304c558cab
SHA512 39ba18506b4c685c4b316e02853d893837f69a545bfa67d18db4ca9ff649219bd71211d5572bd235d455dd53bb6228e1206db73d3f964e008333e3e130dd6b26
SSDEEP 24576:3jsmP0yHaqrVqHra44KDzMsrnzsqjnhMgeiCl7G0nehbGZpbD:3jRP0yHfVqzlAsrn3Dmg27RnWGj
TLSH
T1AC45AF2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 9791fb836639449c49af7a75c2481912b3d7a58dfa5b753c092af7e098364a97
MD5 c543c0a5cababd885b5f82358e9823c5
SHA1 9af59e328ac948f6c8bda6ebd9d0e012a8309840
SHA512 bcc96522eb0c36d4c61cc8d741868a581880e85b8f826a0aa780abb883d58e864bd74aed09f7524691d9c9917681a4adfc52aea8f1e731ad6134ebfeed3ceb1a
SSDEEP 12288:n4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:n4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1964523BE924C51CAE93649B5C3E9E11DA8073E269B2004D379577CFEEBB54E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 8a32ea1fb81f4ccd63cb5d419f06e8b94a6c6a8a7ad51e7c3a4d3f9557d444ac
MD5 666dd799edbfd6b5c213c29dc3c6bf88
SHA1 94b7b836af0e5d1bb42069b3142fd8eb1c8fd8ab
SHA512 184e1bea82a87f2c9d6942e1ec681764e597b37520700a6c5e0c0b2c17c60308460a0f2de1c91e1bcda51aa2524832049ad43b80d4889f3da114f618a106c2d6
SSDEEP 12288:2ObfA4LWO+vAYFTeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:fbLBUTesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 cec3cdd19bb1958452de1c31361d240e22d999bd0e0c5c2c5cb89855375016d6
MD5 5cd2f95660074c72bd60e64bbeaab91e
SHA1 6e677b120fb74afd319ba1bbde0c6937f0dc0aff
SHA512 ef9a30ba30fbe186bbac62f305f0e1cd0f844855ae629423075b14a14c98901be2c892f2376c4b600a603c32cd464151e52d6081a6894b38099ac195a39a55af
SSDEEP 12288:170Vm9IYNvUyBpdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:ypYNH/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14265E12FA2AC08E5E57B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 480ec4a6f01c448596662e7c727bc229b7ce1554a40926556e0bf3a60ae19fae
MD5 14025be992300aec287a7bbc7f03abba
SHA1 5a221c08a918e1da37952aeb38941a491f3b4f0d
SHA512 134413edd75fa0071fc34143a9c05543bdb9acfb8c5b7a438d1b3cf69863059a5922a8525b0c0ca636c64cc34213a59b4ebfcc9d3ca93d18d3c18c9e455bb2e1
SSDEEP 24576:ZnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKT:ZnXoJJYH84VVS6AmEOJas+cHBjSSKHPT
TLSH
T18565BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1a7d78c7025eb176bfce7bec52351c23d8fb1ddd77ffffe5055784a7bd406a25
MD5 0ed4b20cad161a933fe43be04810c362
SHA1 a4123d18bff16f194449f4ca67f91f277285bd11
SHA512 b672a3e7e7285ca0480df08ddd40be8bbeca95e529b2f090fd159bdba5e8a283cbbf5b674eca939e239c4a906ac9fbc9645bb4f2da1b72e9bcb020afcfe09985
SSDEEP 24576:Nv7Xbxd9Tuycf8M/TYlSuxrr2PC1sqjnhMgeiCl7G0nehbGZpbD:NDLL9TuJ0M/TYj2PEDmg27RnWGj
TLSH
T101858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 daba92c84b08a72138886e69b53a3fd903d6c502961cc5d27e272ddb3864cb3d
MD5 b690714a67da44d0c3048710caf9286c
SHA1 84ce39a3bf69012863f5dd7e99945019cf4f3bea
SHA512 deae8794a19e077f8069fd608581d89a557ee12649021bf0e5faf43e4feb730431fe9bbdeafc203b43905d5810c002769a4c48a96b79d5e8e198219ade3902e4
SSDEEP 24576:TegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wesqjnhMgeiCl7G0nehbGZpbD:TngOJOmPOHzyDmg27RnWGj
TLSH
T1D155CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 ac8c8c956c6b932a21d42531cc32676e96f22255e75d7e9b313dc3ea6f99d3be
MD5 059d0c5ced84011a23af368a6825d6d9
SHA1 e5085c36dfec3617ab87a998d7e0b3eeb6ace737
SHA512 e03023074f1f484f34ffebc70d0c87a2b677912393ff19ff8a879dbc65bdc3ac77fb4920ed7f501fd422377a5cb777e52ff32f53c4ec5c07b90e4a1848fe6e86
SSDEEP 24576:iLJnJiTk3R3waE4JrOYsqjnhMgeiCl7G0nehbGZpbD:iLJnJK8R304lnDmg27RnWGj
TLSH
T1C275E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d0183f608c0968b2fe3f6f85454ab685318fbb395b9304324741066af3e7f554
MD5 4584639567d4d3a45fe54c8d3ef5996d
SHA1 5898a4042f1f2caf487950a5b7eddfa06cbb28d3
SHA512 6a92c0ce6cc8388d5cae3a483676f596049db11be7bb76aa7283bbcb0a1761ee093262662c567f1a5724831fcc9a6db50eb9d447db52715b7f07895c264a6720
SSDEEP 49152:u9mqCzDScAZmlvTcFg8Ph6oDmg27RnWGj:gDD527BWG
TLSH
T1FA955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 5174b5a04a07033544292e9c3780506d870d8002452c127bdaa4eb62a3eb6d76
MD5 e7cda6601db76c3c3e7aa7f15f9ce6bc
SHA1 bfafddf366c8d6c0323a9d5d90b5eeb0139e7e9a
SHA512 aded969ad570211fec9ad30702ef6111d4cfcae1a59b1b456614c17404d2cbe80f13cfa45260764ab2f749cf7f51e0f853c07022688a9fa75facd3396eb23659
SSDEEP 24576:mlYJeXm5jUuEusqjnhMgeiCl7G0nehbGZpbD:mlYJeXmRUuECDmg27RnWGj
TLSH
T10A55126E669C30E5E13A8079C2E2C508E633B872671017EF56E1D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 9dcc1b3cd2c131b8793e7909c17034513c98eec44f6b0c564599ef66f46ef5a9
MD5 e7b66b15aedb4e745fbcac26da7d83da
SHA1 7cb94ab46d6826ff835b5930c6205d74e3c470cf
SHA512 7d0e541ed71e38a23897786485b09dab85f021c44e52ad9c64f1c2d3b9afa9fbd9012300c186e31d00e5e3d4264dc84eee40cf74aadf142337a8352c2d8ba200
SSDEEP 12288:pmu6kyTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:p7tyTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C552219639860D9EA760578C6B3C158DC367C219F2006DF65E2FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 860ef728a6b22d92add2c8aad3b13cee602358094ee45b056b7d076ba52dd1c3
MD5 af3eaaa0828be579881f43bdafc2a0ae
SHA1 04d608bccc8328a86ad55e89bfe60003e98087bd
SHA512 51860111a21c3f88bef4731a55f4a47787468783f58e6ff2267925c9f85de7b2864b5966d72a76a6c37e808512f1934538eefc3b1140e43ae969d903ed83784c
SSDEEP 12288:nPeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1184523BE525C60CAD93245B4C2A5E10DA8173E36AB2014E779E3FCBDEBB54D44B38813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 24563034d1d121d2c0aa94609d260c0617c802eac1b8efc150f6aa6dd2d20010
MD5 344626f3ac544d531b7e224327c3c3e0
SHA1 994ee76b9207e6a4ebdc5dc00a989629eb3cac11
SHA512 6a24765a67f09f40fce1b473ae2389ba0b26d9d41e568432b1c598bba438a974cd23889e4c85354f474fa67827aa7f9cdf664c327a73cfd92d77d1c7e4f5f087
SSDEEP 24576:aC+TyQIu93VAumZr7jmpsqjnhMgeiCl7G0nehbGZpbD:a/TfIq+YtDmg27RnWGj
TLSH
T14E558D2DA7F919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 451dff27adb1825fb5d571541070466776b974068508d0f5c2fddb0e608db07d
MD5 97b20e364b7606e3b0c3e8b8e45105d8
SHA1 2cb5952b3c5f0ad0d4e9ef678071d61626e3722f
SHA512 63cd41ed3adb002b390d7acac08f771d17024c938a180da3fdf4f4d84d2adffa64bdf380caee338f0e0dd5dccd92ed6752d9f28b59e9dbcffeed787abd459433
SSDEEP 12288:ecyrWOstaa3kcsaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:HLQikZasqjnhMgeiCl7G0nehbGZpbD
TLSH
T10565F11FB3AE00A5E067813CC8858116FA737835571167DF02A1CB7D5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3e88fc80401bdaea1fd6d6a32c526702a97cc6d38b649c948177d33c7d1bab6b
MD5 955d88e40e62eda9e4aa77a91e24e2f5
SHA1 2e33b338f11bcf2fa43412849fd589637c516b81
SHA512 66a4ec474f8d0c0b945204273bf845d2f4624a3bed70e7775b1be64603dfde33e10e9ba57c47c4af572f3e1a7b6b3a885fe954811dc2bbae8a210ff9baefab3e
SSDEEP 49152:3pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPXDmg27RnWm:8pC7b4+80GTkgD527BWG
TLSH
T186A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6aaa4004f1e6a08df3336cd5aab67bd967855eeaf8968bdde4cd4a48b9e96af8
MD5 fcf645a144818c22dd50322fb9b9fef0
SHA1 aef9b8f7859fecae5005fc87a9b3c840256e3a1c
SHA512 60d10ffb00d3dc643a8af530119d120068de03c605fe8f8b144d2ae5317387ad8edab93075786145b41526db31f149d54a69417404acb743bf5bf088e59a2a01
SSDEEP 24576:lSAwJPE1IDAo+4Kt+l4413JUQLsqjnhMgeiCl7G0nehbGZpbD:lqPCIo4Kol4vQ/Dmg27RnWGj
TLSH
T1EA55BF2AA7F956E5E17ACBB4C663C601FB733822133163CF5290857E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 7cec2e1dfa04582dbdaaf938f08afabda34bd5d41aade10fd4a2ff881159b44d
MD5 937bdf8346cee3344f720b5350e3e2e9
SHA1 d1d55c6de5b0bd46878f17036e72de589bacc7b5
SHA512 93b8ad818a4e29ffff7ace9d7099a436321c3985861885c2044e3d0268e281b8a8459b05a32b710446c38a755f4b1cc00d5c9e157c47aaeae87228728392a6e6
SSDEEP 24576:/yLXPLcw94tbsqjnhMgeiCl7G0nehbGZpbD:/y7PoXtPDmg27RnWGj
TLSH
T16275D03ED76C04E5E47AC27CC6A3C506F6723CAD033166CB19A095792F6BEE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 cd59e5211bb28fe4b22e99fa9cb320e59428057726fa1f8d5d99345c6d41da89
MD5 5b824f2fdc833a4a63c468f64920a3ce
SHA1 74d7ab46c6aaffc6af2f87db0da74be0d796d420
SHA512 f27819bc81c36ddd79c24dd1844f412e27f928b9f24e3c389b73f2892d1ffda1fbd23682e08a72734e893d37c3f0b9cb43c749a911bb1dfe9ba098418a4365a1
SSDEEP 12288:i9lyvj3IkxjbBzKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:iWv8qjpKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A65126E529820D9E43A4674C2A6D12994337C77173459EF75C5E8BF8B31AC0CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-274-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/236-161-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/780-131-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/780-137-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/780-173-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1000-172-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1000-152-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1000-158-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1068-463-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1068-197-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1068-189-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1068-195-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1304-89-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1304-76-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/1304-87-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/1304-82-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/1344-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1344-56-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1344-211-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1344-50-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1432-284-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1432-271-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1432-265-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1432-300-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1432-474-0x000000000B800000-0x000000000B99A000-memory.dmp

Download

memory/1432-316-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1432-475-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1432-276-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1452-213-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1452-208-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1452-212-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1452-226-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1640-98-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1640-91-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/1640-92-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1640-248-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/2016-125-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2016-273-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/2016-120-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2016-118-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/2116-472-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2116-252-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2116-261-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2116-473-0x00000000006C0000-0x00000000006C8000-memory.dmp

Download

memory/2116-258-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2444-486-0x0000022FD1690000-0x0000022FD16A0000-memory.dmp

Download

memory/2444-481-0x0000022FD1690000-0x0000022FD16A0000-memory.dmp

Download

memory/2444-479-0x0000022FD1690000-0x0000022FD16A0000-memory.dmp

Download

memory/2444-478-0x0000022FD1690000-0x0000022FD16A0000-memory.dmp

Download

memory/2444-477-0x0000022FD1690000-0x0000022FD16A0000-memory.dmp

Download

memory/2444-476-0x0000022FD1690000-0x0000022FD16A0000-memory.dmp

Download

memory/2444-483-0x0000022FD1690000-0x0000022FD16A0000-memory.dmp

Download

memory/2444-485-0x0000022FD1690000-0x0000022FD16A0000-memory.dmp

Download

memory/2444-480-0x0000022FD1690000-0x0000022FD16A0000-memory.dmp

Download

memory/2444-487-0x0000022FD1690000-0x0000022FD16A0000-memory.dmp

Download

memory/2444-484-0x0000022FD1690000-0x0000022FD16A0000-memory.dmp

Download

memory/2444-482-0x0000022FD1690000-0x0000022FD16A0000-memory.dmp

Download

memory/2844-464-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2844-222-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2844-216-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2844-225-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3124-177-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3124-185-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3124-462-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3124-179-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/3208-71-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3208-73-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3208-224-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3208-65-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3492-229-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3492-235-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3492-237-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3492-465-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3628-21-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3628-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3628-14-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3628-117-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3628-20-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3700-103-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3700-260-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3700-110-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3700-104-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4092-433-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4092-174-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4092-471-0x00000000017E0000-0x00000000018CA000-memory.dmp

Download

memory/4092-170-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4092-164-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4456-162-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4456-467-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4456-147-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4456-469-0x0000000001140000-0x000000000122A000-memory.dmp

Download

memory/4456-470-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4548-249-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4548-246-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4548-240-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4548-466-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4560-8-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/4560-0-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/4560-9-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/4560-85-0x0000000140000000-0x0000000140426000-memory.dmp

Download

memory/4984-35-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4984-27-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4984-36-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5044-39-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/5044-45-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/5044-59-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/5044-62-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5044-61-0x0000000001610000-0x00000000016FA000-memory.dmp

Download

memory/5044-47-0x0000000140000000-0x0000000140136000-memory.dmp

Download