de493dccb585ac04f2826c2fa2655942bebfac924167182541946841e5f4f8e0

Analysis

max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 11:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.5MB
Sample260502-n1xedset2x
SHA256 de493dccb585ac04f2826c2fa2655942bebfac924167182541946841e5f4f8e0
MD5 261b746916c0341a060fdadbfc86e00b
SHA1 00418863a300664cd7b175e5d3c033291d86076c
SHA512 64672f2d7dc0c2e0d61a6b056c1680a3babbf1318fe4d8fc356e749a6962c28c166c9bfd2d53c3d1720462a3c0b1197f6bff578dfccd93fc8dd72f79a7a0ec65
SSDEEP 24576:bNtQwa0fF5yEVj4xVirnlBUKZ408vTZrX+lgdW:bN2ifFH8iLlBUKubZrX+ld
TLSH
T12575E10AF7A804F9E07B9274C9629505E7B27C9E4771D7AF23A402971F336E09D3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4336	alg.exe
1044	DiagnosticsHub.StandardCollector.Service.exe
3896	fxssvc.exe
5396	elevation_service.exe
5912	elevation_service.exe
2456	maintenanceservice.exe
4280	msdtc.exe
5232	OSE.EXE
5236	PerceptionSimulationService.exe
6020	perfhost.exe
4784	locator.exe
4416	SensorDataService.exe
3532	snmptrap.exe
2260	spectrum.exe
3108	ssh-agent.exe
4076	TieringEngineService.exe
3368	AgentService.exe
2708	vds.exe
3164	vssvc.exe
1212	wbengine.exe
4732	WmiApSrv.exe
344	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6f2dcd3c8b62accd.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001417dc352adadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043e950362adadc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007832bc362adadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7854e362adadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7b660372adadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b216b362adadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	3896	fxssvc.exe
Token: SeRestorePrivilege	4076	TieringEngineService.exe
Token: SeManageVolumePrivilege	4076	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3368	AgentService.exe
Token: SeBackupPrivilege	3164	vssvc.exe
Token: SeRestorePrivilege	3164	vssvc.exe
Token: SeAuditPrivilege	3164	vssvc.exe
Token: SeBackupPrivilege	1212	wbengine.exe
Token: SeRestorePrivilege	1212	wbengine.exe
Token: SeSecurityPrivilege	1212	wbengine.exe
Token: 33	344	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	344	SearchIndexer.exe
Token: SeDebugPrivilege	2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	2500	2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeDebugPrivilege	4336	alg.exe
Token: SeDebugPrivilege	4336	alg.exe
Token: SeDebugPrivilege	4336	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 4392	344	SearchIndexer.exe	104
PID 344 wrote to memory of 5896	344	SearchIndexer.exe	105
PID 344 wrote to memory of 1864	344	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_261b746916c0341a060fdadbfc86e00b_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5508

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2456

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5232

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5236

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6020

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4784

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4416

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3532

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2260

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5308

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3368

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4732

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4392
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2936 2976 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5896
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2972 2944 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d0dda99b7357cba48ff3825625c95d4d2f4d1cb1b2612a7e10e36d7686ded52a
MD5 45fc90dadd8906f3e4f5d8b23b86d5ed
SHA1 806b88240efb75e715a4ca5b5239f020dcd274a2
SHA512 463cd6a3f733e66b5e3bd6411c1676550570098488d5266230a214af5c982f56287a3255d0f5bd75379908149027e15128fcbbf57fa0da2e22e783dccf2d95cb
SSDEEP 49152:5b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnCiLlBUKubZrX+ld:P3q6sjBniBSTZL+ld
TLSH
T1E9D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1d30c617712e5aff8f62bd81487cf48c5b0c4444855ec5d6efa6b031a83cdf5d
MD5 da8116ef228e1c0a477c39eb046c8488
SHA1 4060cbbbaad6bc091f634a6d88c1decfe01b53dd
SHA512 65085ff5951ea99ce9b79d3207c8e42da4ebe58357a1726551395660105bbccc059f356501796aeae7076744106cd8e23577e4f0f9f10ba182778e466f338137
SSDEEP 24576:MXYfDtczA7xVirnlBUKZ408vTZrX+lgdW:rtcwiLlBUKubZrX+ld
TLSH
T12D65F11973D508F9EC6B827DC8A18501E6737C9247A0E79B03F09A661F336D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 542d6b39cd465c21754b516ef8e8b5bbef35cfdbd5e058b69d2f648f21b4d2a0
MD5 2f663878b2a63db678eb72b4e4c21519
SHA1 9621e706d11c4f12d2d738c9d6f64354824f9a88
SHA512 fb3356b87b21198af200b0a46beacc44033f287fdafafccd082341e13675b5fc3997481d210968959a2bd411be5b81e7a2b15fac28b9284a554c10093160bdcc
SSDEEP 24576:k0Le5ji0hmxxrMkxVirnlBUKZ408vTZrX+lgdW:kPji0AjFiLlBUKubZrX+ld
TLSH
T10E85AE16F6748735D073C0B9C5D2A68EE97230825B308ACB4296D77C3F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 335b8ce06c28166276e48c4c8b012aed99f721e0ae8c7dff09f5c2ab1223c633
MD5 7f34443c95c9565df13a15f1296e390a
SHA1 f5513feca1028c71f200f129e1b222fa0dbddd58
SHA512 59bced0a4bb2f5452374b72f33cc6badd2b172d46b611e06a5a6c7234c758477ed454fbdeb3886f94bfe4157bc5535615c0a4a6fdd277a1222f45048d7fc4252
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWn6q8wyumxVirnlBUKZ408vTZrX+lgdW:i/ezSC6vUzPveHjyxiLlBUKubZrX+ld
TLSH
T19A756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bdb8386712148b64dbdfdea3bd08ad77592ee20cc9b9a3a6d697c111b96af810
MD5 2a5d59156f927d611f2fb365de78582d
SHA1 a1071a2c4edcc84237d04c0dbe13f1c9d667382f
SHA512 8d9f3e2e50a0957d074fb53058fd14e1a93473425cf5fa08f96b05d4c3cfad35c555a20e6f5d552be6010fa6c96d89d6743067834e448e290cdfcc3daecbbf3c
SSDEEP 24576:IVbqPb88hv/l+Y3xVirnlBUKZ408vTZrX+lgdW:IVO88hXl+oiLlBUKubZrX+ld
TLSH
T16C55AF66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 96c489dcbb7adba6da773b2440cacce32fb0f3eb723a27231af3099151035cda
MD5 27f9c19e317bddc0672471a9b845c59a
SHA1 61527f4a55bda53c27f62931dc7ee8a54d0e2bbc
SHA512 0bef88f7f08f02af932b5601c2c275acaf129b9af0ba76cda47946454df29e18aabdab5171c6ae7e9f3080d34d6a5b6b3a70be096b26972df7cfcb6e00ce24e4
SSDEEP 12288:mLAxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:mLAxVirnlBUKZ408vTZrX+lgdW
TLSH
T14245234622451867F23F4BF1B0B49D01F2EF2C93E8A9692763B137460D768F9F8126E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f6f8511a8ada936cabff11e0113595e2a631ed4d6d2c9ecbc5c4fe62b05ed62e
MD5 7f11c3124456ee98f0775e42c01aa144
SHA1 24e0a5692ea84bb5846c30cde2be6ae73843ed35
SHA512 d47c9a7350ce28733a9d7ce1fda8499090ddb3741d5df6d7b2070cb54e50334788c920ddf34feb13db0a990189df809e390f1d579ad0aab802f277b593236e5b
SSDEEP 12288:peBNUbTVO86UvxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:pJIUvxVirnlBUKZ408vTZrX+lgdW
TLSH
T19165D02BAE28FCE2C27E4DB856918600E7B278714F61A3CBD275830EDE235E45D75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b676da1cfa0323d0f0c14706120efa08401e59e49325a5be29ab66753b075113
MD5 91c2287e553867c1d8b331f994a4edaf
SHA1 036d0deb50944073fe248511fd491608b33ca156
SHA512 4febf8de40d7f0bd84eec1267148de45e65d80bc78f3c5da167cd8edea45545dc2daa55a12f73cee31fb3c72d2b9e1753d286e77caacf0a9ddcdf670b183d992
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH4:QQvGAdlCEL8c/DRNw5CQiBSTZL+ld
TLSH
T164266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1c767b1862929e47178b61ac35ea4f52a209410d3f93ad4a6c0996e840244dcb
MD5 53be67bdbc7525d31e6574afbe66faae
SHA1 7d7ec2ecb23642a86bef5dc2789c8a705eade157
SHA512 5c07dd479adad6e7b63aae98f32abcea9ac5a795a0b9a8c0632da173fa8caaa87c468e3e81ada0932f13d81f6cf1a199540d39d31a9a3e32577f72ec6a866149
SSDEEP 12288:sAwSfxL/2Dc3RDLLmt0LDQewsAjxxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:R0ewsAjxxVirnlBUKZ408vTZrX+lgdW
TLSH
T1A375E021FA75E436C27F0DB22B35C706647D79604BA12AC3E3F85E8E59301D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a4dccb479ccdf97fd4fb0a1679decfe2045f58028cdffe6ce62554648bffed57
MD5 c51a91d54f2c105de288e28c893bc4ad
SHA1 ee0616e1092eae5eb06d0432e4774f8e8b915e81
SHA512 f37c7d60ab6ccb047f02e6f278faf75e34e9213cf1198e675041d0839b34bb2a365802e53b8f16437f47d3e6a944770eae40d474e0b269e622299beaa9b3cf47
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHDZLud:HUEtQevvqc2W1cpV2tI32Zu
TLSH
T16A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1fca24af8136f4a1d463cdb291547665e934991dcbdebfffc278e464f1214b01
MD5 7c7154439e1f5db3d7d7a4e675280f95
SHA1 9ea9d3ec8b52f43acd4c3e11690d0d8f04dda75e
SHA512 e5a155f8057702884d79d568ec880abb0ce13339d4e9a28b4150d042fa4b36596a28ab0327c3615a5d6d45e8710a57773812c9aa5dabbf196ef2be8d0e488799
SSDEEP 49152:UCbRquA/m2yL5zTfFiV+XenmE3/z1iLlBUKubZrX+ld:9oquVjnmsiBSTZL+ld
TLSH
T1C8D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 182fdde87f6f213105787dd578eb4c295945fe5d96be0d045ea13f1cf1928972
MD5 d127d1c30d8b904a645eaff41a851446
SHA1 3782feffc5f816b32a4a6531d03c41e8f4c414c3
SHA512 d269f5230306d625138a8a932471936ffc748ad71cd99d75da478394e08fc0e141f69d4523cf84382df2c9162a757d8f31c95a4351c037668680b585c5a49cf4
SSDEEP 24576:sAhGL3IFoiwtA5l7S53qxVirnlBUKZ408vTZrX+lgdW:sAMUFoiq58iLlBUKubZrX+ld
TLSH
T119359E81E7F955D4F5B3AAB899B58570EA76BCA65E31C20F2260D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f54147a81c84ecc26658ca97cbfb7c0118a46c995873370a8df562dfb45bf337
MD5 7bb6ef82bc0229a23e2912aff358d248
SHA1 df77addf51994709857429ee2d8e0cbf2e61ba39
SHA512 f8ec2ff58e417aac18e152b2e97a20e1d4977baa741bd039bec91228e0ddab8b62758cf277c7b9ab9efd8965b868171572d3af7212cf5101cf97ea87bdda1905
SSDEEP 12288:amw5HEjsChNVBFgl0WDm+CGxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:zwu4OWlxVirnlBUKZ408vTZrX+lgdW
TLSH
T1B465F04A32A50CF9E56782398597C536F7F3BC022A25DB1F1370C65B5F33261AD2AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e4b85de6b261d9b53247f5c618e19101deab111618b306f25730cde7e08cbc68
MD5 5c05913eecebe474f804b3c0dc4a6007
SHA1 84acb6eae5aedd26ed6d0295980d334d641d33de
SHA512 2f65540b81dc94dfa2cfe2f5e3cc60b87ed2b02bc1db5e925f951da1c73abf7aa9cf60d26f7e8fa2777c08a65a66aa66d13804148720c4200c6ddf7eccc0ae6f
SSDEEP 12288:5eZ1IyBxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:8ZucxVirnlBUKZ408vTZrX+lgdW
TLSH
T17D55128A32D420FAE17742B9D8F04A05E3B638A3A77653CF237112561F339D66D36762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6a0e9f7859d71bbab16780f0b541478e67e48292acf67b1056bf22bd54a16664
MD5 2c0b09943a0cea31a3efcec6d09b7d23
SHA1 947f51eb0217c5f2882a0fc97334abc0e84b1f8d
SHA512 5375c949c24b3a0ee16bd0c56437768e6e8abf80be9e1c819a3c2a45be7fa2eafbef2e1e256677917f5b8eb1a5fa81b4cb4c15e650b96004e569a762a81c4187
SSDEEP 98304:uQRQyi36YOcPbLvw2gAf+PN37iBSTZL+ld:1QyiKa/X+PNVZLud
TLSH
T17E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 28f881d28a8825cd4f1f27fa990ec82b50a8df69bdd5827a9ddd86e0e9ef94c0
MD5 3588b83e967c28b340415be43ec1dbcf
SHA1 1e11895e58a05861013d0a828811da3c0942f238
SHA512 946c79d4e76504cdfa5c5b179f6de370d2b865df094623ba106d6849cc3671d38e9b48d2080e8cab2a003b4e0201d1bf620a419e8a82cbf0c00f23bd075bc273
SSDEEP 98304:wQRQyi36YOcPbLvw2gAf+PN37iBSTZL+ld:nQyiKa/X+PNVZLud
TLSH
T184667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 73671ba45f68c65a4138f0734741032d8e92b33a8c0f04ce124754f9080c1802
MD5 590bf56a035ca15c4f1ce5feadef9450
SHA1 704d91d88982348a79d21fe337b54f083e1b0262
SHA512 3959543551c7deb35b81a1b5e59601f3d5ccb54c2b1daf1e3c5c238faa6ae5c8a1b8441a0727859a73942c2fbb6cf19891b8cc44eb42eddb8d593f6241ce424e
SSDEEP 49152:R68Qg55nhceWu7PNU3/FiLlBUKubZrX+ld:PthLRc/FiBSTZL+ld
TLSH
T1DDB54A33B2F600A9C05DE1769F4A872196D27C758FE1E3DB815172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 591d6f6303332fd6cd4edd16ab2224a2f1a0131642f6919aa2b46e3c3a7c9c63
MD5 350982575b06181f4d397133fb87eef3
SHA1 68bf71761ca441a82741e383fcb3411cd006ee1c
SHA512 71a6f2da36acf0535c62ba07a78730945866554fa2b9a826821076e7836a5a494683bebe0c47786e7b453a410f7ec74d561821b4594be42fab96f65d09e50ce0
SSDEEP 98304:Py5112gYy5azzVvt69nLKnhZ+iBSTZL+ld:CLIHEWhQZLud
TLSH
T174167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 114b009b9b13077ad3087df29ccfaaafb11be8ceed934c2d9088d7314ef2d423
MD5 7fcb04c5977b0df8eb2fa4620cf28389
SHA1 9e528c4278946f10e30a40814413d2d0e88553c6
SHA512 e95cd377b8a07fea9f0c31ffa5eab81d9eaa54da1393329d1385dadfe88ce8b97d26c6bc730ce20001a82c1805764d023b97a6cb9ab22f469175c61e4550beff
SSDEEP 49152:vB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glziLlBUKubZrX+ld:Ru6Jmdxd2dziBSTZL+ld
TLSH
T123D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dcf266682120a363e82b23613ec21f79c686bbacb27651597fd2c3c106a9b8d7
MD5 305b5fd82d7f733e39fb695d9357d439
SHA1 2f922d4029c040e22c31c6c80870411929641fee
SHA512 d695ef328aca8a2f0e11fd329e81203b80be1e585b4d4e9731eccc0669388cd273a1acf4505b0d7c717d6a932c51b74c5b356d7f3d81d079870722859d293fac
SSDEEP 49152:S1hpsNoJpF1A63U44CwH7R4xPiLlBUKubZrX+ld:SmifPWRsiBSTZL+ld
TLSH
T10FB5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 29db1ac7560bc9d1c3df05d29844d82695228f99fa4ab6cda27c4027189c68ec
MD5 e828e74f90204120f343a1c9f8119603
SHA1 875d1c92e9d63b88b312c1a60db3b4ac084a5012
SHA512 9606641adeef0cc9a187df4eeaf2ffe69a985f8bb5c8fb183719bab8281c544b67a910151c1e218932cd136abbed2fbe3b3de5cc644147628789ef5b518bd4b9
SSDEEP 49152:gSuZQIY0Be2KcRVtOnks6NMHqSiLlBUKubZrX+ld:65dKii61SiBSTZL+ld
TLSH
T1DCC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 44b7945cf530dce4249416693aaf35af4a4202a240c9a192a04b5e043d23d68b
MD5 5afb8dd173d484bc8f06119e0f1fb304
SHA1 70e529463e8a9dbca7303453c0fb27b81effe37c
SHA512 7f76920033411b92f339874fc566476b480d471e196898f01d4af1ecd4e07a7446b49a1563c16a8b5afb8ecbefc46f26281116574abe3e33f9a02465ede81caf
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wDiLlBUKubZrX+ld:TX2imph4iBSTZL+ld
TLSH
T1F495BE03F2D900E8D06ED174C7568632EA62BC160B35AAEF0A9077561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6634ac5cb6a0c8922a520bde2eb9db859861158122fa863b90239274c6e416dc
MD5 c75f99e4d9c5c0b9f4121f3da3a6d934
SHA1 293fe712424c2df7f28fbdee7a4bd4a017c3bc27
SHA512 94e7a822e0230636cd46671fd96edd9cc5f7769f818800eb51fae5380d64e114d512d4e081bac21e8202e0d8023c5a31173c663c0d501d962640c03843e5828f
SSDEEP 12288:c4xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:c4xVirnlBUKZ408vTZrX+lgdW
TLSH
T18B45234A31860867F13A47F1A0B49905F2EF3C97F8A6656773B236421E73CF978126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1f9d79547034d87fbdf91329e4e9de5432d411f4decb53ac76498dab0a5e9526
MD5 d3d800a0e451897ee633dfcd210d07b3
SHA1 e4cb1b70e3df32ca4ff4dea38ab940dbdb43b143
SHA512 b022d8b88d066f5733446b1b6ac3bca72c5ab6bab96d853fda6a53fc6fbb5ebbd4057924761630ba85543ea75ee7488a5e46d2ec137e8684fd35b76102429de6
SSDEEP 12288:FtxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:FtxVirnlBUKZ408vTZrX+lgdW
TLSH
T16A45234A31860867F13A47F1A0B49905F2EF2C97F8A6656773B236421E73CFD78126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 dd16ace30f5e836259069bebe78ecf7ed74e608d25d44fc80f9153926af33cff
MD5 1898d2a18fec45f3f9d0cfad6711ba40
SHA1 f27354b7ca0714dfe5169bfb13428321e30d8d4d
SHA512 d8915aa6195adc1434f3b29e3495db611dd84f2ec713582c286a3bde873876724a76798adabf33e862f94287e59ccdfb61d06925cdcdd1069e69dc2d89eeb1f4
SSDEEP 12288:unxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:unxVirnlBUKZ408vTZrX+lgdW
TLSH
T15345234A21860867F13A47F1A0B49905F2EF2C97F8A6656773B236421E73CFD78126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c0bbebc04aa1e0057e274fbd1419ef8aa88760deb289b6af6514e3255e861df7
MD5 7d4240d617475db3f03dec8c5127be32
SHA1 8bd1aaafeaf63e6be0354d205b7b562bff06e1ad
SHA512 932d3495a6b91ed9b45f5d58c0abc151cba57b0ca4222be67f09a55b10db285e951058c3ecac4273092488597437dfc2df366121c4edd91c5643014b6a130454
SSDEEP 12288:tVKxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:SxVirnlBUKZ408vTZrX+lgdW
TLSH
T1E3452346329604E7E03A87F5D0B09901F3FB7C97F876666F637126460E729E87831BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2a74512c1944454691434c6625bc662011b9860d4977e86761b7a5315969b1b3
MD5 11652100c54d3f010ffdef40e32913e8
SHA1 727bf93394bd7f9d72add9ce513b124ab4b1c57f
SHA512 21f4e77d240707a35fdc6b5a09dc5425702de81c58c5fb59ac7b4cb3aa84145db1b0430b8bfcff87fadd86577393f66df723f01d98831e7fdec752a34e2058b8
SSDEEP 12288:fyxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:fyxVirnlBUKZ408vTZrX+lgdW
TLSH
T1C145234A31860867F03E47F1A0B49905F2EF2C97F8AA656773B236421E778FD78125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4d22b5726aa93c1765bcb8ac44ec8e1fc528f0e1e911bf7b9f9483ae39f75190
MD5 84af2a582e53ba519908a097c3116367
SHA1 553a366a09c50f1540aa321a09d97482c30a1e22
SHA512 b0d9442705df98ed2da07598896599879c272028e47e25fac56d9c26581b3a57fb56a3dd37bda1ce96a3a0817b6aa636f4a51f8978a7d6f60f663ca6b4db67ae
SSDEEP 12288:MpxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:MpxVirnlBUKZ408vTZrX+lgdW
TLSH
T13745234A31860867F13E47F1A0B49905F2EF2C97F8A6656773B236421E73CF978126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 eb11bc6ec1eacd19ef3a9d1853a1fa914018029f0b5f2e0a169109453bcac751
MD5 74d0f69c4796e2e0e602fc7b7cf9e698
SHA1 c1ff2c9625dde9a052a78025560be2727dc621af
SHA512 487fb1a8a759314f43b06a5575cdcbb2e3f8fd32e05ff8314de310c7183f2efd08c96f94bed506702c97304ac4d87f396613f05368f2e045d63ed0cf9552a7b7
SSDEEP 12288:yVxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:yVxVirnlBUKZ408vTZrX+lgdW
TLSH
T18E45234A31860867F13E47F1A0B49904F2EF3C97F8AA656773B226421E778FD78125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6d67e28339853a2aea96cbf8732c368695a60b9c0f9cb5aae3b1303417a9f415
MD5 32f8a97019c93c1494bfcaacc849f1fd
SHA1 8d8a4e78a203dd6634d13dc86e74cd0447ce427e
SHA512 e525a97a2e37bf4d60d6e6194a8396e33333b41b900e811793914757286011b4a22c9448b9cf0352a438ea881b91777530c5ac4530c73ecfa833874133f037ae
SSDEEP 24576:bZMRzFVSONxVirnlBUKZ408vTZrX+lgdW:bZMRzfdiLlBUKubZrX+ld
TLSH
T1E665F185739018F9EC77827EC8658906E2B27C5A5A70CA1F13B436571F337A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c81b69736e06b63456b233396b10ca7de4206e87314f8de1f74678b15a7af8cc
MD5 a8775b927b4c7349fd9e5d44f5322595
SHA1 a04b35010f841d6a3a7c7e6eb9b603a58f7d902d
SHA512 460eca7efdf000c2dd65cc2cd27ea492aa841faf8428b95807402e1a4b64496659ab9a82fa8f025188c3a3a035aa8d86374d3cb8419799da0f22bb57e4ca864e
SSDEEP 12288:8sxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:8sxVirnlBUKZ408vTZrX+lgdW
TLSH
T1BF45234A31860867F13E47F1A0B49905F6EF2C97F8A66567B3B226021E73CFD78125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3efa452084075b72aaf2bcead7de6ef4362dd9f187285a4ee777e7f7a4c7ad8b
MD5 79001df8c32354cc1def81a9792a73b4
SHA1 64d563b497a74469b37aaee1672d1133e3c748cf
SHA512 0f0d228175a6693691251b7915e5955c8f9420b68919d008faf97a0160d01a0ba8fe50ca683a7f562a1d40e6189263c96815eb3ed72db3c18e449a4fd402e8f1
SSDEEP 12288:AQxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:AQxVirnlBUKZ408vTZrX+lgdW
TLSH
T18F45234A31860867F03A47F1A0B49905F2EF3C97F8A6656773B226421E77CFD78126E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 409e9d30cde7d4d3323c24687e85773a76bb7841fc943556a8039cab8387e165
MD5 8f95145c4d3ee8cb82ac0eaee82b6156
SHA1 830fe847968812f56bc3d232024676050c955ca4
SHA512 802aa301a6ed4598d4e04ee727d1c43696a5a3b03c060be52d0f073caf458603edabb426ff8e0c0b8fd3f57d9ca104d9424a7bc007aa094eeae5b0b7319a0484
SSDEEP 12288:kyPz5L8BxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:9zyBxVirnlBUKZ408vTZrX+lgdW
TLSH
T1F555024732A120F9E13B8275C8A11A01F3B67C7757649AAF13B017661F336E5AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f9cb899bb53300c4d602b8727fdaf9778371e6b6c71559aebf4dbdf833d8f89f
MD5 807f886cfb4d1c227c719e21b51b02ec
SHA1 981809dfc3dd41c9ea984707c1f29e8cff0c7117
SHA512 81905b998844a15618de3e8c192d367b658d3c90d61b319b8eafccaadde6b17ea10c5a0550d5cd66af41cae45d010407ddd666709606cc2050cc754e07a88cc4
SSDEEP 12288:usxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:usxVirnlBUKZ408vTZrX+lgdW
TLSH
T1A645234A31860867F13E47F1A0B49905F2EF2C97F8A66567B3B226421E73CFD78125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9ed400cc04e896f6172caee906063a2f120f7c9f73fcd2772c4bd604877d0b78
MD5 c6dd438a9617752ef5cf5c32b12adfa9
SHA1 3dfb0a5946ab0a41391402fd0afb5c333d68771d
SHA512 cfc74bbd869ed072a5f013496fe85e0950e7e09850c8f26af776bbfdaf1bb6f549696ed6588ed862beddbd85078f1cd13a33a48a4dd7be80160195f7f98ac4d6
SSDEEP 12288:FsxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:FsxVirnlBUKZ408vTZrX+lgdW
TLSH
T10345234A31860867F13E47F1A0B49905F2EF2C97F8A6656773B226421E73CFD78125E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 771c486277a76faa858148abffa4c3946fabc69e260c2c77d61cba7013c70a4c
MD5 96dfc248876d09c5e1a8b75cc3801e77
SHA1 337a5b2a5780ad222987e663e136641edb187591
SHA512 cc79521297472b66117c98f0be440fbfa070ee907482b02377e7a729d105461a51d6beba586eb594c6633475fc6ce3f9e0b47fd0c646f093fd62f22b1cb86e5f
SSDEEP 24576:dCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAjxVirnlBUKZ408vTZrX+lgdW:dCUZPTY+8Wg2lIL8lrIUJLWwUiLlBUKL
TLSH
T1E165AE1EA3DC0896D0BB817589518A06FB72782A1B3296CF2170C33D6F67EE95E35F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0de7a930bac81d7a52630a0526521a2dd84b71189937b2b1f4f69f462022e4ad
MD5 9e049c7635e7ad9baaa5a6f4c522effd
SHA1 7341864225c95510c56236d55076f23975ff9c6b
SHA512 275a898f45c53b0f273cff6fb248cb762dc6e520a3a1f2c6b7ab5be46d568b375ac2f885d4bcf0c7891b7fc610cd838d968ddbe62fa31a160afa27ca24fcaf37
SSDEEP 12288:jbsfcxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:2cxVirnlBUKZ408vTZrX+lgdW
TLSH
T17E55F00AD28801E9D02E62B5C7654A00F3773C6696E193CB63E0F53E0F765D4ADEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 05d753c73e81ae79667efe903d7830d940e8d6b2c8ef31c891b5362bfe478256
MD5 eefaa9312fcba72a6255f9a430bbd569
SHA1 57b654e8ef2dd164e0303766e24ced34e098c58a
SHA512 e8189ede1acc00100a86f532747a201e103d092b54de0429744c201cff374a265f58a46d5d5bee35875e92e0d1efb871d3c426094d2f3b227190379b5ec4f43a
SSDEEP 12288:fHxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:fHxVirnlBUKZ408vTZrX+lgdW
TLSH
T19E45234622891867F03E5BF060B4D910F2AF7CA7EF65A4D7B36123451D32CE9BC326A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4ba28c585b416373a39f0bb5417c5ece4b94f390b60938371e419a9ed87b6d4a
MD5 be747ed840a343b98c932efb36c4eb82
SHA1 333e3439dd103c95e355cec211bb2c44bd4f95dd
SHA512 fb7268ffebd4431018683d0e9e4e05adb7c35141b82bbbaf15a97388981a5fb7d76fadb64d14becc532df644d9f883d2c2ece1e0f56b46e22f2ac89b232214d8
SSDEEP 49152:IRZwQCyiHiQEaiPnM6iLlBUKubZrX+ld:W9xPPJiBSTZL+ld
TLSH
T13685B01E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F27DF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 c6e06f5ae2e297b03cc76f87a8f4be15d227e428d4478dceb213424eb890cc25
MD5 851b25f3a766ef0d80ce0efe37cc2eed
SHA1 72f09c9d08ab38ad2727b4a2019beb2a86268b2a
SHA512 c5f54b769bb9ec79672995a08b945bf110b3ea2e0e5650dab2acef91f00908495d7508b66e4a6775e3e563a5ddddb05df0a67b57b1ea078ead071ab64276883f
SSDEEP 12288:pbxA1U7KXxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:pbxA1UGXxVirnlBUKZ408vTZrX+lgdW
TLSH
T1BD55120E229C14E5F07A967994E18105E3727C67672197EF22E1837A0F37EE86C36F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ec1a27c314e77206c3cf2b96027cd7904efe2150d0d1e6933b69e640d32ffc3b
MD5 863fcb9927a242b800c0962368b20b9e
SHA1 1855a590beb79323a4bd2bdb6932aef5ce6dc7ea
SHA512 d532d098db51f9eff78f9df72ab24cd0c2b76514eb0c966c4991e504df1efed343e636a559baad70f2f8c783808d70ae6117557be2b5a6144222dae0eae78c16
SSDEEP 24576:AjsmP0yHaqrVqHra44KDzMsrnaxVirnlBUKZ408vTZrX+lgdW:AjRP0yHfVqzlAsrn8iLlBUKubZrX+ld
TLSH
T17945BF2EF2B910F9D4AAD276454107B5FB71782D1F209AC70170C634AF0AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 504b6f2e892f3665c992e7fc3a41a03ba3a0f15394e08fffc4fc5bb406a24f04
MD5 f379f011ff09f82c131c7edfddc376dd
SHA1 9589e92cb1849853ff46da2e231f4bdf19323f77
SHA512 75ebb7f303e31b7631cf11abcb86a0d09aca5bcd3e8ad182e37dec6d65d9255aeb97b50fe32e844f3aebe478b4a1a51476fef8d646734ca4442a7455b7db2ff0
SSDEEP 12288:gJxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:gJxVirnlBUKZ408vTZrX+lgdW
TLSH
T1BC45234921461867F03A4BF5A0749901F2EF3C97E97665E773B236420E76CFE68326E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 947ee20f919d9c4c3e1313e38995b124340e4730412bad7b92fd351e1931ea4e
MD5 a50cb7164076e18576f43ad17f25fca2
SHA1 f1b26132663d1d49a2d428e41ab44cdc05b54429
SHA512 ad80f0e9ed189a995824ab35f966a080bb8553bf43d035893fd24ab5b7d1a5fb3de4afe1867091161d36497f94f06d90cc3382a3673b57728e90af118cd7e44d
SSDEEP 12288:4ObfA4LWO+vAYFT7xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:VbLBUT7xVirnlBUKZ408vTZrX+lgdW
TLSH
T18875F145F79500F9E87B827CC8B28916E2B2789E0764E7DF03A84B551F236E54E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ea5c9b589bdde1d761da446d7effde986d204f6f352a0883c4d4396c043c69c1
MD5 bac921fa453ec11d5c731913dba2bc70
SHA1 e061b8771c114070b6f603ae86fda26c499f3bf4
SHA512 c5cbd93308ed155585e9526ece9eced4e4970cc3cdfd1ec4914ab591f51d8931476ee7eee06ac51241f38601c9eac757b6f7f7a5ee9ca80241dced9c3155f3ff
SSDEEP 12288:u70Vm9IYNvUyBpoxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:/pYNHuxVirnlBUKZ408vTZrX+lgdW
TLSH
T13465F11F62AD0CE5E53B917989C28609F27378A7171192DF11F0827A1F27EE9BC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 17e5443d957b792a6684f4df856b111a3777f486340151e110b5583e5d0a65b5
MD5 9b11aa43bf4fb78621acb996ae91e6ee
SHA1 4ae3300ca42726e6e393be8169fe353046665957
SHA512 01c2ab6b88675bc95a5d30fa5cb118f3565b0d62847f426db52dc4d2c44e615ca3eae2fcbf51160f9dd7555b91719669ee5976004ff0f3181178cc77c22520a4
SSDEEP 24576:HnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK2:HnXoJJYH84VVS6AmEOJas+cHBjSSKHPG
TLSH
T1B665BF5EA2BC04E8D5BBD17DC5C24506F5B278621331CACF026182BA7F27AF56E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a70f08a8cf181169fe4f3b080fa750208c219ecc6fe056336dc06ae768505c31
MD5 52807dc83b749e01518d51d6b2682de7
SHA1 337c546f9fba85d3ef87e40cd09bc87cf0671d11
SHA512 e2871747aaf3768a08b24e935783bb04cdca3ee3744005aee62af24e405bc3ca25079778d6608a10285e426f1c7332da29568df6b0ac1b681220596998ff00b7
SSDEEP 24576:Vv7Xbxd9Tuycf8M/TYlSuxrr2PCgxVirnlBUKZ408vTZrX+lgdW:VDLL9TuJ0M/TYj2PNiLlBUKubZrX+ld
TLSH
T12F858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 833d249c8547f2f6d7634d2c01449f22c437df668a0931bf63bb486a3b908cbf
MD5 cd36ac6f7be8cec4a537335c0edc52af
SHA1 b0cae6f4b83bd5d711e5758726032e5e434876ae
SHA512 a587a6056d46c95e2bf957cfa690d040f60a720ae7de754b6a3ec025e842737c169d5c04d80f0b311dab726c6503edd663ec3335b4346db02b5559ec9896f287
SSDEEP 24576:kegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10w7xVirnlBUKZ408vTZrX+lgdW:kngOJOmPOHzDiLlBUKubZrX+ld
TLSH
T1DD55BF2FB7BC15D5E03EC17D89928916F6B1782613255ACF0160827E5F2BEF46E3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 45d1c85c74573a349ac3f87926eddd65f28bd6d604ee0e81f6e9cab795cad8bf
MD5 c11f8f4534b287d1da12ed3251820927
SHA1 0453e861780f85fb7dedec77533343d8c8205752
SHA512 d77163b42ca4103819207a2b1489c2a0686aca7d820ec2f070b33ebc534695f515e719ddf7ff30d78b2eb095442b018da359801294038fe6dbd6dee12c5af60b
SSDEEP 24576:QLJnJiTk3R3waE4JrOpxVirnlBUKZ408vTZrX+lgdW:QLJnJK8R304lsiLlBUKubZrX+ld
TLSH
T11E75E02DD2A810E8E077C2B4815A1B56FF72387D2B2169CB65B4D5313F12FE0A939F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 41dffd715672f7170f29e147a234e781ac91a7eb4bed8097ff537c3fdb1c0b7a
MD5 5b4ba25987bcdcd9198483e98beee270
SHA1 8d217e12fa3d75c6acc10b2a9a452ba5c41fbd0c
SHA512 da3a6c569a010312386cce6ce0e40b7a129568f21e0857fc49338793cd15f85baa51b514452091e881eb737cc50582cdff5428d6556a5710815630b0beec05c6
SSDEEP 49152:V9mqCzDScAZmlvTcFg8Ph6BiLlBUKubZrX+ld:ZoiBSTZL+ld
TLSH
T11D955C05F7EB5298E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 34b3fc444fc3cacdfdbdc87aa7905a49bd376273b5e771692789d734456d6e08
MD5 a041e79ea0e84199f8230c4553c98604
SHA1 73da7a797afe399d6ede75b1280c5711302c049b
SHA512 4d6e75074f6e5d3de32023568b47f6e29540d27e7b4a8336123a16bfeebe47540664f626baebf6de009a01fd97d6595d9731691b6d9ac563202d038e6c705626
SSDEEP 24576:mlYJeXm5jUuELxVirnlBUKZ408vTZrX+lgdW:mlYJeXmRUuETiLlBUKubZrX+ld
TLSH
T17E55124D329D30E5E13E81B994A14904E3B2B4A2675267FF53F0827A4F77DE92D39E80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 2ce0291e525ff04a07c1ce8ccce421cb6fd78361da8945347588abd7cd93db1a
MD5 221acc90749819a31b4104f6e8087094
SHA1 36b75846e343d3e846c5b2cd3c5ef96a2bec6644
SHA512 0be43a4adfc7fd9fd3bc879d813141109801b5e3a027a0e5c861247b83b40d063e3662214d182e607a4e0273b3c6e5c396c88c249b8a60595dcfea3e3177dc5f
SSDEEP 12288:6mu6ky6xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:67ty6xVirnlBUKZ408vTZrX+lgdW
TLSH
T144551205329514A9F17A0678D5B28150EB7A7C22AF2157EF63E0B72F1E33AE4BC31B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 92f3e16153ce09d04f8c28beccf9b7f44784d44332ba352dcb387d793432a062
MD5 51de44b846224d07f1ae90d27fc1bbbb
SHA1 3694ac9cae6c5d8733f1a80e653e9739460ddde5
SHA512 670ae1d9a80f9c7d1749cd4a564b0209b53dbf1114cfcc89297fe87252eedfddacaa0afcc7ef75077fa1d7088904cba3761778db1ab8a14de11d88601d723b1e
SSDEEP 12288:9P7xqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:h7xVirnlBUKZ408vTZrX+lgdW
TLSH
T18545234D2146146AE03A47F5A0745900F2FF3CB3A96578BB73F172624F778E96832AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 596109d3f6f1e854460ee7cda8eba1d54cfaffa9f3b386812a362062b8a55800
MD5 8f30154ef7fa92e996432e86ee637767
SHA1 96ea0c9852ad4641d592df70dafd72725bb134f6
SHA512 4fe2aaab11b43e8985befbd2e51a5c1d1f559ec9bdc5fcd4c1d4a36666f92bd01660f035734a9d428de035f80dcb7eaf9ccaf9e1df92a58781d931023302cdab
SSDEEP 24576:5C+TyQIu93VAumZr7jm8xVirnlBUKZ408vTZrX+lgdW:5/TfIq+YyiLlBUKubZrX+ld
TLSH
T191558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 ed8d453bd0f79d8f9e767118d4ad4fce7213859ae13d7000ae8d76f76feb8ba5
MD5 6c59b8c170427cf5bbef8733559f14a8
SHA1 47f84c9889965df207680887670300a54e437833
SHA512 3d78de114123744ad874d4a67b944a323895af68bc89ddac64d1bf66894cfe0801b8b40055eab505876b99572c843da417740b2bc401aced8c8ffa97b8dd0d38
SSDEEP 12288:NcyrWOstaa3kcsfxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:oLQikZfxVirnlBUKZ408vTZrX+lgdW
TLSH
T1E865F10F73AA00A6E07B827C88954101F6B37876571267DF52A0C7790FB75E9BD38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5b100fca131d62b93cb8a9359202409df323054f5c57affd25f7484186f61de7
MD5 fbb075b2b0df9dd45af2b5fbe8b5a7f1
SHA1 3f4a07b27f1123a28772c7e8e537de81578845a9
SHA512 97d1af6d7cc9364ae7861074d5af3d61994de0a28c3b169773c09c4ed0ae415d9daca16beae636cc3cca5adb50003d65904d45d27739b5baf9ebaf07454daac3
SSDEEP 49152:xJpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPciLlBUKui:xapC7b4+80GTkpiBSTZL+ld
TLSH
T14AA57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 086a647e51a60b69d482e74cd2b0629a5f5d5a970f35036616520051bb85e944
MD5 3d4ad9b68fbdd4d0b76e068237301f6d
SHA1 e0592b75e2b49ac56b144c97807f8797b22ebace
SHA512 72cc876f5492b9f8adde04d33c6da0bb2de488f868b819bf25b8a3129ac6f1c1f5231b9e7c23046d9eb87a29f2be847be06f056cc63cb273704b751011026a1d
SSDEEP 24576:pSAwJPE1IDAo+4Kt+l4413JUQSxVirnlBUKZ408vTZrX+lgdW:pqPCIo4Kol4vQ0iLlBUKubZrX+ld
TLSH
T1BA55AF1AA7F956E5E17ACBB4D663C601FB727823133163CF5290813E0E169E85E3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 7dbefa12ca2f63f75d365453b46f9a70b8e9251d0d750a1088d70dc06d8461d9
MD5 67eb15cec3f8365b43cc5d1b5d22e5d0
SHA1 6995c3ba981ddf990f395232f89202a522fd995e
SHA512 9f85322cd53f9f652659d42f407b705934d025d7a79b17e5aaf9752242dcdd492c84b7755bcd9e52cb41efdfcb09e9e578d0117d3c322247c2dfe3f9e19fd535
SSDEEP 24576:SyLXPLcw94tixVirnlBUKZ408vTZrX+lgdW:Sy7PoXtEiLlBUKubZrX+ld
TLSH
T12975E12EE66D04F5E07AC27CD2A38906F6723CAE033166CB16E091751F67EF46939B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 42631d0a755ac7acfc89639a070247fd63a2eaba2634b3a6751e23b0c3aa31a0
MD5 3dbdfe031dba9c97a7a9d64637e8c929
SHA1 8a78ed1a3df7d41328312b4d995ab464f48b844e
SHA512 631a66196dc83ed4443cb93e59736643303017d0a6f2bc8513041a58e559e72a02289a3a1d77a1aa52040e540e9c35d3a0c53604a0004533c971b68e1bdc4cd5
SSDEEP 12288:L9lyvj3IkxjbBzPxqTSgZG5GnWMBUKZGYaJ08vTZLfX+PdgdnW:LWv8qjpPxVirnlBUKZ408vTZrX+lgdW
TLSH
T17765124E22D424E9F03A47B4E0718115E1B67CB3677569FF72E0A6760F329D4A83AF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/344-321-0x000000000A530000-0x000000000A538000-memory.dmp

Download

memory/344-280-0x0000000001C40000-0x0000000001C50000-memory.dmp

Download

memory/344-296-0x0000000001EF0000-0x0000000001F00000-memory.dmp

Download

memory/344-476-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/344-262-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/344-475-0x0000000000DE0000-0x0000000000DE9000-memory.dmp

Download

memory/344-268-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/344-271-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1044-209-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1044-35-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1044-36-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1044-27-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1212-246-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1212-470-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1212-238-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/1212-473-0x0000000001350000-0x00000000013BF000-memory.dmp

Download

memory/1212-244-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2260-157-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2260-312-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2260-171-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2260-163-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2456-75-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/2456-81-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/2456-85-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/2456-88-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2500-9-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/2500-460-0x0000000002AE0000-0x0000000002B4F000-memory.dmp

Download

memory/2500-8-0x0000000140000000-0x0000000140232000-memory.dmp

Download

memory/2500-84-0x0000000140000000-0x0000000140232000-memory.dmp

Download

memory/2500-0-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/2708-224-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2708-216-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2708-222-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2708-472-0x0000000000550000-0x00000000005BF000-memory.dmp

Download

memory/2708-463-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3108-430-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3108-183-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3108-186-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3108-471-0x00000000008D0000-0x00000000008D9000-memory.dmp

Download

memory/3108-177-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3164-227-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3164-233-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3164-235-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3164-464-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3368-214-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3368-212-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3368-207-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3368-210-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3368-201-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3532-153-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3532-170-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3532-469-0x00000000006A0000-0x00000000006A9000-memory.dmp

Download

memory/3532-147-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3896-40-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3896-73-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3896-39-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3896-60-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3896-46-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4076-189-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4076-458-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4076-197-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4076-195-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4280-90-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/4280-465-0x0000000000750000-0x00000000007BF000-memory.dmp

Download

memory/4280-96-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/4280-172-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4336-462-0x0000000000560000-0x0000000000569000-memory.dmp

Download

memory/4336-461-0x0000000000D10000-0x0000000000DBE000-memory.dmp

Download

memory/4336-13-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4336-22-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4336-21-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4336-185-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4416-169-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4416-142-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4416-136-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4416-466-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4416-468-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4732-255-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4732-249-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4732-258-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4732-474-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4784-168-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4784-132-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4784-126-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5232-107-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5232-165-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5232-101-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5236-111-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5236-117-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5236-166-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/5396-50-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5396-56-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5396-57-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5396-257-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5896-492-0x000001D7BE2D0000-0x000001D7BE2E0000-memory.dmp

Download

memory/5896-494-0x000001D7BE2D0000-0x000001D7BE2E0000-memory.dmp

Download

memory/5896-489-0x000001D7BE2D0000-0x000001D7BE2E0000-memory.dmp

Download

memory/5896-490-0x000001D7BE2D0000-0x000001D7BE2E0000-memory.dmp

Download

memory/5896-493-0x000001D7BE2D0000-0x000001D7BE2E0000-memory.dmp

Download

memory/5896-488-0x000001D7BE2D0000-0x000001D7BE2E0000-memory.dmp

Download

memory/5896-491-0x000001D7BE2D0000-0x000001D7BE2E0000-memory.dmp

Download

memory/5912-63-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5912-69-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5912-71-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5912-270-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6020-167-0x0000000000400000-0x00000000005D6000-memory.dmp

Download