4449ab6e7141bb29cf3222b6e49eabb8a8febedd2cfcb0a4563af262c78ce948

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 20:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample260504-zs6tmsgx3l
SHA256 4449ab6e7141bb29cf3222b6e49eabb8a8febedd2cfcb0a4563af262c78ce948
MD5 d578db75e557b9aa38c5fbdc43b9a953
SHA1 f3b0bc2d2880fb78c9434e96fb9c8e183444a4d2
SHA512 55ae26bb3a99665aa80fb181d1946dd53452791af50b118d4ab09165932d43020ac993a5a6a5485e1b34bacc198b436d06510a8f407bd8cf9755c300eb9befd6
SSDEEP 24576:TZ5nVhsdDnkGXm9Bhvn/+r1+CnQ/tbw/2Mkjy6Fr7g0oL:TZ5nVQnDXEBh3q5Q/lFTjN4
TLSH
T16885F15CB39459F9E9B7C27DC8928607E6B23C919B71C38F03A5161A1E33290DE3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4384	alg.exe
5936	DiagnosticsHub.StandardCollector.Service.exe
4484	fxssvc.exe
2632	elevation_service.exe
2116	elevation_service.exe
5920	maintenanceservice.exe
5272	msdtc.exe
5172	OSE.EXE
1796	PerceptionSimulationService.exe
3252	perfhost.exe
3376	locator.exe
5796	SensorDataService.exe
1900	snmptrap.exe
4516	spectrum.exe
1336	ssh-agent.exe
2720	TieringEngineService.exe
3664	AgentService.exe
5392	vds.exe
6116	vssvc.exe
4252	wbengine.exe
4216	WmiApSrv.exe
4280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\89d6a870da180f68.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_172312\javaws.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_172312\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_172312\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d90c40609dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1295a0509dcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b35c9f0509dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009579a60509dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047d4e60509dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3980a0609dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002dbe110609dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5936	DiagnosticsHub.StandardCollector.Service.exe
5936	DiagnosticsHub.StandardCollector.Service.exe
5936	DiagnosticsHub.StandardCollector.Service.exe
5936	DiagnosticsHub.StandardCollector.Service.exe
5936	DiagnosticsHub.StandardCollector.Service.exe
5936	DiagnosticsHub.StandardCollector.Service.exe
5936	DiagnosticsHub.StandardCollector.Service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2584	2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4484	fxssvc.exe
Token: SeRestorePrivilege	2720	TieringEngineService.exe
Token: SeManageVolumePrivilege	2720	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3664	AgentService.exe
Token: SeBackupPrivilege	6116	vssvc.exe
Token: SeRestorePrivilege	6116	vssvc.exe
Token: SeAuditPrivilege	6116	vssvc.exe
Token: SeBackupPrivilege	4252	wbengine.exe
Token: SeRestorePrivilege	4252	wbengine.exe
Token: SeSecurityPrivilege	4252	wbengine.exe
Token: 33	4280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeDebugPrivilege	5936	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	2632	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 1184	4280	SearchIndexer.exe	104
PID 4280 wrote to memory of 5012	4280	SearchIndexer.exe	105
PID 4280 wrote to memory of 3876	4280	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_d578db75e557b9aa38c5fbdc43b9a953_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4384

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4964

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2116

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5920

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5272

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5172

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1796

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3252

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5796

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1900

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4516

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1668

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3664

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5392

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6116

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1184
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2820 2780 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5012
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2788 2808 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 19d15bfc46221fbd0321beaaef15b279e8220724efc2d45c191e2030e597d4b4
MD5 caa0d154b2129957601e2b9bf5ce0292
SHA1 ad12c2fcd7d26928961b2f9b6b88a16087a1c0d4
SHA512 66a984f02bd4381b2285e0bfe8b3599ce71c455ab57cd8977968cee916981fa230b8662546cb0bac6f0dc4b46d05645b0292cd849a17e7a4f4c53bb16479e6a0
SSDEEP 49152:wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxniQ/lFTjN4:a3q6HjBGLm
TLSH
T140D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9c1010ab7232db454051cc90c3d984327006df3be0f5c15ee4a206e68ca5877b
MD5 c8c765b06406ae38d5eed490592d04b4
SHA1 8eb62b83d193c09e8d087ed8c853ff741d8166f8
SHA512 9ccac8a8902f36c3f91dc327b7006ee57e87d4dd9e1aced29e0c7dc2541b97c1cf4f16a2e212b38d2451de018ccafdb436ac625f700c643ea259dca4dba462fa
SSDEEP 12288:E1XLsswWkxy2lRq2czANGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:CXYfDtczAtnQ/tbw/2Mkjy6Fr7g0os
TLSH
T13365F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 af154c3bdb8a82d6b9e2f0b6716c8c9dabcda5f526e11c85a3389cb01d44987a
MD5 6bbef2b088f50e59c6a4f27f43fd8b1f
SHA1 4b75a1f14884061a30ce4455514aff2e8a1bb597
SHA512 64ad3f08afe8f03ee9d0f1474bcf03744809b011b22b5bff7351c274b91c0e953ccb48af5f2a6c64fb63517c10e1d4207324f4fbf433b72540a3fc5e567730f5
SSDEEP 24576:V0Le5ji0hmxLrM6nQ/tbw/2Mkjy6Fr7g0os:VPji0AlLQ/lFTjN4
TLSH
T130859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0aa0c3810d727d00c19444831fa2467015a6aea4cf605d39a102bc1c297c4a75
MD5 4e0723aa6c1fe76f9fe3c4e0bc07141d
SHA1 3f113ff4a5dfcfbc3abd98c32254e835623c2a0c
SHA512 8fb687ed31fbda6a13ea560a6322bf4aa9970cc292286e77cba2aac4d08ef8009b3fb5e49aedfd519d28a72fd1e9ea93332fa50761a0b72696488a3573d899e6
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyusnQ/tbw/2Mkjy6Fr7g0oP:G/ezSC6vUzPvxHjyXQ/lFTjN4
TLSH
T186755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 90c5fd15e012592b4e54d93e0bb917bf911ca2a0713b53d2a73b64e8d9d95d5d
MD5 12564b9c895eb80bdb42be45d28e5bc2
SHA1 3349be520e331c6f56409da5787503d66e2427b4
SHA512 13ca57358bb8a394f9a47cf7f1d76ddac09d80abf788621e08343f3d35e660bf02c71dfd09b45ce89c7c73f057c7238db8abbd5322142e8d6708d6aba4765bec
SSDEEP 24576:qVbqPb88hv/l+6RnQ/tbw/2Mkjy6Fr7g0og:qVO88hXl+mQ/lFTjN4
TLSH
T135559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a4a43eeaba1687c283a5c8a1c325a2f5aff1af1c3c977fa2fb2fae9e8a4ef5c2
MD5 1864b6bac3ea92d24147f1143e34a9a6
SHA1 ef8d1fd2cf75a1a1947b5d8ed8a75a81b2e353cb
SHA512 19ac21f17aab7ae653f1d39e5ccc0da3ab0a14cc64adfff0ecd2a402b2a81c67451139ea2d70d123d11472260476b9e18331376fb9872791e4f788604c472b53
SSDEEP 12288:JzOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:JzOnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1735523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a60467187d86660d14ef8468a86dab144dad4ad32e9e80e3b27eb65d436cec40
MD5 3ba2b8b3053f7f9b290ed6d038a14014
SHA1 e412ab1f9cfd0c485bd288b267a64f161ea6879a
SHA512 c3e867e42902735df1a07673ebde3d73282d56e7fbf7a7e7373875915304bf21234ac09da1898882eb6221ec7a5f18db88bf4b9f3120fc6411c746f5ecda5bf8
SSDEEP 12288:1eBNUbTVO86UZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:1JIUpnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1EC75CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 91c3913eefae94152e76408a3d6136f22c18bd388252e75ad12161485688ed8c
MD5 b839140da202a2c37303376b7b33c529
SHA1 2298fa71a7297861b8455934e4e5b0713db4484e
SHA512 656616dce45297bc3fb86f991ae37772d22ea0f09d6fcf9d52e95a165a47693a333e322d6ad4eb48fa5dd68f01292cc2b137d7291e06bbf73aea77f74aa60b1f
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:uQvGAdlCEL8c/yRNw5C/Lm
TLSH
T104267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3a2df1ee8a258710c18e796bebb774f5a7ef50f8223f606bc74905d6674de2af
MD5 a988be59422e5276fac2ec035d9ad4bc
SHA1 51a56733ba3e0d0291f9068479d570ef6192e399
SHA512 935ae01c24345e68daa58c4deb2a85da531aafdcbacfd2e52c655fd22d74f74643ce638a5e1ece646355ab1a0297223d749bf92c441ce9b55046d2b236630bfa
SSDEEP 12288:vAwSfxL/2Dc39DLLmt0LDQewsAjLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgk:4QewsAj7nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T18A75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6748724c69eb0aa96ae1b508d6d61068a179053cd0041bb875a32a5b11b72953
MD5 26b272f1cf962c594aeb68d495719c0c
SHA1 3f430b441d679b9179f06f6a14f403e74bee316d
SHA512 d887fdb3dfbecac58f78624c42aef77682dbd4ff9620b391e62bedfb569892b52afe435efad829b231d1193186479d76424fc05a13a49f34a28bb7c805be49c4
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHIL:cUEtQevvqc2W1cpV2EI32
TLSH
T1A0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 176ef6a5e5b3a4e5edaab4785ef292f3f2325a340b7cd0cb0821b4e1a2c4b8c2
MD5 1b96361f6ed6cc5410039d377934e159
SHA1 0ed9df7a587cc8a07d379ed6d833099386cb6411
SHA512 3d40557493fe0411b9f035711d6d18c2d92aa755a7334f83f27b3fc1c64013a61748d7a19ed3192b3f03b01651f33dfcaa74b6500e362c36c38acb9cd292a61e
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/zbQ/lFTjN4:OoqtVjnmbLm
TLSH
T1F9D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2264b0ae10d1a133031bd350c8d5a57ee4ade02af35248defcdae9f26184aa41
MD5 7e92e8e451a1b13a43379fe55fd81be5
SHA1 ed65162f97033d396dfb2316cd1b251a9af352b8
SHA512 6dae189caac8adea9a0c7e1817c3cd5207529a5b5c853e5988de4eea9b8ede00224c0682bc13a1b26948609f972e90741e0b3c7dfa59c889c0eccdfd9c272253
SSDEEP 24576:9AhGLJIFoiwtA5l7S53YnQ/tbw/2Mkjy6Fr7g0ot:9AMyFoiq5oQ/lFTjN4
TLSH
T12335AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 61becfe7afcb0627753e16b7f218a6be2db2e9fd5277278a55565d235cfd4c9b
MD5 3597d1d857458e7d65d0e7662c9e92a9
SHA1 86bfc28d2aac394dfaa50d3078db8804dec46207
SHA512 218a26d08b32cb71d2d0c49c1a1d0b5fc6c80d65eda7a1ee4aaf31c340cd5b6f26e3aaf734bc9006c60a0c4093ee7e1638ad7d3714071082e8e2be5851398968
SSDEEP 12288:ymw5HEjsChN2BFgl0WDm+CMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMw:rwuHOW3nQ/tbw/2Mkjy6Fr7g0op
TLSH
T15E65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5e63580892c4989cec5aab30f2fa3a11c61268e69cb4af49dc8ff30e70dfe146
MD5 d58fa23cba63eb1d9068b31fd75934da
SHA1 f57afb020b8cd87c921a27d4405734c95fa3d96f
SHA512 ef7f0080c6587e838281234e6313a7656d7ee48666908fb75188ecd2c2d4af805b830725beeea6afe971de46ef9e1eacd49dc995219b8c25f290f202eefa63aa
SSDEEP 12288:BXZ1Iy7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:JZuSnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T10E55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0ee09e6f49b57722d1ba062f1a5021ef7f63815a4d35074ef4e696bc4aa28f02
MD5 724b334651d59b02122a0caef719200e
SHA1 ae6f8be2e23bc51fedda803d93ed41059ba48283
SHA512 ef7c38108f2908346f744f74403fc594d8f85d01af6176f5e308e01979742bebc58e251dfa686973a6147a5e040baf4ecc2e2324ad329df37dc488ec643cc573
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U9:oQRQyi36YOcPQLvw2gAf+PN3KLm
TLSH
T1FF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6c3afd945ee29c3bff72c7f77478a8f3bbcdca079c2ed75948fa77f84f662f85
MD5 0870165ac993540eb530c17f002bf2c3
SHA1 2dff45c9fed5268cce6edf37686972cb68234786
SHA512 28ee81f8e5654422dfa654c4e5abb5cc7a6238f4fa7d3e1a60e2a2cc2da33a627eff7141283b8caa4b683b705b42018bdf7a6b19d9314dc9ac23f827cb453487
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U9:9QRQyi36YOcPQLvw2gAf+PN3KLm
TLSH
T180667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7f3bd7af1f2674c39d14c0cb846bb4e2b99f78c17d873c660ba33b655bb7a2c6
MD5 42266f0742d2a14e5cefb5336d7fba13
SHA1 625b41287a92cbfd111a61b37edc60600bde4986
SHA512 d1ccc98d9ec351d21e9f67de4dfbaa302637bfdea2a9119d063619a10bf29d329f9e785f9ce92ab7394e9e096e6665067fa8ec633d00a4230fdcb422823e2d57
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0inQ/tbw/2Mkjy6C:668Qg55nhheWu7PNU3/LQ/lFTjN4
TLSH
T1CBB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 41c608b8c4ce342e8d5f9d9846c21711452898d8aa772d4172bcbd38770e39eb
MD5 d0b315591b906e7e1e5e0f40858f529d
SHA1 aaac8a9299d91537b32d639c78669b6e8108b5cd
SHA512 704ccb3afc8be2e8244e155cb0956b02a048ee83576ccc6b3d023c0f51de3bcaed8e2c3bfa5ebaf053b8973def5b50756dcb8cdea8455f7ddbf6f0dfcb125c2a
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99T:vy5112gYy5azzVvL69nLKnhZpLm
TLSH
T154167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c373b995bd541a2fb14213cf5de9316ad9ae50095a99c26880b93e04f126ba30
MD5 f1c96423c27f717ff6eae988a349489c
SHA1 58e67c4dc9baff6b42d12e9a81b02a97304328eb
SHA512 d01e0ab771c1a20b45e0c144785f8b0a8da536b159cf4225a8a264b416fc3684320f844e7e2e09e9910da19a13000a001647575aebf6984352ce983ff34274f3
SSDEEP 49152:tB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl9Q/lFTjN4:zu6JmVxd2dyLm
TLSH
T16ED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 652e325030671a6f464fb85989827ac1101c2759e03d2fb677227e96ef460b78
MD5 010e7e2a50dce293ce049f47d5539383
SHA1 ff05adc11e63916f1733e745416969cf5090f15f
SHA512 7e79cf4740b0b490b0e0a9fb37ddc0cac809ec6c2a3bc8c2a1abd39cf57363e76ede26a8b6b431abc4aa2d649b41358a7d419afa3566d714ec60be9063d84a47
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xJQ/lFTjN4:QmifPbRbLm
TLSH
T1E8B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d723dc9c5cd3cb5f3f01a5240dafad20309d770e477a9d72b579538a56cef8c7
MD5 772aaf6e5c998979e972825461890168
SHA1 2dd8b420e3af4c6cd28ceb2054078b5eda2a4e8f
SHA512 00f0c427bf19869ef1da8445942c580ddffd90e96c2aa14962806400e66f81d33c3c8cfcefc77f9dfb404335bc040a790052c255ea1cc4f9de63605a24bea970
SSDEEP 49152:gSuZQIY0Be2KRRVtOnks6NMHqSQ/lFTjN4:65dKTi61dLm
TLSH
T15BC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 924494a02bbe8b3ae09796753044ffa28336e7daf09d87c3c4aedeed0e434f51
MD5 300b2e018410c4eb5519b719b0c6caaa
SHA1 79f30e253457b26249ca0d30535791e1d2150ae2
SHA512 3b0db2dac65b86940e6bf99ab0c47e432c7d4485e29ea75c70ba6d876f7199b009d9582ff958b5d12fa44bb8f4a31858f1a1ab4bec18f0678196b3f58084907c
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5wtQ/lFTjN4:zX2iyph3Lm
TLSH
T12C95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 eba43c1f79335cbc18829de309924ab5b3a55ea3ff1bb4529898216a73a13160
MD5 c8624ad9a568803f039f77cf53a72e7f
SHA1 33b660f2f3c0d47000960c2c04a5331f738a7238
SHA512 7a013e19d0f9353e20c4a6f20177c4a27321ea863811a9b889f31d5746a70f4235b0cfab5b3830cd77abba57e19043afd46bbf2301708dc809ab3a15588747ac
SSDEEP 12288:3GGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:3mnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1505523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e19544c308e716baec91eaa4706f9feb1165c4a9ee170bab08ba788b37ca6161
MD5 1540f2d4c884d3b74423d4ac32e5a5c7
SHA1 76ce8e2c54ec29ee87de2d96f989ba80e3451f2f
SHA512 414ee01e57bb66e78b869f7da6365d513a7810dabf927f3ab927fdb746be4ec7b9e60fc865666b2aa04f59e62698f97c53f53d3aa1e31ca6ab71a26febfa1a89
SSDEEP 12288:7/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:7fnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1425523697965F98BFB1706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ed586c457470687fec108d5de95855b9a3a510ca5eb7a8534341ec58d6f26abf
MD5 323a30288b4c69e02961ef5de518d031
SHA1 2b90d62f449f4ee58ab8dd251000318458bb3914
SHA512 fb44ad2d32075b0e07ef32a1a2676d8f204669e2c2cae7ad05a6e43a30578a4f87b5718dca20a22fd88da5b709a57e7a3940edfee2e993057dff9c73ce8a6131
SSDEEP 12288:KRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:KhnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1665523697965F98BFA1706F14C8381829B7F0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 70140af705e21b735c99270e822ef88576b7a5d3cf0ed5fd01a7a875f7ed000b
MD5 87333594829d8e6e52fe2a25f30b89db
SHA1 b484b011f75581e43a2e8c26f3c7218557ed7ca2
SHA512 e82667fe50e6e120dc340b2cf4be54ebb87cd734ee7a59801a23104adc2654a0427633564a2f48b66de1e58f15a412a00618273549d94128860475e49b669f39
SSDEEP 12288:HV4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:WnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1C65523693A69F4C7F92742B4CC938142E77B3DC6BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c29badf0a74a631b31c239051afdbd72377bb972ba06402612b40667e3e98cf1
MD5 9a905fc5b0f4a6f87fe65d6aee943f33
SHA1 887e886efbc0a788d8d247eb7b73315df4c3ca7b
SHA512 c315db276274d648351b42f43daa1ac9c5daa3e8ef317d8e7b454385aa6f81121aee4badd323cc0f97b971609d9c468e858045d3dc307d3ab7229d23a408ced2
SSDEEP 12288:QAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:QgnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1235523697965F98BFA1706F14C838182AB3F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 51a849190f73374fb1b9d1ff2c6b2c5f061169c569ca66e457dbc936c437565b
MD5 d4fdb6ca1071f5ead2a4ffc6627581ad
SHA1 57916130645dce13d00a5fcc79617e2ae9c4ef8e
SHA512 f6e2bd44f9e842ceb40371d06bad9fe8a08e9ac8be8e2f59cac2908f2182aa0fe924dcb3d0df0f4f3524bfc2bd8e07a2882c2e29bfeeb9c79bdba66a234d49ad
SSDEEP 12288:XjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:XTnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1435523697964F98BFB1706F14C828182A73F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3401f8246dc3997f527650654f40281f7ad97606a1cd4b053fae12c6aa388359
MD5 f2ff3fe0b9499e1302ec837ab7170ad3
SHA1 9263c55f738749bd522f72eface33afdbb94bcde
SHA512 3c8fb8e1c170d6c108155f0c7115bb38e0b6fa50ece68478f6abfceb8122a2544687d226a220b8d6f23fd4ad9626f5490bea5841f60c9499b7d3cd935377c49a
SSDEEP 12288:JnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:JHnQ/tbw/2Mkjy6Fr7g0op
TLSH
T17F5523697964F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 636acbd6ae2a0b8069f1b08413f93b639a784681f4f7f61587fe53223c5acbf1
MD5 e92feed2c2296630483b6dc3c7164bc7
SHA1 33690481ffc678ecf5c516858cb29665b61d3629
SHA512 9d48beddb51c80c7f5808a3e003f99880d558ff47ed40ffe0110a96cf8ff4fc8eaea804cec3ec4d38414db7d1fd828671ba26572377cfd36607896553e15baa6
SSDEEP 12288:5iZwbDzzFEoS2cPvyfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:8ZM3zFVSO/nQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1677501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 79c312cb2a77b0fd7a77c839bd288d87eccaa6e0bdf925d71ccf986ee629b4e9
MD5 b91d3e7cd30f44f2f302b64df64996d3
SHA1 fbc05319e8451a855f92ca1e7c78697dcd43121c
SHA512 e1a7deff4686153e60a4a62d7639db331de08793cf2e069109c6a6a863d1dd36ae1ca8557f99acb83ea5843d09f5107ca4b7e721606059367346c07ac5681be8
SSDEEP 12288:sCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:sCnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1835523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d4934765c0a770cc0e862e0976217c2e3bfcb3a0610c15d422cd15600ced4ce1
MD5 776263c3bd4f6b2f0c4c8f5b879807a1
SHA1 4c8aa28592b0be4718a2623b6885d2b240778753
SHA512 399bfd30fda1d7db69a1f2e1c27debe2e78a6d4e63feb09f06bbaf0ac3497272bee2ecf8d4f8de8a80faaa917fcb53a2b204ca1d6cfe9ca6066be4576a5dfcc0
SSDEEP 12288:J+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:J+nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1055523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f342f4bbd07efafb208be3b1b405059d892e67cd0cfcb1a74e97c6a486b0af92
MD5 2c8a3b050422e30f0885da29be0f155a
SHA1 3c9eb4892ae893093add1067ac1d92ca36021870
SHA512 833f2486a6003bfd70ee08a094115cafb1450815741126ee8f3575c64bab5f4b52bd62454f5e85ec44f24f9f1d23f9d6c9c2a65c9cffdcd83f0545391cc37c2b
SSDEEP 12288:XyPz5L87GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:azyrnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1DB65021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e09678f51785bad500722f107fe0fd73a7dee5bf1682c4cbf738fba7819e504e
MD5 cb88fdb3f50d4eaf3c2eb452d4a7f96e
SHA1 c8c57bdb95b5e22a8a408c00bc801b7f7d2b07c8
SHA512 3f4b1e88b3077fc890bfcd5965e5e26cdc7af2a449861d1926f3d4a43d93fdfee4175e8e96959689786b42790d3aa18d398604a441f8a6fe3f4111f947a86b80
SSDEEP 12288:mCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:mCnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1265523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 edae926a3d58e0ebac9c94258313a78750b24545af4a7ea7e113fc735d68c1f6
MD5 85962cb07fb640bf6d527ba6e7f1e15f
SHA1 ec4e9c12ff440591746ae92dc954c493a852f802
SHA512 bf478ec305293d9d8960a78404e611c50cde34b52b8204b0ccff0e2dec941e28af4ec2aeac52a9636e044838aa0b3d4b3e071d91031ad40c3efe75047b1ffa56
SSDEEP 12288:JCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:JCnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1165523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 fc7a8a7162b3f01427f60b8e332a909c95572324cfa23c24029af1ac7a82aeb3
MD5 afe1c54873ee59a8bd225386dcad06f6
SHA1 56afc8f6d5b6ce6d1f9644ab32bf397e49c98441
SHA512 449db831758e2a4f5b9f8e2c2db60ccf39054aa17660ec8127d13f95bc370175393ec69137ee4ea3c31d7a272ae3090116b50bafb26c2dbf38b716c6c851b6f2
SSDEEP 24576:UCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA1nQ/tbw/2Mkjy6Fr7g0oY:UCUxPTY+8Wg2lIL8lrIUJLWwgQ/lFTjG
TLSH
T1ED65BE1EA3EC0896D4BB817589518A06FB72782E1B32D6CF2160C33D6F27AD55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 926bfd1035e013d164814bf06152889f5614bcc366cb4879842f8746a31bb40f
MD5 543c8f856e556c695ad4ae5869e5c4e9
SHA1 c20ba454d4d827635fdfb5d50715caa5b13bba45
SHA512 d28b4f1cc786218825e8993f788587f7c897f45b681cd0914c5d339336c67a9a888f58e696b10843decfd509e7079a0cfc4c51f2bb168957f3f10954518bbb8a
SSDEEP 12288:xssfSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:ZSnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1BF65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 87e5b50c61e433869de0b3587ab210a6a6008340e187af0e01b5197ca8f0e83d
MD5 9f4b17cb85b4508c7c615d713e6dc97e
SHA1 e5aee9fc505840ca89c97a7454042804e311db74
SHA512 64cdd27475b037517bd624187fa6aaa92520e6d24e5bc8ce2f2430105282a78e8e5079fec2f8f84c08705568078eaf8dd77d251b848cfa5a4d4b8e24b6573117
SSDEEP 12288:SxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:SBnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1E25523696668F94BFA3B06B048938111673F0EC5BF91D3CFBB082269953C3D41EB6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4302c0ca554ab645b08ecdec41557fc94c4571cce8bd5fc497ce881b02b9269a
MD5 ff435d99e5f67c8d49eecba494daf863
SHA1 35a359b32bdde1cd699fa97e672fa11868bf4449
SHA512 32e98a42535f5030bb6a51281f876c9908f754c52e27c17ab1bff4ec4b3909b602d7f6f56abb147c03e6c3ed211b7106033d1465d8f98d9fd53c5f66737e6bf7
SSDEEP 24576:y8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCbnQ/tbw/2Mkjy6Fr7g0oN:zRZwQCyiHiQEaaPnMaQ/lFTjN4
TLSH
T1A385BF1E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 2c1e2c7b95c2ab3fc966c00888d5b0c2eb92d45b320ab7878e44cb2bd11fa371
MD5 bd0eed62705dea0891588666f24f7984
SHA1 53e6aecd7b49f8f86b072c3bb6027570e790b045
SHA512 673388d87125db89a9071fcbac55fa23247fbe4d2a4bcdcedd757475ed01ec2a769afa3a978250840c030c6e443cce3a9bb4f7e3d81726d36395a0d4b70c1d3a
SSDEEP 12288:+bxA1U7KhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:+bxA1UGxnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T11055123E26AC24E6F636927D88D28106D3327C56676193DF2584823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 df76bdcff28ebb02d3b320771acd5006569293fab843e5adb0a531aa4ac7aefe
MD5 320d41a0b39161d8e79424af34f31ef4
SHA1 6813d0e869b73d81968243a8fe137c3e90bb96a3
SHA512 ef97bfe5c164aa0d37b57fa676475c83ec4fb3b52034536bcfaa359c696a329695af84d22ba4683a51b910bd6a0fb8bb0b7c64fd973522ca87d286f30652c3ee
SSDEEP 24576:VjsmP0yHaqrVqHra44KDzMsrnonQ/tbw/2Mkjy6Fr7g0ou:VjRP0yHfVqzlAsrnoQ/lFTjN4
TLSH
T1AD45AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 d232d42192030edb728b0ac750ccbc554adfabc870e0a4a855a436d8886e2bf0
MD5 a0233c20d53de27b2e17c11674b095e3
SHA1 46aa4828c7dfbf22e730ad6bea8c0274b87d9d17
SHA512 6d9193b0b61a442ffc75d21cc02a881bec25f4c665cfbc1f734c92523a468c3889dbd1bd81a90ef1a636fff7e4d7a771d0195b28534e42a1de6e464ad1ddfe67
SSDEEP 12288:3DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:3znQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1A355236D7654F98BFA2B06F548828142673B0EC17FD5A3CF7B482129967D3D40AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 5aa13af4170185110b19120f7c4ba37cfa5e6e8b6a4a35cc7af5c059199439a3
MD5 b4249caf26c6774c2337083cde414eed
SHA1 7b22f5c2bf2ee190a27334b41bd9f97e41497c82
SHA512 3751092d7e7d3c920d86545febf2c9bc68ec0b7e78e2c55001641c08a530e553445e42d32be31587d8092c740af5098908b3e0e252da27ae868c7982947a22e8
SSDEEP 12288:pOb4A4LWO+vAYFTNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:ewLBUTtnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T13B75F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e3a9c0d4b30084fccd87a6e59223f82b7a36d4983abd7f8d55e93e57d3e84134
MD5 06b7636d108e3d7b080fbc8b9d8f52f7
SHA1 6f8fafca9c6a52a448af29c673833f069f161f63
SHA512 27876e74238711a327a9b87e11d15766fd0b0fcf025cb50134fd9403a0eee9d99109bdc691d4c9c881a9d42ef3e40c2e874a931158440739d47e0f92d41dabcf
SSDEEP 12288:E70VmuIYNvUyBpWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:xKYNH0nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T17165F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 988d7ad410b971bef9e8be4e3f2085be5679f2b41aa378a40ce3b0a97b2862b5
MD5 aff87e1eea3b90e4899261740ed687e7
SHA1 bdfe78d11d85680612a19bb920535025cc9882a6
SHA512 c7cd6b7fcf354939159925e7818e5fa84f04e681b1f85092e417e0cde58d06f563c3434f1b4c82f02bb4da0402b296fdbd3407caad3b68c811b49a06d2a1baf3
SSDEEP 24576:ZnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKW:ZnXoJJYH84VVS6AmEcJas+cHBjSSKHPH
TLSH
T15365BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ed8decaa871fc170b6bb399b727ec2ce1bb933a35464fe256370d4a411f52c15
MD5 e8f18abca9259feeccb56c3fcb39b3ff
SHA1 b0b57c8b0f5159a9132832fbc2a8a16b092ada11
SHA512 30cc5f3b99f192f8ac4eac0819847c8c4e8f3220a45569ddcf421cf89e370fee571940c5d0c7aadf48062432ff9cbcc6ebd9a1c4d1503253410fcd5af856f325
SSDEEP 24576:9v7Xbxd9Tuycf8M/TYlSuxwr2PCunQ/tbw/2Mkjy6Fr7g0oc:9DLL9TuJ0M/TYW2PTQ/lFTjN4
TLSH
T1C3858D5EA2EC52D8E47BD6BD85B39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 9748a60d6451ea0cc488c01bd7c8246e8518a7025fd3b2abb1f4e25e1161d524
MD5 9e880f76ff872a4bf11ea00a68518488
SHA1 55067c9873d558f5d10673a8ef8281fa11d4fcce
SHA512 bcfbcee1cb751436ac8738483955977a93a086ae360bb39b9f5d8ec29669936a00cb3a5edd47b1f3e9e6bcf5160c84721cbe37860404f57ac6ae9e7919be0948
SSDEEP 24576:hegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wtnQ/tbw/2Mkjy6Fr7g0oK:hngOJOmPOHhtQ/lFTjN4
TLSH
T18C55BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 14ce19fea47bd1e238d01f7876e0cc619bd95576406b07a73dd9d07088c1fc8b
MD5 09343205c5993af12a96691ded1318b7
SHA1 aef6ac49fd559740b13ae7844f13039b16a5752f
SHA512 88352dc5a5226cf8c9f209cd51eb00cbd42bb52628f12830a08d3ae8eed94bed82c86022fe73a5a0f8c317f93af64719b012c6f7c1f5ffa1b23eb0992fd83d18
SSDEEP 24576:WLJnJiTk3R3waE4JrOTnQ/tbw/2Mkjy6Fr7g0os:WLJnJK8R304l4Q/lFTjN4
TLSH
T19175D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FE06A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ddf5a7efe216e76dda3d4f564cb27aa26d65116ed2b61255156fada9ad156498
MD5 f1b085693a542a675fa9bb6687f461ed
SHA1 48c5130d915cabe8ae8446d89cb99089ce9f88ad
SHA512 ebded7f802382a0840561e2a7e03d79b83843898a2209c9809d89f0512ffc3cd831173aeedffa00151b229cd38e70be5c979571297bf784abbb066682c1566df
SSDEEP 24576:xA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6plnQ/tbw/2Mkjy6Fr7g0ov:29GqCzDScAZmlvTcFg8Ph6HQ/lFTjN4
TLSH
T15B955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 1349080afe308073915c771b5e6bba7080ea96bb0772e1cc9e7c08ef85d0246e
MD5 bb0196a4cc20e8e49d3b13a853e82f22
SHA1 2b5c6b247a9cdcaaee5ab60f6b88c8ca57065111
SHA512 234e3513fd424d6287715fe4df502dae5e9baf1718e9c6755460fedaa1f43b4df370dc7658c59e2a6cefbf083567064124f73281b2ee03118844ee32610eddc9
SSDEEP 24576:NlYJeXm5jUuEdnQ/tbw/2Mkjy6Fr7g0ov:NlYJeXmRUuEdQ/lFTjN4
TLSH
T1AC55126D36ACB0E6E22F41B988928545E372B4A1274163EF52D0C17D8F7B7E51E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 b5de678e1d5409999faf7a52da6f9d92e09439dccc331d8cd1d50dfefc1ba968
MD5 a2584444d93963bcb1e6da857e9ce4ab
SHA1 661fae46571936d3c4a9ad4f2f4765930e25562b
SHA512 5b30562a307b76f7ec1f8fd2489d612be2f70520cc55b22305c80ff8bd88b659405705f5d656d8bb6f4a960cad1744303c0af369032e5b422ce09d7fda3c9894
SSDEEP 12288:iFu6kyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:iUtyInQ/tbw/2Mkjy6Fr7g0of
TLSH
T12065121833A4B4D9FA7A0678CDA381819F3A7C50AF5093DF66C0E23E5E3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 7d378baac3597d82e80c0a4e68502a45db466ff303b4c06d884d86c54b6196db
MD5 a37fb39f492c349e0b4f63d0a065b111
SHA1 840541adf8b02c1472e81359fe1f5f223bd1af35
SHA512 0a4e4dfe0e5ca949477fa698c765e7f45e45988ec0ec9340cdfb5e9a23172682fd66f40045a4ef29a76fdbabcb27d2fb8f32eb1aad339642cff44f61e5b337c0
SSDEEP 12288:yPNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:+tnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1CC55236C2624F49BFE2706F448528542A73B1ED17F91A3EF3684A139CB7D3D016B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 959c7c876e9a1732a438888f0e4b7c6da565c73e9c0292fb2c6c0ecd0b024caa
MD5 00ccb6904a381a599104251ba0b46e08
SHA1 42197296dcf7842ecf404379e5747fe95345e47d
SHA512 fb699ad12a31b46e3a5621672b836e6cc4158d019a4384ef280bf14e785f900b42b8adb8ce604d9ceb180f1fe63ff066ae4d4556bb60760bd0470a22e56ff4cd
SSDEEP 24576:pC+TyQIu93VAumZr7jmynQ/tbw/2Mkjy6Fr7g0oR:p/TfIq+YyQ/lFTjN4
TLSH
T127558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 e4612062923277ab83cbbc965e8fb26f6555e32e430438e1db27304748f82d06
MD5 832e90507da89077d7a3d14be902f9f3
SHA1 32c704ae5b7912f02558a6c59670fdfc9bbec047
SHA512 29397a65e560663a9f11df72da7b87c2a1de604ea8f5debe152b9aea55adacc94eec271beb6a2e4b993f3be0209bb1caa0bb9796cc127b99a39fcbb55df6a566
SSDEEP 12288:mcyrWOstaa3kcspGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:/LQikZ5nQ/tbw/2Mkjy6Fr7g0o0
TLSH
T16365F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8da7ed9995bc6fa2b27256eb638ab6d59731157e9d42a0e255b3f319f523a6de
MD5 c4576119ad8fd95fb7ea99051c2ab2b2
SHA1 8df120acaaeae240fbbb08bb80fd3212002f6ef3
SHA512 71f084dac289667b381ed0dc0bf295858505390aba84a70484d741791a518ac3a8d850b830832a368871a0b8bddea8f5adb1235dc9341a432e6c36f9c5050d8c
SSDEEP 49152:epJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPIQ/lFTjN4:LpC7b4+80GTkELm
TLSH
T11FA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 59d7aee09e81b3723dd4e6e83ca36ab54405d6b616efc3659fcb0ebd8cd29bca
MD5 04a4f0d90e25f52049a54f9c26296182
SHA1 3be9cfa6c18c4b38e890c9bd36c462b800362c5e
SHA512 0512af6e575818b715751b71c947c326176aa48efe831d71646667e9153f249e3ba530002c1061d5cd9f4bc0eadd6188223597977eb92db45d8c1c8c6b08c484
SSDEEP 24576:LSAwJPE1IDAo+4Kt+l44135UQAnQ/tbw/2Mkjy6Fr7g0op:LqPCIo4Kol4/QAQ/lFTjN4
TLSH
T14F55B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 6a3e9f13f1ab1629f3e54ddd33388840f5bdc633274a70cd53dc5d79a0b07c6e
MD5 70fc9547f0acc4d8c71cf906cf4915a9
SHA1 b7421812f2e90ef319bb1ceb9387a97c0b8a3dd2
SHA512 1a68dcf089d398368908ab2bf267696636f9b504f518b7bec1337c7ee908e61bab3ea6be716d6d604688619144238b8b771202a6a86df9c3e07cf779ca7b1fa4
SSDEEP 24576:EyLXPLcf94twnQ/tbw/2Mkjy6Fr7g0oa:Ey7PoetwQ/lFTjN4
TLSH
T12875E03EE66C08E5E53AC27CC6A38506F672389D037166CB1A9491791F7BFF46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 215cf0a04d2bab85434ba1b74ac093c1850a479c9fa23cd185eb8ec8432d02ea
MD5 4893033c6f4ffd30363379d510dd0160
SHA1 98b2456c091b9a80e0d39730dede85aea4cf13ad
SHA512 80659cad0c12dd1fb8369befe9aead222cceceb6b89dfb6c57e0f0b54df5a3c32d7372ed0b407e9a2418481db0890811ab2e26546dcb1403fad370f72cc6fa53
SSDEEP 12288:79lyvj3IkxjbBz5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:7Wv8qjpJnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1BE65125E26A4B4D9F53A0274D863811692767CB227A4ABEF72C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-358-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1336-144-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/1336-138-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/1336-136-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1796-93-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1796-87-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1796-162-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1796-100-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1900-121-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1900-227-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/2116-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2116-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2116-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2116-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2584-385-0x0000000140000000-0x00000001401BB000-memory.dmp

Download

memory/2584-1-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/2584-380-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/2584-71-0x0000000140000000-0x00000001401BB000-memory.dmp

Download

memory/2584-7-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/2584-0-0x0000000140000000-0x00000001401BB000-memory.dmp

Download

memory/2632-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2632-33-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2632-39-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2632-120-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2720-373-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/2720-149-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/3252-102-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/3252-166-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3252-107-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/3252-111-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3376-114-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3664-151-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3664-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4216-172-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/4216-378-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/4252-167-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4252-377-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4280-209-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4280-183-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4280-174-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4280-379-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4280-181-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4280-225-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4280-193-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4384-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4384-99-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4484-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4484-53-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4516-132-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4516-309-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4516-131-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5012-425-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-450-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-461-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-462-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-457-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-458-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-460-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-459-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-456-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-455-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-446-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-447-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-451-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-453-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-452-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-454-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-449-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-448-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-445-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-442-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-443-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-424-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-423-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-444-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-428-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-427-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-426-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-430-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-431-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-432-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-434-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-437-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-438-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-436-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-435-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-429-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-433-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-440-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-439-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5012-441-0x0000012CA8250000-0x0000012CA8260000-memory.dmp

Download

memory/5172-76-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5172-157-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5172-77-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5172-83-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5272-73-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/5392-374-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5392-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5796-118-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5796-182-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5796-375-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5920-68-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5920-57-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5920-63-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5920-56-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5920-70-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5936-27-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5936-18-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5936-109-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5936-17-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/6116-163-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/6116-376-0x0000000140000000-0x00000001401F6000-memory.dmp

Download