85aad7fef89d976315e733bde9965b3cc1e0cfa807df5f0c949c3313102f2a14

Analysis

max time kernel
150s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample260505-symvdsa18t
SHA256 85aad7fef89d976315e733bde9965b3cc1e0cfa807df5f0c949c3313102f2a14
MD5 d868aa2e1eead3179f8a354fff112ea1
SHA1 e9d2249c25a0a5271ce1b96a4549c45c7f73b3df
SHA512 f98b5df2ecb3513ab1011c742474845c46c040050757c47d3d8519e6fa09d3207da7c20aa080ac8cce09f6ab2a4ce124cd4c8153ae6478e9ba5430158bc403e2
SSDEEP 49152:Tgh8jK3xEPK3Hkcm4L8A5ilefJJnB58MlSKl2HJpj340FuiK0:TMYTKXkcmgfJiPG
TLSH
T11DE58D6D7AED00D6C175E1B8CC022791E2B2B825473145CB76A46E2D6F3FEE48E7D620
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5372	alg.exe
5468	DiagnosticsHub.StandardCollector.Service.exe
4748	fxssvc.exe
5592	elevation_service.exe
5736	elevation_service.exe
5132	maintenanceservice.exe
5876	msdtc.exe
4164	OSE.EXE
3424	PerceptionSimulationService.exe
2316	perfhost.exe
4216	locator.exe
4084	SensorDataService.exe
1996	snmptrap.exe
1076	spectrum.exe
3792	ssh-agent.exe
3536	TieringEngineService.exe
1500	AgentService.exe
4124	vds.exe
420	vssvc.exe
2352	wbengine.exe
3828	WmiApSrv.exe
2568	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c0d0d8f614bf40d2.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\java.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e47a8a61a4dcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079ac5e62a4dcdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083871962a4dcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bb4a461a4dcdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4748	fxssvc.exe
Token: SeRestorePrivilege	3536	TieringEngineService.exe
Token: SeManageVolumePrivilege	3536	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1500	AgentService.exe
Token: SeBackupPrivilege	420	vssvc.exe
Token: SeRestorePrivilege	420	vssvc.exe
Token: SeAuditPrivilege	420	vssvc.exe
Token: SeBackupPrivilege	2352	wbengine.exe
Token: SeRestorePrivilege	2352	wbengine.exe
Token: SeSecurityPrivilege	2352	wbengine.exe
Token: 33	2568	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2568	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2568	SearchIndexer.exe
Token: SeDebugPrivilege	2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2628	2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5372	alg.exe
Token: SeDebugPrivilege	5372	alg.exe
Token: SeDebugPrivilege	5372	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2796	2568	SearchIndexer.exe	105
PID 2568 wrote to memory of 5840	2568	SearchIndexer.exe	106
PID 2568 wrote to memory of 5820	2568	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_d868aa2e1eead3179f8a354fff112ea1_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5372

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5576

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5736

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5132

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5876

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3424

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2316

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4084

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1996

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4020

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3792

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4124

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:420

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3828

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2796
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2880 2680 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5840
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2884 2692 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f166d2200ef3e6ace79a386b7c7d911948a792537fdb80fc9c6dd6e803a1296a
MD5 89e7442317b4dfb34bd094e9962a9dc6
SHA1 04a4c44e4ae214d39c1dfad8bfe1ab5be4cb9aee
SHA512 6c241cdafe1bb46f44df7187553c5b13b7fb68e0e165497d7b6c9e401c6a3d74f374e715e48c4eb77f465edc0308332a3e57532bd4524211f6beccf2894e55f3
SSDEEP 49152:8b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnz340FuiK0:m3q6sjB8G
TLSH
T1A4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5832fb61fa5ff1a0f883c34239daa5e6f990b8360a3f7e51d697c97cc1c091e9
MD5 f2bd7220ff2e45daafcaaa532c663ee7
SHA1 1974fb455428a83c303ed97123eb810f4f0f3aa1
SHA512 e1e670c186aeeb4753c573fe96fd1cd2b56677de5e4fcef6cce3615b291395040a0e04fc76dcd095efdfea298297be124fe3abfd1def85d754487f5a19be4bce
SSDEEP 12288:+1XLsswWkxy2lRq2czAoEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/Tn:MXYfDtczAoEWJW0N3xpH+EnK0/E
TLSH
T16165F12977E408F9ED67823CC8A28511DA73784547A0E7DB03A4DA395F332D89E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f4a423d497a38789f6d63fdb7dc5988d39d927ee650d029e1efe6fde0bed3447
MD5 c8abf4cc868fb030632e9f06dce537ab
SHA1 376dd073a074182634edb364e1ae58971d709430
SHA512 2d65d0c1182f633b5bf8008d26b97aa454736f1309abddbfc13ea0d55e172fc2b6aff96af77c3a024359385ced54743b3b8db10d8fad2c2eb57b862266ad756d
SSDEEP 24576:50Le5ji0hmxvrMrEWJW0N3xpH+EnK0/E:5Pji0AtC340FuiK0
TLSH
T1D0859E26F6748335D073C0B9C5D2A69EED7130825B308ACB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 303c08f48cabe4520337efd2861b6303ff9a5d56bcbd7ec27a794eb182cb35fd
MD5 a2b583c3d8c5021f3ca9104767fa5d3f
SHA1 1c8f04681a2899e13c11f763f63104dc4a831283
SHA512 aee3189d35c6f45952eacab36369a591751c26c1e91f08f3a3f67be7e87007b716bb75fe870265f792f580c7862e2e62a9d531c73089c58a75627170ed75932c
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWn6q8wyupEWJW0N3xpH+EnK0/E:a/ezSC6vUzPveHjyO340FuiK0
TLSH
T1EC755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e9cf0a3f655c4850b3fe8a4657396463bdff32c14af9e1fd95aa6e59d6f09ce0
MD5 d2d8b4fd9fb784b4166e766048272a2c
SHA1 08879f0163072d3ed8c5fb4e6a194be05d701b37
SHA512 c49b87dbd3c1c285b2f679387a82bc0375ff1fbcfaaed0f9fbc7e3125843f1543c76f3aefc174a3b71b7ed862289f3003887c97637b178f0bafd48032a01e678
SSDEEP 24576:8VbqPb88hv/l+YMEWJW0N3xpH+EnK0/E:8VO88hXl+x340FuiK0
TLSH
T1C0559E66F6748331D073C0BAC4D2AA9AEE7234425B318ACB1246D76C3E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 49d98533b124ad42bc659c4e4b951045d5c09188c630e7d9c4f34b29fe442d1c
MD5 7e91b9ce2a7038cbec940cdd3e2e2ee0
SHA1 c6586fa36ac1cf33d0c7dafce770639afb703b57
SHA512 d3cc8cdedb2cd91d0a7a524c885d55d2263c785a22bb9d876e9eb98a0d74808bc663612ffec6b8a507cb1f57da3af54a7492b8edf3603fdc31e91de4a05921a0
SSDEEP 12288:Ah/EGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56fa:Ah/EWJW0N3xpH+EnK0/Ey
TLSH
T1654523779BDC50C4E77FDA34609CB2A54EDA4E04ADA215E8A32AF67D85F3115CB0B301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 28c7b836aa862b560455adc56b3afd2e4fc819e062a166dfb8143edf4221a86a
MD5 dee041ab5e774bec7f46502d9aef2123
SHA1 94eca0576978bdbc7b02229944d4fb48b48837fb
SHA512 21c8c69e320418a67332778c18cc53c8986e86894a6953d0fe78af73f91f6eece3c95921549330a27ce9532094842e800884cb99d6fd92da95a842d658bf9528
SSDEEP 12288:/eBNUbTVO86UkEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56f:/JIUkEWJW0N3xpH+EnK0/E
TLSH
T18965CF3BEE28FCD2C27A8D7956918240D7B278304F62A3CBD165C20EDE235E55E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 156be3f8b153e7267cd3f5d9d3c696fc3337e1c96fd0f470facb1edfd024362c
MD5 4f13be07bab789fdf7505530a5f859dc
SHA1 f87e79abee2c0e266ac7c8d57d85fb9458dfc8cd
SHA512 a70b46ea899fdf01645a11880cd519430a57be65fb8eb02e9142caa88c70c186a4157970074a0fd354459bc761483959b3c872ec3e7fb6eddea2e2e0eaa1e126
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THs:bQvGAdlCEL8c/DRNw5C5G
TLSH
T177266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ab7974e638032edddf1c196dcb273ddd897df72c4eaa1fe2e28d2c7fb9c018ca
MD5 02c85567f020c6842cef07b60086f325
SHA1 ad342a08af9792b00d26b45670c079ffad1aec0f
SHA512 86be1719a187577c17581ece144243ff079a4a68e85d31d9b7a035ee92d563f795b24b16f77d13fa1ab287f5c8f23eb7f2798c11345ffbe4aca6114de4a6d71b
SSDEEP 12288:cAwSfxL/2Dc33DLLmt0LDQewsAjSEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYp:BuewsAjSEWJW0N3xpH+EnK0/Ex
TLSH
T1B775E031FF74E036C37F0DB61B26D316186D6A204F621AC3E3A89E9D59702D26736A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0fec73b00dbca5e296d22c06be4a0b728501bf0343d957f53ab163cf2cd61206
MD5 1811fddf61cdb8f0266682d7df537239
SHA1 3b476e59e3243ef98940576dcd10bf30d30253d3
SHA512 8b362ceb566a8d2e97178f24ed1cd7c3c75c9f33a651fed7045a82cd67eca89a7f965d6f4895097eb775a3de9baa2ab67253519390efb686699e800b87671b9a
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHa:2UEtQevvqc2W1cpV2tI32
TLSH
T112474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 18a8c8bc5a30ad4a9bac2314e021860f49808d451a41f1714c2c9b9d59423b28
MD5 4ae21d130e1420a6fcd1d3ba57e0ef07
SHA1 3e42b56c35b8a819faeafb720dc330213b795b08
SHA512 aaa0b613c91bfcfa7067f093d0a159af921877e2555696949d9ab84d288ad986a0dfca43adfccf61f183de1df31a059bc52bca8988ebf321dab55d09b6ed032c
SSDEEP 49152:ICbRquA/m2yL5zifFiV+XenmE3/zy340FuiK0:hoqHVjnm1G
TLSH
T14AD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2ae4538ed306e36c9d6e1126086524121c5246da8f25b74ae26989dd108f2f7a
MD5 fb7c4ec5fd8dc79c85e6ef07b4491b5a
SHA1 7c1b5b013beeecd3c555738a8a116a362a53cfe9
SHA512 3a39ae31344ec5a8b74a681f8b6b96772f3f6123609073b4466a56a14c5507247e8b5f20b83ec478964b745b5a09097e2cb9eb6df889d0085212c8ec1708fb57
SSDEEP 24576:LAhGL3IFoiwtA5l7S53VEWJW0N3xpH+EnK0/E:LAMUFoiq5F340FuiK0
TLSH
T14A35AD81E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2220D11F0E33A40DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 fa7a7ca9ee10f82d917c5e806967baa36abd309d3104a4d33d0c1341cf9bb7d7
MD5 c065bde8d13fbf2417a2125ea5de40de
SHA1 f2570e3456fbd18b3eada86d7928a1eb2692ae2a
SHA512 634ca75ec2ddbe39635d85532d028cda7c56c12212018e0434d080f00b17d37848aadbfc33e6064452675875132437474765d641d981bddde69bbb7bb45b2f13
SSDEEP 12288:Cmw5HEjsChNDBFgl0WDm+CJEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCU:bwuKOWuEWJW0N3xpH+EnK0/E
TLSH
T1AC65F15A77E80CF9E96786398597D136E7F2BC012A21D71F1360C65B5F33221AE2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8688f2b3be109a268720dbff097da562a9af80042bc975776b2e40b0de79e2e2
MD5 48cb5876a0ae97d79119845ba733a4e5
SHA1 7e1be7dde73a0dc4577ac76780b44d3421c1690b
SHA512 2ec04cf6c2c5a8118e05f114a104619fd8ed2ba6b513f4173fea21fbce4a5410ec2126e17f7a6eeb924a26722213cdab3af41149c868107070fe2e1cfe563f8d
SSDEEP 12288:KwZ1IyiEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56M:BZuDEWJW0N3xpH+EnK0/E
TLSH
T19B55126B23E860F9E277923CC4E55245CBB278426B7203CF1325926D5F736D58E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bc8d931d073884dc6d8ff4f9d98d69f585f7ac675a1310e73f7e5013df2fd509
MD5 0a43a084f30902513c3970805bd3aee8
SHA1 f162bc3dc4908fc1e8d22b3a3837c0e82738de4e
SHA512 6532d40a21cfd37afa965113929f42e7dee6cc241e71684479a6b2aa962c574e12df42ba093c1a08e97451e2eb393c0b96e84e6597e06935298e6915dbab0f36
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U4:TQRQyi36YOcPbLvw2gAf+PN3gG
TLSH
T16F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a81209b830c68e78b16aeba881607c473214bf7313e918e6f1d60fd450bce612
MD5 31ffe33cc684534bd92910421f587cb4
SHA1 cd735ca976227cb310f1426297188e2d0c2bb4f9
SHA512 82b404b53c762d4a408d9165ac8078cc2a1b19f06474f604630dd3c370d786cc90bf900fb77212de1832760b6546cfad1b31df511e2b3ad857a36f869d7850b5
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U4:vQRQyi36YOcPbLvw2gAf+PN3gG
TLSH
T171667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f9efadb7c635ac81957408e419a0b5a1f4d8287899b9c1fd59c27aa399cdae4e
MD5 633ad93a073ee9e23b7839caae9c4b0e
SHA1 cba2b338ac1a2a13e03484d7e77479b73ea7d1aa
SHA512 973a154f39198afd542fc80915faa5c0e6d8daa4db4b47434cedd26514e3769947305c99ed20ff68865a4c53fe13d217c0b73cfacf4f6bd4b1946ac318e519e4
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0zEWJW0N3xpH+En0:r68Qg55nhceWu7PNU3/C340FuiK0
TLSH
T11DB55933B2F60099C44DE1769F4A873196D27C758FE1E3DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 898efdb3630a1ebb741b9a4f789112e3fb87ba9cfc8b537ea1755dc0486c7d8a
MD5 d4ad064b66c12e03f5a7499fb295c183
SHA1 3e2781cc19c003021eca4206475454dabfec2ef8
SHA512 4cd08301846b10bc885355306ba133c2dbff04554a2d07677f9f7dc0081d1be3920cc90c67256efae77bd284959da76a330a99810dff1a5062fd531495a722dc
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99C:qy5112gYy5azzVvt69nLKnhZ/G
TLSH
T196167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f0a107b35361e6c3b97f7cb773039f797d10a9e3f873847543916589a008d69d
MD5 c4fc5e38d0395eee5d63884c5d52c2e4
SHA1 e697e8b0b79474db67f0f4fe8ba0a8c7ab10968b
SHA512 734996890b50c966370abea12023d76c4b2e9bac73f254d9463628a753492bec6d811a2335e40484f4450aae6ed96ee123010e0361eedfe38a04b1e37d88990e
SSDEEP 49152:zB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glY340FuiK0:Fu6Jmdxd2dYG
TLSH
T1C1D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 50e527997d30877eaf67ed86ab57d63974fe18b03d5098255a88b1dad31d0176
MD5 d0599059b9dd4c6333a3a85cafac5886
SHA1 384b91db1df40f301412a9ef4c6305038dec132b
SHA512 b7d2278989b63c86385f3b2444ef58209d7d66ff3cfc9ff76c8145e0ebdd7221ee70da5d2814394593985282f33120c89e8fecbf85d1447390c407958fb15ddd
SSDEEP 49152:E1hpsNoJpF1A63U44CwH7R4xE340FuiK0:EmifPWR1G
TLSH
T1FEB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 95a3c5884a200a56af5482fc159852c8cbe15224a133afd7febc437899e92ad2
MD5 621f49147382c3420f265dac400eaabb
SHA1 4e2169301cff2c73c6c6b683e4211c4ed6e6b230
SHA512 3e2f0717214b2653dd3e2199764b8653fc4052fdc77b6f8f98b60962539284dcaebb59066c052fc7df7e07c37df1414121686df2cba43302cf10e633d7cc09b4
SSDEEP 49152:0SuZQIY0Be2KcRVtOnks6NMHqD340FuiK0:m5dKii61DG
TLSH
T183C5BF13F2E940E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 06bfe1a9b3d2b3f4641eea2bd53e43670719632cab8c834f4530101cf0e5ef3d
MD5 6300acba71170c0234f2851bf77b72a9
SHA1 b88785f6a8a141645a5e5b2648a47b1bc81bcf0a
SHA512 b9027c63c033eb638b2668ebac35bb0ac0d0e249b476450b254b49788e6ffae6896926b52d7854b5cb2e48f3fc5337a0025fddd2cb5282ec4866e3e75161a65f
SSDEEP 49152:yhtSn8EApI0fig3giDn0AP5wo340FuiK0:zX2imphBG
TLSH
T1C695BE13F2D901E8D06ED178C7468632EA62BC160B35A6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f270dea36d44dbbab5f42716884e7073012722a478e931f44f094c65fbe8b7b0
MD5 bddd4d3291dcbad8c2fa70f36855043a
SHA1 260606c0878bc79e777c696527fa54b3284a38cf
SHA512 6a5c5646b92230da0484e9578461d59f70580bfb8b923407d37b2b8851d404bd85239e7d8310716083a1050df524f4c2d2cf791049523a77e4faf92a61d2a5a4
SSDEEP 12288:F3EGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56V:F3EWJW0N3xpH+EnK0/E
TLSH
T17045237B9BDD41C8E73ADA75508862958DCE1E05FEA311E8B31EF12D96F3115CB0B240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 aec8c6203a16bcb0a4be14378359b087b8f6809e8daa1f4d68b0a0a87392d19d
MD5 1cc32c3c431cec6291e21bc6fe5d4057
SHA1 9f26a16bbad647135835fc335afdc31d0ceb5a93
SHA512 62d2d8e5e174a19084cc8ced91ea52a09fa6d416b6caaa9c2fdf312dcec6f6e8cac900b93c966cafa418ee13359d85950e23f440c89658569d8e6098910a7e95
SSDEEP 12288:oWEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56V:oWEWJW0N3xpH+EnK0/E
TLSH
T10D45237B9BDD41C8E73AD635508862958DDE4E05FEA312E8B31EF12D96F3129CB0B640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6e373e147d14e5cc620cf4e190b4c7ff9f3130a7eddf3fca70699d9d54c383a9
MD5 a3103ccf6e7facf8f6c672682f4571cb
SHA1 f1bea7df10ce07e9a8f9e1bbd16d4b179601e6e0
SHA512 fa8e58eafcb2a8463965ebd68ffcdbd87f57d9ec5ce0122998670b9636fc5e13a0d62e30b1505d161489da4960cb381544b7a539137dd23b336e85651e89c30f
SSDEEP 12288:D8EGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56Q:D8EWJW0N3xpH+EnK0/E
TLSH
T1DF45237B9BDD41C8E73ADA75508862958DDE0E05FEA312E8B31EF12D96F3119CB0B640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f86127d1d8583222ad52f0b8a4de79325308f91593f4e2d28ac9aac80561f9d5
MD5 23c59d8bc775ab53717a4dd0b323a829
SHA1 308391df6068aaaa223d909e132826e19e82cff1
SHA512 8a3133c5d341b844d4004f66bb85519a983a90b514a1dfb8f4d4d0448c15b1700ac470ad1a9da8067a91e2f6c34feae7b4b0e34265838f94d0ebe3d5365fb0e8
SSDEEP 12288:uV1EGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56b:SEWJW0N3xpH+EnK0/E
TLSH
T18C4523376BED40C4E53BD6388095A255CAEA7D45FF3313EFA315A52D0EB3254CA2AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0c0c5c02df17ef45d3c1b72c7728e5d816699667c7f2f3b65ecd06bbaf10101e
MD5 17a6f9ca4e95940c9cd5bb2bcf8cd360
SHA1 bb047cfc1b3930a5efc67048d5a7bf421e6a3327
SHA512 78dec91cc914880bd92c08319d43985687cfedb290937f04b7c13e0a657a6177e1a7de4711d78eca3045979c9c9c1ec812b8d5ac22dab541f64e4474958ce63d
SSDEEP 12288:/dEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T566:/dEWJW0N3xpH+EnK0/E
TLSH
T1D545237B9BDD41C8E73AD675508962958DDE0E05FEA311E8B31EF12D9AF3128CB0B640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 593fe2de47ab5c113aee160bcabf84a9f6da661ef2d228f9596612b86a9906f8
MD5 f7e3af5c5eba6687396c0b28af6aa31b
SHA1 7d025c9a9320cfe8cccd20e6dd03d066dbce460e
SHA512 ad461f9a13520927045f234c80eead78dfd7a8a5504db3af98001185198cfc81de459d28d47f1aa0a8999780ab4d7e2a74684f0ba5d217e72d8c30233b3ccd59
SSDEEP 12288:zqEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T561:zqEWJW0N3xpH+EnK0/E
TLSH
T12945237B9BDD41C8E33AD635508862998DDE4E05FEA312E8731EF12D96F3125CB0B640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2fd40fee324c3d3d3270b1bd8e6d0208ae5177e557de7d069bf0b28df2580039
MD5 6159c51939547612a5f43d1f8c468920
SHA1 14ae122f1715176f5480061c236e7fb1f392cad8
SHA512 4c8c9b9b8a987884f5c86ba603e6f0b5b9f4db92fb863e0b3537f163988371b6363d6e98fcf72e6b381c5c371aa98b4873c4a08030e19a2053ca0b502a996516
SSDEEP 12288:4eEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T569:4eEWJW0N3xpH+EnK0/E
TLSH
T10545237B9BDD41C8E73AD6355088A2958DDE1E05FEA312E8B31EF12D96F3125CB0B640
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 bb9eab806d08c9beaad82fdb3a117bca6029a6703c28d6510dccbe770372f215
MD5 be080deada2731dabc147248884e0864
SHA1 1136334a13ffe28612c9ff5207abf9a6a9b6630b
SHA512 93bbd91cc4840b486440c04fc44e6676ccaf4330a12c1bf9b56c45c1cfe5e2ff479f90029403def5c2d994eea736b73b352e0816ec698d23b715cd7b8dea4998
SSDEEP 12288:fiZwbTzzFEoS2cPvy2EGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56E:6ZMHzFVSO2EWJW0N3xpH+EnK0/E
TLSH
T1E06501A5B39018F8ED77823EC8559906C6F27C1A0B70C65F13A8362B5F733A14D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 070fb2e56216d7cbe3e97b9b35e1f61b82b0353c376e1f0b859f26b997722386
MD5 7ece69e66264ed16200426e2cf1734dd
SHA1 a7ecf7e636dbe74fe575006d338ce1e56e4f7093
SHA512 59afc765cb9f55b52335780ff8be055a8d12e35fdc6b80b6c1c859909e6edf323c90b5cbbdcc0b4ba8ea30bda097ff0092b3d6bc7b4f3f4550ba3304e995098c
SSDEEP 12288:jTEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56e:jTEWJW0N3xpH+EnK0/E
TLSH
T1CD45237B9BDD41C8E73AD635508862958DDE5E09FEA312E8B31EF12D96F3119CB0B240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 bc55ea69d522de1ab5e895509119cbfcdd4c3368b6ef6135895416d09ae34b83
MD5 29a984029c9a3084c53993b14a706549
SHA1 8a4264cf5f942aa447739243ac12384480a9a08d
SHA512 901b3d8ffbe30d86c50c4e68a1bd9afde17ff9c051846f4ee08f17488b75e7d27e34a9713af4413a106ae5a998cba9cc67f57157ded03ad9096472c4fdb29914
SSDEEP 12288:4PEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T562:4PEWJW0N3xpH+EnK0/E
TLSH
T19F45237B9BDD41C8E63AD635508862998DDE4F05BEA312D8B31EF12D96F3125CB0B240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 5f6d530028bd4fb67c500beeb576ca5903dc13d1323a1e795eca4f0db62eb619
MD5 23ceaf263e74b38b20d462a97369ba76
SHA1 f197f45b782bccd6e3d76c2e2d1a41ab6b4aaf21
SHA512 e10a6bb0d524e8cab418fe9dbd26ac4c2d3de695b2feed3bc47d35c1d197bcbef31bc5414ab00b5da6ef2c3b99767cbae37bdf32f7ff3131521e232b709f8730
SSDEEP 12288:oyPz5L8iEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56M:pzyiEWJW0N3xpH+EnK0/E
TLSH
T1AE55121777A530F8D137923888911602E7B678365B314AEF6364577A2F732A09E3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3976a66385aac0fb5a335b513f94511342843918a76dfc832d1f7074cbd2c1d6
MD5 be576ad7b7a16442b93a3888c0b34812
SHA1 afd775bfdc1b58901f8e11a96f625995cbfdc3c3
SHA512 7f9f4cf467895c9f001d6ebc362a51feff4576406a484378637b5f9cca1fc221926c653d22c62aa1950ca107adad5f78476285a36c136ef9c271fec2f9421e21
SSDEEP 12288:mTEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56s:mTEWJW0N3xpH+EnK0/E
TLSH
T14945237B9BDD41C8E73AD635508862998DDE5E09FEA312D8B31EF12D96F3119CB0B240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9f927b14ca1636482374e7395a90d3df0a4f4730283f91f549f288c3a5e0396f
MD5 7fd5be59a962abaedd7adb20b6e32131
SHA1 82fd5a5b995ae79b282f3e975c2b258c7e03fde3
SHA512 328d9f1b344ec215610dda0be8a7f900065463cd90ed8736899b5e6ec5f1e5208654c4b54e74984f7f161d1f1fc3d6b436fad293bd4468901e799ecb972d1389
SSDEEP 12288:HTEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56s:HTEWJW0N3xpH+EnK0/E
TLSH
T17445237B9BDD41C8E73AD635508862998DDE5E05FEA312D8B31EF12D96F3119CB0B240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ea6285f8f86c7e50348466d40a01cce59945253b0e2cd13688afc92a67c0c5b2
MD5 ec6c4ae0f4bf00f476123b4edfa35b81
SHA1 aa63579843dafca8981147b94f37cd57dba9c4bf
SHA512 614cba1963ab5405ab50a3dd9c1f0ffba02b74f31e6a068199613ae4237a517891732cbdcea9e60120e0c43f937bea5ad68b61fe11797216f12614b1c3131280
SSDEEP 24576:ACU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAQEWJW0N3xpH+EnK0/E:ACUZPTY+8Wg2lIL8lrIUJLWwd340Fuif
TLSH
T1AC65BE1EA3DC0896D0BBC13589518A16EB72782E1B3296CF2160C33D6F67ED55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 bb0660b0d1909b67c6324766c4e5fcd5f8cf26d848bd3ca81ad7730699df58d5
MD5 2b847da70f432eace9278cd60f9300f4
SHA1 254fb1c55bbcb0351c44a8d922bb7e152c59517d
SHA512 d9e6eea5136269b0d7f743b703b8e09e9e2737665f6cc887daca0d6268798ef0bd508a08b088b3efb943212fccdb86e7804a0459278d2a1d5f5b0aded62546e5
SSDEEP 12288:uJsfDEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56E:/DEWJW0N3xpH+EnK0/E
TLSH
T16555012AD29802D8C16EA239C7555641F7773C259BE293CB63D0F53E0F762908EEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 25be0df69e80c70eeb92dd860a3e705686d4451097f6d842f63c41ee974f1f52
MD5 027ea9dc0cb3daa7cc8b20674f890c4f
SHA1 261b7dfcc62e92c4cbec796caa82032159703953
SHA512 1d7584de0cf72c16b1bf55b074b7cc0c8a8d8f08c3f9ed328aa38527c35cbfada9a51486f45fbbabeff3a6ca577ffa982f3f5887f54a56de85bc5071fdd89516
SSDEEP 12288:0cEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T564+:0cEWJW0N3xpH+EnK0/EN
TLSH
T12A45233797DC85C8E63EDB34109DE2354A9E6A04AF6211DBF30AF26D95B3194CE3A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 08263482893bcdd0322d6dd07ac355ffa69dc96d697bbc3cfafa4f4121f46f39
MD5 da519c721fb12cf0e5c864c8ae70b4ee
SHA1 a99ae52d17bdb032bcdcf00d163b4c9bf6dac965
SHA512 e1274c656fda25d4cb7e014701ee95f4b9f1bd64def112006fbaf8ac2b1e7c5109d3d7db6b44a0e5031673bb2dd3fba66584ffa1c749e9d9a7bcb6202746d243
SSDEEP 24576:c8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCyEWJW0N3xpH+EnK0/E:VRZwQCyiHiQEaiPnML340FuiK0
TLSH
T13885BF1E63DC46A4E0BAD278CDA74407E6B278165731A7CF1250C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 b580d2b031c19f008051e4d6be11e3e83a3e49ab210dcad25e69ef9c073ccb63
MD5 d0212482d8a6769747499ae11e166206
SHA1 f79ada6ac809193aaad5246b7fe5befcb45a7081
SHA512 7ec8df7259b883ce7d9a9807bfad99dceb0070e2dfecf869b4673a8f2b6f065d0877afbddb661cd6e8ec05a3eee0f93ed1300a384cf708129c99385c50a41a5d
SSDEEP 12288:AbxA1U7KsEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56H:AbxA1UGsEWJW0N3xpH+EnK0/E
TLSH
T19155023F66EC14E4E276E63D84D58206C77278166B2153EF2295D23E0F37AE48D3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e0b942fabd02ecabad78a6f303aa074d6f15d5c7ef5b70fd54365dacf20056f6
MD5 3141453a3d2e0a6187909c8c824f0aa9
SHA1 bf1d98573c4e055167ef8368965e5051524e2dc3
SHA512 f701e708dd3285d9ea8d197d3a5a0a1e3be06b3fe7b7f6cc418d9e35dca7d18b9e1dad1e4db5171bf8790b029409b5f2e44010453ea29113ff57e10493b066f4
SSDEEP 24576:rjsmP0yHaqrVqHra44KDzMsrnFEWJW0N3xpH+EnK0/E:rjRP0yHfVqzlAsrnF340FuiK0
TLSH
T15A45AF2EF2B910F9D4AAD136454107B5EB71782D1F219ACB0170C634AF0AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 7bcc7f44abf00be7eac2b5cf8af7656f5a66885ef6e580731254931489d48768
MD5 2219669e24d64fd85e26058e74d87e3e
SHA1 f44402a8385578b2a9153895b5f84e0be1afc2fb
SHA512 b5bfbbc60a3c2f74d3fd7617f42ac7dd4119070f2f48ed2403bfedfdab4c845e8085523f12064fd1afc6dfb654f13e528e33b3abc06b793ac5089cc314537fc4
SSDEEP 12288:VKEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56u:VKEWJW0N3xpH+EnK0/E
TLSH
T16A45237B97DC45C8E63ADB341088A2554E9E5F05AF7312E6731AF13D46F31A9CB2B240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 42894440992a65d5c214c6bf6a1e0af2d3f3b67757e1450390d21a3cc823188c
MD5 a4b25b4e6e5a6eb1f13217ab38fc4228
SHA1 05b166b4e702e5bb44bc457ba3ee2023c92238ec
SHA512 199f3837bdeea92041036f928445c11f71b2999359ddd4838df7e8414c9164a4f42daa2a5d7ffa41ef110ebb4cb7d7a0a3edcd836a8c42ec6b85ad008dae5848
SSDEEP 12288:hObVA4LWO+vAYFToEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T567:WBLBUToEWJW0N3xpH+EnK0/E
TLSH
T1D375F155E7A400F8E97BD23CC4A69616D6B2B85D0760E7DF03688B691F633E18E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bdeb7c5464ff90c09ae417d2333aa15c3b245f33b177a954c4ea5ea057dca7c0
MD5 113d70eb3b5bbd40506a2b6c194936ee
SHA1 89a0c00f07c47b5d1bf85bb5fc347b24322f9f55
SHA512 29e8d43d77c4168d9712842969b87712fb779afb842fc9685632a415c05adc423f0a9041e0e754df4cd2615869810d6dffa2f7da13d5162f54c0e22f2d239513
SSDEEP 12288:v70VmLIYNvUyBpnEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56y:4DYNHREWJW0N3xpH+EnK0/E
TLSH
T18965F12F62AD08E4E53BA17D89C28209E6737856171192DF11B0C27E1F27EE9BD3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 127a52217d98b4baf619d31a50beef40ade19c605ab1db61f2c057482aa1acee
MD5 846da2b2782dfb65f0a339de92b63f60
SHA1 86c51467172184866023ff43a9616b131b459430
SHA512 6e30ec44bd3790256d9a32b782edf68a9fd4d2f98c7bf43137ed2d25ad2feceaa8da0b0715e97d6db33a7120e287212b9bd516a277bd70adb90fa195201021d7
SSDEEP 24576:qnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK7:qnXoJJYH84VVS6AmEOJas+cHBjSSKHPG
TLSH
T1B265BF6EA2BC04D8D5BBD17DC5C25506F5B27862133186CF0221C2BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 badefa847211726a27095f43eb28e8c2bb628835a22480cba81813d78e9710d9
MD5 029d74d8f68e28e5503da49e8f558435
SHA1 defae18f3174a05a6c63c4da93bcda05110d9516
SHA512 4402d73284395e8a97db95e20867716d4500d0cf38c6d3607ad211224b651ee9eb0e7d2df9861552fe3efe92b0c00e80ba0176a129786caaaf3eb06e6056adc9
SSDEEP 24576:Kv7Xbxd9Tuycf8M/TYlSuxrr2PCfEWJW0N3xpH+EnK0/E:KDLL9TuJ0M/TYj2Pq340FuiK0
TLSH
T19B858D5EA3EC42D8E07BDABD85A79146FAB2B855273081CF0251856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 cb162396a873da458c54c9233b04e45aad09b8b648e6a0dead7255bcc92003b9
MD5 0de9326b40b2898b47ac1d245d8844d4
SHA1 450feabde8161fec8a3d7325e535bf4a99d6b6ff
SHA512 7be71e8eac2e5f81269484233de447e0d4abe71357b670f47c4c640f1214ca17f77c9200d29f766198b4caca17f0a519382dd1c18c1e5202f0812635dd4e7108
SSDEEP 24576:NegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10woEWJW0N3xpH+EnK0/E:NngOJOmPOHzo340FuiK0
TLSH
T1D555CF3FA7BC15D5E03EC17D89968916F6B1782613355ACF0160827E5F2BEE46E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 fca9d545b51aad67e3849336ddab7115ba51b781035843dc74ee51ba4ae9a7a2
MD5 de0be1e7b08d2f4774acf92d78908c6b
SHA1 6fd3cf6d7117ebc5dce661d20cf0d4a8e7d5e849
SHA512 d53150cf7765999e918ad6a1df3250092efa37036c76d2af092a1097e851450aece12da87ff700b5d394fc18c4827e4ad5559c4851d3f4cd2b9713c27c7fe6bc
SSDEEP 24576:kLJnJiTk3R3waE4JrOqEWJW0N3xpH+EnK0/E:kLJnJK8R304l1340FuiK0
TLSH
T17C75D03DD2A810E8D4B7C2B4815A2756FF71346D2B2269CB6974D5353F12FE0AA39F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 10d5cca68f0f494515f23fde5a875956947d4d2c458e23b5f3b1a41147e9b3d7
MD5 6d6e0fc0a62c513173e5c8674694066b
SHA1 38420f0611f1ba4360a0d5195a80f9d5483ac0cc
SHA512 c5c55adbb81999da8075e8a458baf0cb54ab97f407fa951142e5e93c575af9bddc564dde9748389158ad05a0e56e789ba7cad2bd779cd0cd8a170b22e05862ff
SSDEEP 24576:KA9mqCceDQncA/BmlvLto8cFVr9og9P/Z6pgEWJW0N3xpH+EnK0/E:V9mqCzDScAZmlvTcFg8Ph6e340FuiK0
TLSH
T14A955C15F7EB5298E8B3CAF1C96294159B327C409B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 5eb95811b26e3d090b67ed689ed439767b16eb03f408889cc2510e0678866c32
MD5 cad9eea3242e399b637a6a9f2bab413c
SHA1 bf5aaeb711a1f69e013ceb8ab8a21950c774938c
SHA512 82dde872f93cbdb768d3cca15b3bfaf20504e8c87d665f1902981fd3587bcfa1b9e4761108c1e5519fe390dc1a678746b2781451717517a7e13db77448054a0d
SSDEEP 12288:3lYJeXm5nkEUuE4EGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56u:3lYJeXm5jUuE4EWJW0N3xpH+EnK0/E
TLSH
T13155126E77AC30D4E23ED13980914254C7B2B4656B5223FF52A0D27E8FB3AE55E39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 7363a8dde857c5010ab4c78b86e2c3e3309e8af90c78d4c73befc5e098c09d57
MD5 8b6e89d07f301a963d612e13df29030b
SHA1 a98566ed54fdb9bd27b048f75d945e233504a69b
SHA512 44bd6bcf6f8e2ddda5afa98c0856e694dadb8f1ebd325034ba5529ab7a89e6af41afd48f8dc3f6ab7bab49b91c87a9bffd18aaa67a1179caec6bf8b99eeb0ed9
SSDEEP 12288:Sou6kylEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56R:SNtylEWJW0N3xpH+EnK0/E
TLSH
T1EC55121663D851D8E67A8A3894A282A48F79BC10AF2113EF6291F33F5E737D4DD35B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 af859adf278c8b4adbb9a1c24bcbf086328646e0b5a9ad05c7a588da83f16721
MD5 0ecc440898b5c63b3fc8d821e3a19fa8
SHA1 265843f9c72e4aa590dbd9e3e342d058296ddea6
SHA512 203dd03e736836061fc12f77b57ef29ed7aedba498f9f887c55e699fd553f72f3ce7fdee1af1965b661eed39b1973723518f8735416ba7a9224fc9d1cde62a11
SSDEEP 12288:fPoEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56X:XoEWJW0N3xpH+EnK0/E
TLSH
T12045233F57EC50C8EA36DA34405962558AAE3A14AF6221FF7329F13DCAF3155CA27A40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1f1b8de65a976ec98474ac16887582e719fc2a44be395ec6ee3095224a3cd7ae
MD5 c82f85d7419d0472fb23d8f0bf549ae0
SHA1 d451138f3b431b4fd342ccbf2681ec04c0025495
SHA512 1e773bb891cff42cff1cee5c0e694822463451c63f1c21ab9df71f3f1aed976b3689cde82864d9e80aea35163e32a62085dffdb75dcafa2ac9fa5a20ff680a76
SSDEEP 24576:nC+TyQIu93VAumZr7jmjEWJW0N3xpH+EnK0/E:n/TfIq+Yj340FuiK0
TLSH
T10D558D1DA7E91DCAE276C675C8A34493EA33B872177186CF2044C07D499EEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 0b8e627bdb3173fb82b3b49e551f4cf24e5bbccc10920a9ce0fdac165463e0e5
MD5 a0c45ed2feda5e434d3eb79d8db65f13
SHA1 44ff16b8fc4d5b76b06a28cfe9229ee6668222db
SHA512 959f9250355f29fa592c6a5a9142701ef01482bdf99a82a8345860ac4eaf97a9e48bcfd35b8b2044c8ab3dfe21bb6cf901b0cb4b5867fbf9431e94c39c23f728
SSDEEP 12288:ecyrWOstaa3kcsUEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56h:HLQikZUEWJW0N3xpH+EnK0/E
TLSH
T1C565F11FB3AE0095E167C23C88854256FAB374245B2263DF52A0C77D4BB75E9BE38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d5a6f8efb90c9dc051b397a56e3f260fae4ef71757564f999b047ec5f4c45358
MD5 f114a12507a112ce01242379d50b3d92
SHA1 741dad36300538d364cd8e791238010d2ed8684b
SHA512 e0d124e7c52b6082e6ce593691d26576d153579ff901230a1a36d9957835e68fd3c7ef04ce4af277dfc72e79a9a902bdfdc85e54a3e73c66c62e3d8aed6030d1
SSDEEP 49152:bpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPl340FuiK0:wpC7b4+80GTkmG
TLSH
T1B9A57C3DE2F810ADD9AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 82b606532ea211487d353b46f87d7ab3be75017b880ff46826061434a319170b
MD5 0b0e65add62585d319d19d801415b250
SHA1 3ea9ded0e54b4b8320647fd172c9d4124dd68324
SHA512 a48822bcc9b5e0f3dfdf14689e04afa246e93b572b8f88fca517fbc3081cac8a27dd3757cc7ef8a4da8cdb71c3b5ab6ce468ebea23cf1494fb4d9d30419d4b91
SSDEEP 24576:iSAwJPE1IDAo+4Kt+l4413JUQ9EWJW0N3xpH+EnK0/E:iqPCIo4Kol4vQ9340FuiK0
TLSH
T14D55B02AA7F956E4E17ACB74D663C611FB737822133163CF5290813E0E169E89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 54a2c13b65e84644aeb0943dea2a9a572b5d4c053318c837ca76f0fb7db6ef43
MD5 7b2e5ac204d9ae5413eee39e07d372d8
SHA1 68827ecbf4122af998a8ffe3f69bda17aa1a54cf
SHA512 a8a9e8caaa476a51bbb2718d37773731b401380fb549f1ec18c1039096c0088c2712ff87b191e52a2ce522ecba6e6143218963ac875d4f744abf91dc2d048b01
SSDEEP 12288:USsyLCFBoPLCRy56NQ4tNEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/S:cyLXPLcq94tNEWJW0N3xpH+EnK0/E
TLSH
T19675E03ED76D04E4E57AC27CD2A38506F67238AD033166CB16A4D1791F6BEF4A939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 d46c3e07ce741f7f039a4c4a9d7a7b35d65f508237c09774f3599dc60a925e26
MD5 5f94a9926b104356c72b32ebd468b299
SHA1 4d475cfed49d9b7c18cd4c7ccba9fa78ad5f45e1
SHA512 4f1dc029201f68ef82827a8ad76383d6c6cf85cae566dfd9751dadaf72dcb963eb9f3fff37e71548471b64fa06ce40589d71b794fd07c57e0465843b9fc7d774
SSDEEP 12288:I9lyvj3IkxjbBzEEGBFZ3ZdIYNoFIv5N+RS1ampH+EnKfB+zVYJU5TCa/T56T:IWv8qjpEEWJW0N3xpH+EnK0/E
TLSH
T11A65126F57E824C8E13A8634D066822585B67D762B7126FF72C8E57A4B726D0C93FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-244-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/420-522-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/420-247-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1076-436-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1076-175-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1076-182-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1500-218-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1500-221-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1500-212-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1500-223-0x00000000006A0000-0x00000000006F6000-memory.dmp

Download

memory/1500-224-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1996-170-0x0000000140000000-0x0000000140138000-memory.dmp

Download

memory/1996-168-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1996-162-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1996-284-0x0000000140000000-0x0000000140138000-memory.dmp

Download

memory/2316-250-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2316-129-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2316-135-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/2316-130-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/2352-251-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2352-257-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2352-258-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2352-576-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2568-285-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2568-282-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2568-306-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2568-290-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2568-325-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2568-276-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2568-658-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2628-6-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2628-8-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/2628-0-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2628-61-0x0000000140000000-0x0000000140323000-memory.dmp

Download

memory/3424-124-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3424-246-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/3424-127-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/3424-118-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3536-208-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/3536-206-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3536-200-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3536-472-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/3792-187-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3792-457-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3792-198-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3792-194-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3828-269-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3828-271-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3828-263-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3828-625-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4084-156-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4084-158-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4084-275-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4084-575-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4084-150-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4124-232-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4124-473-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4124-226-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4124-235-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4164-104-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4164-234-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/4164-110-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4164-112-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/4216-145-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4216-147-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4216-262-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4216-139-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4748-48-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4748-50-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4748-47-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4748-39-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4748-38-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5132-76-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5132-100-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5132-85-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5132-82-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5132-89-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5372-21-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5372-88-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/5372-12-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5372-20-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/5468-34-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/5468-35-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5468-26-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5592-62-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5592-174-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5592-53-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5592-59-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5736-73-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5736-65-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5736-193-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5736-71-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5840-478-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-484-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-475-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-479-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-476-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-489-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-477-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-488-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-480-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-481-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-487-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-482-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-483-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-474-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-485-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5840-486-0x000001A8A86A0000-0x000001A8A86B0000-memory.dmp

Download

memory/5876-92-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5876-211-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/5876-98-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5876-91-0x0000000140000000-0x000000014015A000-memory.dmp

Download