675617560ccfbdfdac642f0d771a9e3522c517e2ebe7a0837de6938778511385

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.7MB
Sample260528-stsvvaes7v
SHA256 675617560ccfbdfdac642f0d771a9e3522c517e2ebe7a0837de6938778511385
MD5 76330146016ffe1756ec40f93e5633ea
SHA1 8f1a6d2782c0edcfd87fdc8b93e6dc12439b06b0
SHA512 5da366f65ac68bbbd8425cb4d49e143de37ddee8d2369e8f8ec26c6d371582a8ca7b0fef3b775056284fa705e2e960659ce9297c92fb750d4156604381617447
SSDEEP 24576:znXBcQnigYC+NM+0pINYrbmeHT0gicsXvwPrHavYWJeqm:zO8lY8+0pEYgcam6vYWo
TLSH
T13585D041B3AC3CF9D167D238C9724A51EA71BC155720D34E03E9A76A1F33662BD3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4276	alg.exe
3176	DiagnosticsHub.StandardCollector.Service.exe
1632	fxssvc.exe
3608	elevation_service.exe
3616	elevation_service.exe
444	maintenanceservice.exe
4332	msdtc.exe
4464	OSE.EXE
2544	PerceptionSimulationService.exe
1012	perfhost.exe
1788	locator.exe
2888	SensorDataService.exe
908	snmptrap.exe
1432	spectrum.exe
2468	ssh-agent.exe
1844	TieringEngineService.exe
5080	AgentService.exe
3296	vds.exe
2584	vssvc.exe
2556	wbengine.exe
3252	WmiApSrv.exe
3312	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ebc825efc4568d2.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b34e0c47b6eedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064090948b6eedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000809efb46b6eedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3176	DiagnosticsHub.StandardCollector.Service.exe
3176	DiagnosticsHub.StandardCollector.Service.exe
3176	DiagnosticsHub.StandardCollector.Service.exe
3176	DiagnosticsHub.StandardCollector.Service.exe
3176	DiagnosticsHub.StandardCollector.Service.exe
3176	DiagnosticsHub.StandardCollector.Service.exe
3176	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4608	2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	1632	fxssvc.exe
Token: SeRestorePrivilege	1844	TieringEngineService.exe
Token: SeManageVolumePrivilege	1844	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5080	AgentService.exe
Token: SeBackupPrivilege	2584	vssvc.exe
Token: SeRestorePrivilege	2584	vssvc.exe
Token: SeAuditPrivilege	2584	vssvc.exe
Token: SeBackupPrivilege	2556	wbengine.exe
Token: SeRestorePrivilege	2556	wbengine.exe
Token: SeSecurityPrivilege	2556	wbengine.exe
Token: 33	3312	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3312	SearchIndexer.exe
Token: SeDebugPrivilege	4276	alg.exe
Token: SeDebugPrivilege	4276	alg.exe
Token: SeDebugPrivilege	4276	alg.exe
Token: SeDebugPrivilege	3176	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 3244	3312	SearchIndexer.exe	105
PID 3312 wrote to memory of 3268	3312	SearchIndexer.exe	106
PID 3312 wrote to memory of 2680	3312	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_76330146016ffe1756ec40f93e5633ea_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2928

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3616

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:444

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4332

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1012

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1788

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2888

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:908

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4072

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3252

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3244
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2816 2812 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3268
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2828 2836 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bab6683531bc339116188441d5b9d111aac4ad040b54389f9ef5600c447a4e26
MD5 ffc6d6667175c5b9793347d3af7c26b7
SHA1 7688904a959e0c2eac1a74bd3cbc1ec85c08f425
SHA512 6adab38a9a464a693bd9f415db495c57284482658bf4f9bcca256f8e9eb9dc39cce2e5c1a7051fcbdef47c89cfe3c313c7278a1b72e596027cc973700f45d966
SSDEEP 49152:Cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnupEYgcam6vYWo:k3q6sjBjpEfca7AWo
TLSH
T1CBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5470af2688355effc7b77d04dadf80b43d026edb73c01367657a1cc1590e7f6c
MD5 73b52c669d6e2ce262fc93f729ff25a9
SHA1 59e9d5c2d78b0e15562f319bac7ccad3efd2dd3e
SHA512 7918d1429d54f3f37c33ff098de966f7dabab9f6d110ed661d71098e92fe3ec0f7d10ac1afe145e82e63996cc16c6df71547496d8fe45d1b02b1b7391152fe64
SSDEEP 24576:WXYfDtczAHpINYrbmeHT0gicsXvwPrHavYWJeqm:VtckpEYgcam6vYWo
TLSH
T15E65F12877E504F9ED67823CC8A1C511EA337C9547A0E69B03A49A3A1F337D85D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d52bba916d1ff972dd56087e56f8683ec0e53a84fbcd84b261edfa3b39c647cb
MD5 13cacb1bedb7987b23925563afc26112
SHA1 7ca30467d80dd811c3df28184716ee26412e6559
SHA512 15dc229ddc03fff9337c938385cfc5bdae2e8d9463e6e47d820355bdc038a4e36e1b2d2636d996bb8dda2e6a41db0c8ad475cee09399d39fbefc140158b32b01
SSDEEP 24576:F0Le5ji0hmxvrMmpINYrbmeHT0gicsXvwPrHavYWJeqm:FPji0AtxpEYgcam6vYWo
TLSH
T18F859E15F6B48335D073C0B9C5D2A68EED71308657308ACB4286D77C6E67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1d1b7f562a9c4a718b7d20e876d12d7d76f679a246cad216ead0ade91c25dd2d
MD5 bac96fea950f22efbd74d0060e7dfc3b
SHA1 c7a0b6f985c4d13c4fc3ac9825447a14261b58ef
SHA512 fc76be1fa547fd7efb1a331bd4a174b881fe1d3afd1b6b8ce288b2ed599358e841f090a39e4cf865e522038e07488cdcf78d612c1f0da3538512b8cf2fa92ee9
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWn6q8wyu0pINYrbmeHT0gicsXvwPrHavYWJeqm:n/ezSC6vUzPveHjy1pEYgcam6vYWo
TLSH
T1C3755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dec0a623be0c78525d58a4046e6aa361a2ad6a83c4230d2abfa273625a554099
MD5 cd09b9338dc1332f2139870ecef16546
SHA1 e4aaaacd3b59b7311d16536af7914ad7fcba768c
SHA512 436de46baf1ba15671b84696cb1a31bad3b29e7682815e3c0267ee3e6caee5c225430dcfba4aa7a35c1db48aae2ed131b47319d317e1619f3f147beccb885d55
SSDEEP 24576:tVbqPb88hv/l+YzpINYrbmeHT0gicsXvwPrHavYWJeqm:tVO88hXl+cpEYgcam6vYWo
TLSH
T1C4559F65F5B48331D073C0BAC4D2AA9AEE3234415B31CACB1246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2eef9c065509aff6effa6f2a10938d197cf2a4c7278820a9ce826c51ed525464
MD5 ccc78f64ce45216db799492a94ccd9dc
SHA1 0b32eb29364dfd6f2f9aaf0172a2fe8c86312811
SHA512 af1dd33cb6a099ded1d31aa29d888d31d4570d3d1f2268b62afdb0043bf019df2f14e9d9ccfbacd13b058e12507141b2656db1f28388bc08d41855ecb7782a94
SSDEEP 24576:thipINYrbmeHT0gicsXvwPrHavYWJeqm:mpEYgcam6vYWo
TLSH
T1C845234869FA60B9D32B833584D4D918AA256DF8D4E1C411D0213F3F0DBDEE6CC2EAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 300123d4d4661a5573298bb369e1d70e663f693a78f41a7573c42ceaf2b3f7cb
MD5 1e7c226eab50bd254a08b684cbb320b9
SHA1 debb73dcc7f855489279d496e45fafc17716a3f4
SHA512 fa386a4da9d9e2b30e6ac9ff1ed4e6e418f80da33429508a9409b4d1a36b6daf389795ebe66d8b199e8a8e883cd86711840e2240e661c4ffbf206a22d8eb053d
SSDEEP 24576:JJIUrpINYrbmeHT0gicsXvwPrHavYWJeqm:JJIUrpEYgcam6vYWo
TLSH
T15565CF3BEE78FCE2C27A8D785691C600E77278704B6293CBD165830E9E235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6e387d214f154f783d852109a594d107ba177a7d772eb70b77fb102713846225
MD5 41f925577f515d8e0c818b1c729366cb
SHA1 fcdde4b3b722e3f8cd291089705fb10c8bea5543
SHA512 ffe78680ff8e62fadf9e1a9fa6f695864c745f5f120191424597f0d63a26d031cae3bfe96b9f6562b25c080bee05e3e00e1c13e779cfee67d43be0108efe1d00
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH7:0QvGAdlCEL8c/DRNw5CEpEfca7AWo
TLSH
T1C2267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b5950533e6e15d343bfc0bdb70bd0d489bf258937125f43972c5951dfdcbbffe
MD5 8344214a61d7bcadf6d58389c8d4d209
SHA1 f4590d7293fe4e47102f2008f868d7dd1917dfe8
SHA512 bbe34e259669b80d6c8429f76fbfb0e1635a0e31d03140b7bfdb24ea5c7ead60d007a265a5b5abedf64b87105bf3836579042ebafc85ec28ecc0dfd03c6cf331
SSDEEP 24576:puewsAjBpINYrbmeHT0gicsXvwPrHavYWJeqm:IljBpEYgcam6vYWo
TLSH
T15D75E030FEB4E036C37B0DB21B65C706583C79604BA219C3E3A85E9E49746D2677AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c3ed645f843fa403b665585eeceb33dee1705f883c7a50e1b58b9b18d809554e
MD5 b219155f77bca950bc31c9e19705ad13
SHA1 223ff338d9537094443a9d0fb2614ffa544a9157
SHA512 f893fc34c7c8f2fb52d3cb29a149ba7194a39a0e050dd2fd944e35e4d4f7b6cdaef5467dbbb0cdb58c04e2e5c499f27416257dccbb27ea753db66d830f718fed
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHTBaX:ZUEtQevvqc2W1cpV2tI32kX
TLSH
T1B5474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 35f25b6cc70ab6ae6409e787488e8ade3e95b0c90e3381d65732a5d6f7f638f9
MD5 8e28da6ed4693f4b345fb216493abd04
SHA1 7c6fda8ab6c274de162bd458fac9c53169f2d33d
SHA512 affcd2b5bfc7cf6e63dd61a2f0a44624d33d2379ce00813d3e4c2d1240cd81abf2b1682255086c36dca81609178d7a0be949c1c2f06c5893065f2342e48baefa
SSDEEP 49152:BCbRquA/m2yL5zTfFiV+XenmE3/zhpEYgcam6vYWo:uoquVjnmopEfca7AWo
TLSH
T1D0D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3dc8c4046e01baeb93b38c23cc8a39990c809737dcc9a7636b95dcf111a90963
MD5 bbbcc2cc24b6df7a18167555c662e208
SHA1 893d99c8149e2be985a876096f26ade400af7f96
SHA512 c1839226c1b1ef5da8a4023533fd964e25ebeee9247db8f56fec17977d8636a8f20f9f089fe92acfaf8a22da962e416597b27aa460cf0c30433024f2584d3866
SSDEEP 24576:MAhGL3IFoiwtA5l7S53IpINYrbmeHT0gicsXvwPrHavYWJeqm:MAMUFoiq54pEYgcam6vYWo
TLSH
T12E359D80E7F955D4F5B3AA7899B69170EA76BCA95E31C20F2160D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b3dee8f66321792e973aa4fa6180466e99fd727e544cc46bdf30bf4e48f46599
MD5 6ceda6ff94ede028a1d79f1530d9d878
SHA1 da4245de4eeb778d8c53a60ff5a14dbdba191192
SHA512 eb563eb29ae45014c3f10e6d2d1117b059a99615f8212c5e06c4755286c099fe6397fa890c222e8d684152d22a8614f969a6b707627750a5ac477d8db2b2e4ae
SSDEEP 24576:ywuKOWVpINYrbmeHT0gicsXvwPrHavYWJeqm:ywdOMpEYgcam6vYWo
TLSH
T19265F14936E91CF9EA6782388597C136F7B2BC512A21C71F1360C62B5F37361AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5ecb3ff5abfca4aae6e5e312c8c6aea7a0c1abc31e152197b067905e61f0c63a
MD5 764126fabcb1858d63722d4725b0d805
SHA1 097950db93244188cba822528f5fe84fd3dc7faf
SHA512 8631406aa701aa4dce4326d8b617fcd857291c0e270ecffb0b1ab6df36b963f189fa0ebf821ccc94c60e4167a817a49b77adf66a829904104a6735abc042f2ae
SSDEEP 24576:vZu+pINYrbmeHT0gicsXvwPrHavYWJeqm:JpEYgcam6vYWo
TLSH
T1BB55128936E820F9E3678238C8E49605E77278A5637283CF50211A2B1F77ED68D3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 afc21c80a0d530cf0d9b6b09b540de5c52e1804ab6b76113866271768e9d0c0a
MD5 843e790005d781b796b3baf7d3e6b4a7
SHA1 964825083a5f13dd1218a907cae8a0cdd28424ba
SHA512 ea6385297a98c25fbeb3e5954dbe9585e0aa3012aaa677927a841a36b75ffa7c9a74e6d8a3a954806193c09c005668518227def53acf7dafb6dcac9a9bdef343
SSDEEP 98304:BQRQyi36YOcPbLvw2gAf+PN3fpEfca7AWo:YQyiKa/X+PNRBaX
TLSH
T1B5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d7ac07c7cebcfa9916fc9041991f9e73ced2cbb8b87cfc68045dfe6bf3bc3f49
MD5 e4c38d9a5e1382a11ec72b9727a1200c
SHA1 3a4940e09386d1a244ffe8343714c47995636c42
SHA512 c1be95a2e5ac6e434f7eef074b7137ba77f1222d1424b33cf0cc01e5a3b88730c059dba49fc3be0c67b79a69f3ab7925d8027132f160b0000ac2714ec5d1fed7
SSDEEP 98304:BQRQyi36YOcPbLvw2gAf+PN3fpEfca7AWo:YQyiKa/X+PNRBaX
TLSH
T1D8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 23b8a8c7f778d5dcc6f01e14e39061fe4d74216a850f34685f2145807524cacd
MD5 68e12441ca0a7f8da1643415c9d30d09
SHA1 92e24992523da58ad1dd0a15b1f1e3a667221714
SHA512 6ffafca4579a3829ad7e04496f9847fd6902c4ab52bd2b493697cbf9bc8f12ec7ee22131700c87bb529f5fdeb3093385ef94eb8df0aa6454c6dc40f68c7efa83
SSDEEP 49152:x68Qg55nhceWu7PNU3/xpEYgcam6vYWo:vthLRc/xpEfca7AWo
TLSH
T13FB55A33B2F600A9C44DE1769F4A872196D27C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 80c44e088d12da7d51061c078a17e1a95454db3328f4c45514b4f7305c274791
MD5 e624e5f5d0c7f14542eda014a338c8d4
SHA1 65b1c7acbd464d635bbf18cdd622aff1796c7b18
SHA512 c5e65d82a4719e47c77828f7d9cdf196292ec655d8abdae013547710c692f5586fd5dd669527e23f940858bc830e99713d9535920d066912fc8f72cf65fd5b3c
SSDEEP 98304:Zy5112gYy5azzVvt69nLKnhZipEfca7AWo:0LIHEWhQBaX
TLSH
T193167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 61c7764baf80606cf211a2375ded21ee4262af05a4400a5cdd1cf834005b13bd
MD5 c31179d1520876afee2b891b3fde223a
SHA1 2817f20bd58b5b2181c666394526e13aa79912f0
SHA512 41d0bb306e4fddb58f61207c308712d8d0a10c136f2f2a4dacea91351c62fd6c5cc2d63a9ade221ae55265b8d03c58b8fe23741b527580ed406b7fc94abac4df
SSDEEP 49152:YB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl3pEYgcam6vYWo:yu6Jmdxd2d3pEfca7AWo
TLSH
T1ABD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4e6cd3aa7a23d27220f4af874972790128868a6639962d1316bd148e8b153af7
MD5 0338c360f71c51feb05e95c58a14be1b
SHA1 21096fe1594357301c10411f7944c3760e65c9a0
SHA512 4ab78842b2018e4fc36bc7a4d2df8915afb8e517f6d430ac8e4f571e4497e6516fbd97b37a04ea6be0007b9aebedc3de2ab6b88b0c099278a20937bb5f47060b
SSDEEP 49152:s1hpsNoJpF1A63U44CwH7R4xLpEYgcam6vYWo:smifPWRopEfca7AWo
TLSH
T1B7B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c176d4b5be74e2146502a3811dc934a66f63d5af0e821e46d1050c7a6c0944bc
MD5 a9082ebe8c702bc36245912193ec1202
SHA1 6b6b7e1bd0d35b1aba34d6c8adbc648c50e30df7
SHA512 015dabd7d2634811fb0933f474b7f9c1257332f14883887e038b5ba22bd8a454d629159882f1776d2048a99303691cce8645b114e5a983f8e1105fda6fbdb833
SSDEEP 49152:dSuZQIY0Be2KcRVtOnks6NMHq+pEYgcam6vYWo:z5dKii61+pEfca7AWo
TLSH
T198C5BF03F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 519ba9498749c210041edb145e6123ddd85fa4ee0f16c18b7158b2571adebbf1
MD5 44077b964a5c3927609d9a60a134302c
SHA1 d978cf51a0d890f889710eb6d7bd7eae780e7717
SHA512 b4b84ca36824302d300022b295249041f832145fdfd28bbadfe71066708a1933b8eaa2ebb620457212e0792b0e22ed656b19bf02817448ec83a74cd123dab361
SSDEEP 49152:NhtSn8EApI0fig3giDn0AP5wHpEYgcam6vYWo:cX2imphspEfca7AWo
TLSH
T1AD95BE13F2D900E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 74d2b19086cb4bce9321f0d5b99fa015c6a6ef77ae1665dc9b710278690155da
MD5 396c1a020c03d6824a0899858c8086e8
SHA1 a0d421c5c8e299ea2a3e75989f3878353bf606d3
SHA512 12e575b88fc0857bc2db85cc67cbda9485ef08a282c0bfa3b93699ec17f95a6953969836a074b33339f7ae50f53cd2157b82c46ec1291609eafca0cb79e96efb
SSDEEP 12288:R690GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:R6pINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T16645234868FF51BDD3178371C5D49648E9256DF8E4E28056E0123E3B0EB9EE6CC2DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 cc0c3fa7ed388d6d33456d179f8d15ada14817bd216c188f71f6a785b9912f90
MD5 4f2d5b2f4dc1013666de733911a79ca7
SHA1 de181d7263b1462ea43e20b6c2c51a00c31afba8
SHA512 ae3354d4c8659df11abaf2201f3f095940ed6b51997f1cd1a1ae76ecd90e1328ab48bed44b4246d9d2e4e84c262f4964bcc7f3d9fee2026b9ba933aaaf747a4f
SSDEEP 12288:Td90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:TdpINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T19045234868FB11BDD317837185D49648E9256EF8E4E2C056E0153E3B0EB9EE6CC2DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 eba26ab066a2179f9172831d1883fdd8024aa5c996d0bc9b775d9c3d0dcee561
MD5 19a9c650c05a60fcd18a36bf41a6fd64
SHA1 8df76c3c117808827cec1b59db71433e3a42580f
SHA512 93cf4a023da243fa9d4ce2bd99374394409fc8dc05a2728f6c30a0244033efdd0fa3e4793522b24bca3314bf65d4cbaf9d8c702fa03a6fcaa363979ec07c6245
SSDEEP 12288:sj90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:sjpINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T18945234868FF11BDD3178375C5D49648E9256DF8E4E28056E0123E3B0EB9EE6CC2DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ef221e51951f824a717d124f994807bedc6d32c4b70e332026d61bcd9c228c27
MD5 9eca93e401bdffb7c7fa2ad9f34190b3
SHA1 67812b816d506fdd8fe6f9b48cc8c2d494abb8e5
SHA512 e59ffdbdf394404ed16548dd21bc3fb28320b483f99a4fc9876907139e45589dd7f10298160dc00ae72330530fa699a18bf7b2cf0a8b0cc888d862585ff3c1ab
SSDEEP 12288:YVo90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:TpINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T1634522482AFA11E9D327C334C4E19504E675BDF8D672819BA0112E2B0EB5FE5DC39BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e5b437f046499331796e74d89d6b50b2fb38c0b55f69657512e39bccc2920666
MD5 0b8e3fecf8835aaf4858331347555872
SHA1 1f6153edd01df1b8779611915d78562bddc34dd8
SHA512 9774efa9e80303aed92287ebbf331bae8426a99525de67e0bc1e51628ce5911d689b5c6784e85455d5acb7253fd139491bff05c9e9c62bf9b5d814f51c0552ef
SSDEEP 12288:bw90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:bwpINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T14E45234868FB11BDD3178371C5D49648E9256DF8E4E2C056E0163E3B0EB9EE6CC2DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9a611aa709aee484d48eba0a39d6840d4f94e98a229c88c3eebb352eba3ad7d5
MD5 14da67ba11c8ef3b5de57861cb1198f5
SHA1 c4c8d6327f5c3907cd09bf91a13aeab7ef49d70e
SHA512 11651bf6bbdf4f35a3deabe278e333bb2e7c763160e7dd5e316c020895873512eaa23e6c029e6acd0ba990342006665f1da9858b86bb4d2442cb6e95ae15cc77
SSDEEP 12288:kZ90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:kZpINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T1E045234868FB51BDD3178371C5D49648E9256EF8E4E2C056E0113E3B0EB9EE6CC2DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 22b204772d5d718411c38d7564842a669e55098e019ae3e73e1b21bdc6d7af31
MD5 9411b79255fc60aa76cc178c2b0ae587
SHA1 ef2d013753fd4d04c3ca57ca438d5bf58a9462b3
SHA512 08302a9d17e6387ac753513ce7dad6fcefe95a02d03b7ea96c072ad4b361426e16d17092fe4e326b02e4ff5721ef905ddb13d7295d4b3c50a55d67eea2f1ffe5
SSDEEP 12288:hF90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:hFpINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T15045234868FB11BDD317837185D4D658E9256DF8E4E2C056E0123E3B0EB9EE6CC2DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ee04943f07cd7d327a9905bb74f5ce46229326ac97e6dbbefa070a939c234c22
MD5 c96be6e8670fe6d5ad9607b1eae2c4b0
SHA1 48397192f1ce45efdc83a2dca09fd26fe3f09e46
SHA512 0b9a2e39673063aad8dc3f3534c5ff1e89e4f2b2a8bde1f8d88231faebb31c0d27e1530164114328aa6ca8d2f44e067f8c1e0fcd0a45ca5d75da1b10d4bd1088
SSDEEP 24576:ZZMHzFVSO9pINYrbmeHT0gicsXvwPrHavYWJeqm:ZZMHzfppEYgcam6vYWo
TLSH
T151650194B3E018F8ED67823EC9558906D6B27C6946B0C61F13A4362B1F737A14C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5cc63ad0513da7e488a48b44bf3a10d10b340b7ffeb8f25906657eae1cf90981
MD5 42c3c49ee57db18e3c51e4e32bff7a19
SHA1 0cb04e8642815c2d8de63012be7abb233ac2b47d
SHA512 f937c8f24039c37e326062d33ac5bc740397b437f14cce48cc86946518e1bdafd1b60c4627ae82906787f4669518ef713dd5cd002be5989eea9cd0d5c2f00ba4
SSDEEP 12288:GO90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:GOpINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T1A445234868FB11BDD3178375C1D49648E9256DF8E4E2C056E0163E3B0EB9EE6CC2DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 25fe8a3b306311d95e56a1fb1ca411f7f0d3d572250f01efdb25ba4eb0024841
MD5 f157e2440a5cb38d92dc0978bbfda969
SHA1 0f0ebf12682f8b6af1a7a3c3f01e60f7e215c6e8
SHA512 7863a52cfe90168dffedcdad1daee046ce56d58092f76f734f2e7262ade663aa12d81525c49b626be7b8427e3acd9c1aae3d7cefe50d1905fa77dd77126143bf
SSDEEP 12288:cy90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:cypINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T1AE45234868FB11BDD317837181D49648D9256EF8E4E2C056E0123E3B0EB9EE6CC2DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9890fe92725c82c24367284367d551c068da63ce0f994a3ce34b63f857712815
MD5 51e55c8c1afae94fc39c23dfd3ca7bca
SHA1 82186e703387b6a2c00c86cc25bf493b815ab405
SHA512 afd3599a6b88e60a9b5f4610a03844aab07e0d296f086494fb4bbe49aaea1fcd9aef887c20ed8cc7af4df767b325e52cd340699b91fb3e148ca5d60ff6d04b5a
SSDEEP 24576:NzyRpINYrbmeHT0gicsXvwPrHavYWJeqm:NspEYgcam6vYWo
TLSH
T10255024776E630F9D2278238C8A15A01F7727C7547618AAF5260173B1F37AE19D3EBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6235529f294770d8ae38621149b5b5b030a5f65fabe172505f9c76e8e4b6499a
MD5 b652aa82eb5121f7c0e5b2d2f487a013
SHA1 b5c2305900da4650f18d077eb46be611e88aa725
SHA512 c5f1611b30f81bf9f4dc130fcf1e7717a989bc6f7235b8305187f025dd96e773e88d0149e8fcb13f5ee6dda2b8bdba0856831b725e3821c9441ce62760f712e1
SSDEEP 12288:HO90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:HOpINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T12F45234868FB11BDD3178375C1D49648E9256DF8E4E2C056E0123E3B0EB9EE6CC2DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f94a3ec0e6dd7260f31a61ca2b5d7e1ec379db3310c9588148ba01e75aec7f9d
MD5 e8f0d8ef0ae812ac1b56f88085bc0bc1
SHA1 47b0bcff5e4fe81cb724f05fbcaf8fc612b7a7a4
SHA512 756fdcc05cd7e59b0ffa684433e2b9f92734e59ce073ad35e2cd8fa5d38dcfafccafd9c15670f453576ce1c8008e9f189ff05389948ee20e557ec3c790bec812
SSDEEP 12288:EO90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:EOpINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T14545234868FB11BDD3178375C5D49648E9256DF8E4E2C056E0123E3B0EB9EE6CC2DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 60fedff4e6008b0f72c0dd16891ffb5a0d3509c9c30c122332af0773414e8427
MD5 456506365bcf6a7bc90fb8310cb8c191
SHA1 0377aaf5256f2f09152b0e5e8cc76b75d402c187
SHA512 9a7639f65729ea1d94d93e15d347742f71ba0a6adc1b452b296d2e04e35ba38b32e0c6f64acbecb5c48c8849e8d2694b87736a30bbc4dc9c47dac38bfe654127
SSDEEP 24576:6CU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAPpINYrbmeHT0gicsXvwPrHaO:6CUZPTY+8Wg2lIL8lrIUJLWwwpEYgca4
TLSH
T10E65AE1DA3EC089AD1BB813589518A06EB32782E1B32D6CF2160C73D6F67ED55E39F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 92bd1c46bf76099217be3454dc6e3b8d113acafa0d699294f2646f44b73a2e3d
MD5 c6070e9e2abc8b145e61f793ba6413f9
SHA1 09954549603d4c05467fba32103691533cfe1bc1
SHA512 c276666293dba0b2508594fea8f599b72d80b280063aee467c8c339689a814d428098532235099eb46822d48d42fbec5eff0f4c958df410ff784de03a1fa866d
SSDEEP 12288:hJsf+90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:2+pINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T1AB55F149D2A812E8C16E9275C7958A40F7337C6583E1C3CB52D0F93E0F76A919DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9c175fc8fe97b24d87502e529193f88ae54acc5baaa190fc2dbd53e389bb20b9
MD5 e2cab9a3fdaf6a4f9e134c2f96efea45
SHA1 f22e55ba386d142584d5a00fdf33677bdaae01a6
SHA512 663c6ffc7e985a45482c2f1b06ec62664f6dee8b93d76b10ffe757a6d3501247b39e859001606370f372fbb08fcab4ea48583b532ed424dd26f36284372986c6
SSDEEP 12288:uD90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:uDpINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T1EE45234865EE61A9E33B933084D9D524A6197DF8DB91C0C7F0112B2B0979EE6CC3DBC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c19717e22c736a0fc04e7840ce35bac523daa25a0adad7657aa13d41a23affdb
MD5 d7ca7a524399ba77fcd645a209fdcd65
SHA1 e35aa54932f1eb18af765acf7dba2a4040754caf
SHA512 613c62e8a59017eb53b17e675c5fb6fd0ce884bd81f5c8e1ddc946fa07d39c143188fbcb9b8b6d959cff744589078455cb7f2ec6dbaf041aca0286ede84c719d
SSDEEP 24576:08RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTChpINYrbmeHT0gicsXvwPrHavYWJeqm:9RZwQCyiHiQEaiPnMGpEYgcam6vYWo
TLSH
T1F585BF1E62DC42A5E0BAD278CDA74407E6B27816573197CF1190C27E1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 8a703505b4f2a2d35c454964b73348a0b487e4e405af35b52b0003a7153805d3
MD5 67b29b84d63cca0e181807a46782351f
SHA1 a55d870393cbd0f9fa59272e8c957a34b5b70608
SHA512 d086baeb70acf180d09430f2702eabb6e6b9061fd3041dc154cd588eb143c77e30542b1058ea58060bd786084d8644768ffe52b32fa850b085dc1726ad78b62e
SSDEEP 24576:ebxA1UGTpINYrbmeHT0gicsXvwPrHavYWJeqm:ebxA1U6pEYgcam6vYWo
TLSH
T1CC55022D26ED20F8E276923988D58105D732BC69576183DF6091923F0F3BEE59C3AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b6a8c2ae8dbe6c6df11e7f1146dcc8905515b8aa3b92bcd0762ad44da7249ab3
MD5 9b17315b13991549ecdf4cfd05108c27
SHA1 c07df5f4ddf9d6d238c168f82ae48584d0cc5644
SHA512 45d9ac24ff5ac7ea490986ab4ad206108af0a9361d6d8f4424ef00fe9beb6a58e79279f401e72d7f78d93bd64e2d43d59ae24ed09d4abe061496994b3bc1cd78
SSDEEP 24576:hjsmP0yHaqrVqHra44KDzMsrn4pINYrbmeHT0gicsXvwPrHavYWJeqm:hjRP0yHfVqzlAsrn4pEYgcam6vYWo
TLSH
T1BE45AF2EF2B910F9D4AAD236454107B5FB71782D1F209AC70170C635AF0AEE89E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c64801e455cb400345222905633e205831d1a6babae189924ad04a2c62fd5be8
MD5 2638d6c6b37aeaca61de9527051d0bc3
SHA1 32df15b96afa8a1fb3a2ff8615077b31b0e5fc9f
SHA512 a8f906526001011c98ff7ed41af1f555b5c1d37565dd35a03202c714df7a08bfbb9bf8ca623120e0cc1971ffc725f53df9cbaa783d656b56e65ed42a47f55a13
SSDEEP 12288:L590GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:L5pINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T1F145234864EA51BDD327877584D4D614AA157EF897A280D3E0113A3B0EBDEEBCC3DAC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 90ecb53f8bdc9598571120e7a3df6ee09be04d41662c6f3d3b3f4fb8a62ac35c
MD5 783df35e859d098afd3306c8e9f71cd2
SHA1 18efa3ccfb931deabf22b2b6bf5bb1b78b117297
SHA512 1a560da9ac11c007b810f55bc41c872e195c3faceb5b57dd40653d8c3ca47fab895ab00f248621275f27e4235e26ae328882bb066cc01f746948b1770cd23cf0
SSDEEP 24576:SBLBUTHpINYrbmeHT0gicsXvwPrHavYWJeqm:SBLBUrpEYgcam6vYWo
TLSH
T15975F144F6E500F9E967C23CC9A68516E672789D0364E7DF03684B261F637E28E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ac3b4f4f89908ee7ee998801827e094681ffb7e1d9f39f69dde6a7de6a7295f9
MD5 534ea69dd4679e3bb512be2b1f3f1d29
SHA1 ebc8c42569f5ff1dca6ff4f208a5bc7a2222133a
SHA512 a90217bb51dc56dcb0f64b6efeb3febc79e41b34ae17c2152065a5e926b56c6801e653f6e18a8d242dd65a8b63fe35008b9a71b54482b6448384a2b69451c5c2
SSDEEP 24576:zDYNH8pINYrbmeHT0gicsXvwPrHavYWJeqm:zDYt8pEYgcam6vYWo
TLSH
T18665F21E66ED18E5D63B917DCAC28609F67278A6175192CF00B0827E0F17EE9BC3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bf87c99c0a394eafb14564b886de143d91fb703135d71adf820a4c45646c1672
MD5 5dd1ee98e479b773d3fa923b33fcd812
SHA1 5f80f1a96c2723509b25a9c8d077735aa0163158
SHA512 7966cf325cbe0fddcae1d0329d19f35ec2c8e1e71033bb036142ed75119a074d0377e6d18928ab2b9e0dd49522e52e25e2ae0f7ef838133a5480675f74971c06
SSDEEP 24576:3nXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKZ:3nXoJJYH84VVS6AmEOJas+cHBjSSKHPJ
TLSH
T1C365BE9DA2BC04E8D5BBD17DC5C24506F5B278651331C6CF022182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a42ccbcf0e773989177b66b4213f4c9d4740650c9a6f1a6a64b7b3d865391ecf
MD5 28a9bfc340ada2e40f8eab31f61eb502
SHA1 d60527f1eb985f169a2cd65907edc0db363a3b6e
SHA512 3ea6a18ba57331554d902d29aa00c5aec446c3027f35e40eda49ca8808729c3d2a7de4b5f169dcfa6807e53fe0b64faa99eddac43ac9118ebac956e6972e527e
SSDEEP 24576:Vv7Xbxd9Tuycf8M/TYlSuxrr2PCCpINYrbmeHT0gicsXvwPrHavYWJeqm:VDLL9TuJ0M/TYj2PZpEYgcam6vYWo
TLSH
T142858D5EA2EC42D8E07BD6BD85B79146FAB2B895173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 1e1bfb42cd0af4d5cdf1a3a228130ed1f0349a39a9e2dc8c3cc48b647bedb587
MD5 0f693b630b2d5b83f242481104ce34d5
SHA1 66d2948ab31063f2f13785cecc5391758ce0b8b3
SHA512 7337f841db08b895896d5e75032ac7eaf3ac4e00f2429cbce04fd32ede716e026dbe4923f29930848f3ba9cf35229889f191d7f37a90ae714f0f892b767c9b1b
SSDEEP 24576:negJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wHpINYrbmeHT0gicsXvwPrHavYWJe5:nngOJOmPOHzHpEYgcam6vYWo
TLSH
T18E55BF2FA7BC15D5E03FC17D8A968916F6B1782603259ACF0160827E5F1BEE46E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 380f64f4b045bd2bce966032625e562d259edbcaef9ee9b694768f97ffd433e1
MD5 e225d721d837c184e3b7e42d39d356fb
SHA1 c6092d2e95cc7e22f3bdb95c01e43391c1e1e5d2
SHA512 47f2cff1973f09146c1dcbceb5035797bf6a99826bbbfdb85fbd0ed02cb3317b8201fbf78c88abb5e9bdfa1b7f55af4f2528285383a420a3de53980c6fe23ba9
SSDEEP 24576:FLJnJiTk3R3waE4JrOZpINYrbmeHT0gicsXvwPrHavYWJeqm:FLJnJK8R304lopEYgcam6vYWo
TLSH
T1DC75D02CD2E810E8D477C2B4815A5656FF31387C2B2269CB68B4D5353F12FE0AA79F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 436a3841d02bdea05926469cb7c685cba34d0739538824bd984ee8e0355c8ff5
MD5 f526716cf90cb55718ba0943dd114935
SHA1 07ea1aebc1d73676aa016fc39b5fbb5dadfe9ac4
SHA512 3d25820aeb6021caba7fcc355dfb16e9c1593be4f6149743fd72eaf69882b14a63f1ea31fc7d8cb288976d3e69ce7160d44e3efd5a0141c096303dc77222acb3
SSDEEP 49152:m9mqCzDScAZmlvTcFg8Ph6FpEYgcam6vYWo:ocpEfca7AWo
TLSH
T180955D05F7EB5298E8B3CAF1C96294159B327C509B34F7DF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 aeb40639a4a93c58d4e9e23f630c426c820d146ce4d9ae0155454b4f57a6b832
MD5 db5c35b0bb5065c3dad3422b5b31594c
SHA1 a8866798e10b9b6d9ee7d6992a64cf9663cb3999
SHA512 38ec7f6b01df25e83e0e01cd67d0e13c5c70ef4ce6a4b9153c08df324f9fd1f55645f5d3de194f993ea2656fa884b3ff77280ee76aa570f38b6b97192483c607
SSDEEP 24576:NlYJeXm5jUuEXpINYrbmeHT0gicsXvwPrHavYWJeqm:NlYJeXmRUuEXpEYgcam6vYWo
TLSH
T17355124C35ED30F9E22B827985D18A04E371B4B5535293EF90A0963B4F6AEE65D3DF80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 2e5ce61cb360079bac2981cf972b83eafaad605cb28df0d942de5573d126a893
MD5 0cbd5e5e6763f4a6f1fc53d270c48a38
SHA1 e23032385f36aae47ffe8d7b85f07dbe79e33474
SHA512 5f0811eb2c13525809af55e8dc3a0bcfba7e0203f181a2ad0567bc5b77c030f45a9cc93d86663945d6ed45bd30e0b35ae0bd1725c13729c855dc48c0bbdbfa27
SSDEEP 24576:0NtyYpINYrbmeHT0gicsXvwPrHavYWJeqm:0NtNpEYgcam6vYWo
TLSH
T1DE55120822E960E8E77A4738C9A28154DE35BC709B2182DF9090BB3F1E76FD59C34F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 284ff0b4a4e38cdc9317ffa6ac2d2a87b69781f64911752294e30f5b22a5fc61
MD5 75d290075a20efdabd5e19de0f78bae9
SHA1 1ae50c97e63a11d7853d940300b957801bf5d7b2
SHA512 9c5be32ae88d79afed33a1357bec65b25243414bc2f6d395be2dbb60cc8d604a24e02ccd563c41f48fa31493819e11d8644166a7d6d9db47ee9e180b86ed80e9
SSDEEP 12288:yPH90GO0ghNY1lbmeHTj4gaBH8uCMYgvwPrHrMKTWzdUIKIPwLWsoeqmT:+HpINYrbmeHT0gicsXvwPrHavYWJeqm
TLSH
T13045234C25FA21BDD317837480D49604E5257DF496A180ABA0A17A3B4FBDEE6CC3DEC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9e9bc1676d0355c4ac20141bfd970b5d0c023be85ecbd8029a492e8702756276
MD5 bf8b816102fccc9acc0121d3783c88fa
SHA1 9e4d07a9dd916156201dcf99737b31435186b7e1
SHA512 5a2957589f4dc592716789df058191a8ee97844392ba41aaefe10c3d8a3c5ef5dfba57160bde983a7bbac3739ec0e4389eddbec5b01569e648889254f7c3786c
SSDEEP 24576:qC+TyQIu93VAumZr7jmepINYrbmeHT0gicsXvwPrHavYWJeqm:q/TfIq+YepEYgcam6vYWo
TLSH
T129558D1DA7F919CAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 680b962c37fa657902965a248dbb4b4bda77e8c8f21acdbff6b55ff6f7da70b1
MD5 a0157384a1a8caf74e7336b682949ad2
SHA1 ae0fe64d26deac2dba0bfaef23366bb1ae4f190e
SHA512 ee2b7a2f3f4a1b90f8f5ae0d42ab096f7d0f71eb516c50fd3fb46c5b097b6a8a0933ce8a5fca34e519ccf414c26530e64b6289254bcf4b69d8945079756ce875
SSDEEP 24576:3LQikZbpINYrbmeHT0gicsXvwPrHavYWJeqm:7QikBpEYgcam6vYWo
TLSH
T12E65F10EB6BE10A5D167C23C88858115F67374745752A3DF51A0C73E0FABAEABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a5f815d2a5506afcd65edee00e2d825f44a6b3be5fbe229b63917ad402823215
MD5 e10e72508d98f3f82d78fe828b42eacf
SHA1 41f8b3132d765b5fb0697ff62ac3cbd1ba6a62b5
SHA512 b13c846264ac4ad52fe7c5f37465c4d5d641e32c73406a81b7950649db8a8a3825f60cb3e9baa6a21ceb6ef52e7ae2632f6774ab9f4dd2b972ee88a77a9f140c
SSDEEP 49152:tpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPYpEYgcam6U:upC7b4+80GTktpEfca7AWo
TLSH
T164A57B3DE2F810ADD9AAC37585461665EE71382E3F2015DB00B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 471c56673bf1ccb04787a6e9f8e1c28fa4d964dec0972845471f24ba35983658
MD5 0673d93a3576105f112a8d494c91a91a
SHA1 f48d9e6f60069396b086a39282e37310ea17d419
SHA512 acd743cf97102e8740b31fa397be02216c960e230ff54da2fc162c420ee8d307af3217898692188b01b7ca17655269a4fb06db3d29852963c7f56fabf6b5de11
SSDEEP 24576:GSAwJPE1IDAo+4Kt+l4413JUQQpINYrbmeHT0gicsXvwPrHavYWJeqm:GqPCIo4Kol4vQQpEYgcam6vYWo
TLSH
T11B55B019A7F956F5E17AC7B4D663C601FB7278221331A3CF9290853E0E169E89E39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 527bfcda9c4729eec985f5805f845c03d25d1a569b9bf8ee996a169c567674e3
MD5 aa05a9e46c24e2946fac6095b87a9343
SHA1 2580862f6231874bf26dfe02bb42eb68a366305b
SHA512 0d0e1fe64f7dd2247cb7f96e2c2cb09957ab57b658202a195e1dee4ee659adf5636e569e4873b244feee0c4ea6378ed17fb409a87a52a8727064f16173b73ab3
SSDEEP 24576:/yLXPLcq94tgpINYrbmeHT0gicsXvwPrHavYWJeqm:/y7PodtgpEYgcam6vYWo
TLSH
T1D775E02DD6AD04F4E57AC27CC6A38506F67238AD033166CB15A0917A1F6BEF4A93DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 c003e8167b100a1aa97cf5a6725a7f863e3c57764ede1c7e5b18d8aec6b1884e
MD5 11bfd5d60b8381aea8e5250c1050d1e9
SHA1 b6d8e8504abb5d3b4a888dcf26af3b9637251f32
SHA512 017262b578a3de9598f77b1b0a27c0220ddf026f16bce7733f3641186e83e6697d98050583773bd7b2fb62c2de0b8957ca1d35baf332c9603dfa825cc0228299
SSDEEP 24576:oWv8qjpLpINYrbmeHT0gicsXvwPrHavYWJeqm:oWv8IpEYgcam6vYWo
TLSH
T16B65124D66E820E8E23A8334C5A682259571BCB513A595FFB0D4EA3B0F35ED1D83EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/444-76-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/444-80-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/444-70-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/444-91-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/908-150-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/908-144-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/908-278-0x0000000140000000-0x0000000140138000-memory.dmp

Download

memory/1012-305-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1432-160-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1432-154-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1432-279-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1632-48-0x0000000000A70000-0x0000000000AD0000-memory.dmp

Download

memory/1632-105-0x0000000000A70000-0x0000000000AD0000-memory.dmp

Download

memory/1632-39-0x0000000000A70000-0x0000000000AD0000-memory.dmp

Download

memory/1632-106-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1632-38-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1788-129-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1788-123-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1788-260-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1844-182-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1844-176-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1844-281-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/2468-171-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2468-280-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2468-165-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2544-114-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2544-108-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2544-304-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/2556-226-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2556-220-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2556-300-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2584-500-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2584-299-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2584-216-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2584-210-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2888-456-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2888-454-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2888-139-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2888-261-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3176-34-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3176-27-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3176-453-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/3176-30-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/3252-301-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3252-236-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3252-230-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3268-512-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-516-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-503-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-504-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-502-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-507-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-511-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-506-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-508-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-514-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-510-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-509-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-513-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-505-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-517-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3268-515-0x00000201A6CF0000-0x00000201A6D00000-memory.dmp

Download

memory/3296-298-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3296-200-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3296-206-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3312-501-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3312-302-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3312-262-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3312-307-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3312-241-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3312-247-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3312-282-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3608-50-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3608-56-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3608-257-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3616-60-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3616-66-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3616-306-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4276-13-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4276-22-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4276-21-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4276-437-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/4332-259-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/4332-89-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4332-83-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4464-95-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4464-258-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/4464-101-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4608-8-0x0000000140000000-0x00000001401D0000-memory.dmp

Download

memory/4608-457-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4608-303-0x0000000140000000-0x00000001401D0000-memory.dmp

Download

memory/4608-0-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4608-460-0x0000000140000000-0x00000001401D0000-memory.dmp

Download

memory/4608-9-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5080-198-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5080-196-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/5080-193-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/5080-187-0x0000000000670000-0x00000000006D0000-memory.dmp

Download