7782a5045d9d08fea53be59786502a83c51da5894344b144db5cc7173fc14fe0

Analysis

max time kernel
148s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 855KB
Sample260530-2gp3vset7w
SHA256 7782a5045d9d08fea53be59786502a83c51da5894344b144db5cc7173fc14fe0
MD5 e24d9f6eca1d5d5d300bfd9db5576099
SHA1 3837acf6d72586f266d63f1357e180626b86e607
SHA512 eed4c0f22f2eb47bee430f16984e7774f6d321eae29aa3ca3ffe22822d4736fc2a6e056f739281e7ed4db5adb70400b6c80999b4a3f01a8c30b68250b2748c60
SSDEEP 24576:WryfWe/ZrmiSAzABB6196yB2w0f1uqKxx/RMPe:Wryee/ZrmiSBM1AbbKH/RM
TLSH
T1F01512A3E19830F5E427CA79C5604556BB32AC70166A5B8B4B107B6F8F336D1DE29F20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4276	alg.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
1456	fxssvc.exe
1100	elevation_service.exe
4956	elevation_service.exe
2648	maintenanceservice.exe
1932	msdtc.exe
3636	OSE.EXE
2088	PerceptionSimulationService.exe
1176	perfhost.exe
656	locator.exe
4284	SensorDataService.exe
1172	snmptrap.exe
2360	spectrum.exe
4944	ssh-agent.exe
4744	TieringEngineService.exe
1196	AgentService.exe
744	vds.exe
3656	vssvc.exe
3668	wbengine.exe
4688	WmiApSrv.exe
4140	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\89d26d3ffc4568d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180031\javaw.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180031\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048b0406584f0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2192	DiagnosticsHub.StandardCollector.Service.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
2192	DiagnosticsHub.StandardCollector.Service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4608	2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	1456	fxssvc.exe
Token: SeRestorePrivilege	4744	TieringEngineService.exe
Token: SeManageVolumePrivilege	4744	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1196	AgentService.exe
Token: SeBackupPrivilege	3656	vssvc.exe
Token: SeRestorePrivilege	3656	vssvc.exe
Token: SeAuditPrivilege	3656	vssvc.exe
Token: SeBackupPrivilege	3668	wbengine.exe
Token: SeRestorePrivilege	3668	wbengine.exe
Token: SeSecurityPrivilege	3668	wbengine.exe
Token: 33	4140	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4140	SearchIndexer.exe
Token: SeDebugPrivilege	2192	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1100	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4940	4140	SearchIndexer.exe	105
PID 4140 wrote to memory of 948	4140	SearchIndexer.exe	106
PID 4140 wrote to memory of 228	4140	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_e24d9f6eca1d5d5d300bfd9db5576099_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1296

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4956

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2648

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1932

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3636

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2088

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1176

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4284

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1172

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4944

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:744

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4940
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2820 2812 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:948
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2828 2808 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 052dd0532e3c4285f16145c95d155d596c9a3d75297e0f5e1c24ecd2d8a95af0
MD5 3d0ed369f1906c73efa9a1ab6e8cfebe
SHA1 afd8697cf00e44b11421d6723fc8954c6e6ec7a3
SHA512 0b1e4381a7b49dcddcfa7f9fe14b969128d8680fa2707353d61569582a8de1c5f8e92d022830a306ada0148b8d6ae93f44d4e5cc3f356684356180433ae412f9
SSDEEP 49152:Ib+632BuPkFKRrdE6ohrstBhuXjfS4LWxnC1AbbKH/RM:i3q60jBrAbKJ
TLSH
T1EFD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 417b658a2da64990bec0c1b8ac08c201fb945f93823fbc4b159612a54cee7052
MD5 2a5ee01ecdca33239688572795f05da9
SHA1 2bce5f136ca31874df397ddc13327c344b740523
SHA512 2dd6f56ba6c5d2e540f2ef539504bf5328707b8b24a9205c90f2a960a073520889d3657c3993d026dbf75b9eda50dd0ba158937f81a78dd19d9d771a231dfb8c
SSDEEP 12288:51XLsswWkxy2lRq2czAlOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:XXYfDtczAl196yB2w0f1uqKxx/RMPe
TLSH
T14505F129B7D508F9EC67813DCCA28515FA3378454360E6CB03A4AA2A5F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e81dda65c3cdf68bf3f591a92a562e472ef1011e78d3ff2fa741caeb9c61fb88
MD5 a9075ac6439a4b0e5a8ce877ad21be6d
SHA1 0244d13f6db598d951339c1269d1f812e7e36846
SHA512 825b8130d83e8a531f67f6bd6e7a5a1701d445e9779b1979d02c0a3816632ac5fc37319c2acafe949ff8b1c8716f2832fd4744a210b4f22071319659b7eb1f88
SSDEEP 24576:f0Le5ji0hmxNrM6196yB2w0f1uqKxx/RMPe:fPji0A7H1AbbKH/RM
TLSH
T17D359E16F6748331D073C0B9C5D2A69EED72308657308ACB4286D77C6E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 69c885edb3358639c680c0d8839314d59c09c603d8dc23e71cb76ec75ee266a4
MD5 8aec4747b333569ef48df5dab65b4c06
SHA1 34261d17dced85cd7723073ace2e2221115b1495
SHA512 87dd99e45098d904edcc22584dbdd381076dae5c0720967f09c5f9162ecc89868e891a0b01e57541a14dbb58db86c448d35dba55f7dd7c08e52d2d660ba69a25
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWr6q8wyuY196yB2w0f1uqKxx/RMPe:A/ezSC6vUzPviHjyj1AbbKH/RM
TLSH
T11F755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8e53321a2d12e2edbe114edc99206720255147f1a84627c2d0c54c83c1439cb7
MD5 ab4db21c6bbc8d5d7c8a0426854eb69d
SHA1 570c5cd492269da6ad80d5832b5be146142fdcaa
SHA512 de436f2e836cabcca8b3605977c89d9a31667b28212d12f1481cd0faecb6fcf315108e11907e244105442117116f8c3ddc2eec1aeed898df3a68d26a14fe2ced
SSDEEP 24576:TVbqPb88hv/l+bZ196yB2w0f1uqKxx/RMPe:TVO88hXl+N1AbbKH/RM
TLSH
T1BE559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 47dd18d6362aa542093d834b185f95de57ae12c8676db4c2d48c929e008d1017
MD5 40c78bb668b1891e23551c6e0d1bad96
SHA1 f2f2a5a92cae26b23243c321b4a3bf9bb005d946
SHA512 af9ef690fb62e323b7ab2da2f63d7c2279969344281bbe80ee9a59cde8289f7543b2755d77bfe581431379935609765ee9dbd59e9169a7af14d4d194926f3c46
SSDEEP 12288:TjOOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:TjO196yB2w0f1uqKxx/RMPe
TLSH
T192C4238BBA4694D6F1479832E97929B97F166E4C2040A8C32B24FB2FC873724D38D751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 1a3893bb712ae47de0e6785ca5a8210289827f0f146dd86c16186f7a33f69c64
MD5 9ad7bb38e8c7c83df447589da7ea5864
SHA1 b3d634c804694ebe45ea2804c42ab6e8f2cfad62
SHA512 67c699acdf89fdec2d864e0fb925dcbb39741a06bc19f2f8821578fc909b64503e8889286f9f9078f2bf2cafb9d35c0219282369661d05f113babab98884f0dd
SSDEEP 12288:yeBNUbTVO86UxOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:yJIUx196yB2w0f1uqKxx/RMPe
TLSH
T1D105CF7BEE28FCD2C27A8D795A918640E76278304B51A3CBD264C20EDE236E05E79D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 88ee370cd5627e44890c95e7e307deae3d1d41c4625b3111e57092f2f2b52cb3
MD5 f125680c33f9f4389cdeace36811c074
SHA1 10eccb6f0cc8f99311d21c934543784c1eceaa08
SHA512 84b1d1307774215c5889dfd1e528ca904fab1817f90e8bf228b7aef3c350e79e3ccef73e9d2ccef678693b78bcb86e6f168aeda6757c50b4397001579a8adeab
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH0:AQvGAdlCEL8c/RRNw5C6AbKJ
TLSH
T112267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 ae39ed12da5c4f5ac1317b059943ca5e905e1ff2b3a3ef1c2092d700449d64ec
MD5 c4ab8d6021a1756026a137ed516b7bab
SHA1 a00012e1e83c8fe2d6e6ef8f9fb6acc9be011aa4
SHA512 a683366d1e151589c0f0d891358532e71c817dccab4698e2c47053458ce4c52d90238e9f227f5109e2d22cd10132f18e7327b23d83646f151313977776f6970d
SSDEEP 12288:iAwSfxL/2Dc3DDLLmt0LDQewsAjXOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMW:nSewsAjX196yB2w0f1uqKxx/RMPe
TLSH
T17F15E031FE75E036D27B0DB21B36D716282D7A204B5119C3E3A89E9E59702D2237AF17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 634e7826aa7caae543f05916ae1b859a1a29148b14b9be98ca4e23f77da8543d
MD5 891ab8ca7d4a142e85deecb11623bc98
SHA1 b3819d947fbc03981b84022ac7846aee52c22735
SHA512 441547064f5710466ee990f136899152aee177e732278855eeb0058e16c3c509013cd898bde1dffb749963ca768607cf2e969323b66ecd5c7f742852cb49b545
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHtNJ:ZUEtQevvqc2W1cpV2RI32tL
TLSH
T1D3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 08078126e1bb16dbd4343bd27d438311baece667236d2cc551b03f5eeb9496a3
MD5 fd83945b110aa31b7d313e17ab110c2a
SHA1 425ec0d86087721a8b1845ab69558d0afcccde3a
SHA512 63a547c74cdb2d1db9bd466874650fc48fdce2729697573b051d6388e967c728eb2d9ef4bb3be65aeb59cd6bcedab576cfbac9ef39c3087a358ef32138b88821
SSDEEP 49152:qCbRquA/m2yL5zLfFiV+XenmE3/z31AbbKH/RM:foq2VjnmGAbKJ
TLSH
T164D58D0A76B8C1E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33BE58A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 21e0765f31925c7e2d3ae9fbd8351b6553942d10a4bf2b0e2ca3797a1b60cfb0
MD5 22b461ccacafa524f31ffe43ce995734
SHA1 e754cae0da58837538194edca470a89517fb73ac
SHA512 9108b40bdbfb67c2b0d43507cc0767ec59c6190318a14cc94bcacbee59b4d5f2e3a74cf2b94873c90d1a864ee494900efcd8b405e771043664cc9d50923fd081
SSDEEP 24576:nAhGL2IFoiwtA5l7S53E196yB2w0f1uqKxx/RMPe:nAM1Foiq501AbbKH/RM
TLSH
T17A35AE81E7F955D4F5B3AA7899B69170EA76BCA95E31C20F2260D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 95b802e1d946c05fd584bb261e573f9012a86357870ee932d1fd501f1dce0556
MD5 9785c85abc1a9bec35bb5e8e67935282
SHA1 938b05b522b31a6ffcbee87949d2d0e108c0eb6e
SHA512 318310846f47e0c36436d391ee5253c1e519bf972b2b8ff2ba01b2935c03d4379a6419641ed7c95fb19d328bda2ea9c1e6f721f120594ed5cc0f9aa536c21481
SSDEEP 12288:umw5HEjsChNSBFgl0WDm+C4OIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:nwuXOWD196yB2w0f1uqKxx/RMPe
TLSH
T1C505F14A76A50CF9F9A78139C5978536FBB2BC052621DB1F1760C61B5F33321AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 f438556429b40603a4b20c15ba14d014006e5d11cd2e2ec577550ffe7a11949a
MD5 ec5e58123ba0546631bd7b76906cf109
SHA1 6e3519dde28f70af2767f445c18b06040e21733c
SHA512 d7a3046930669dde40521c84d9f2bec692a292602bc8085a560e113e943e02bf0b035d3b247c6bba81f199149f31496f726aa48d6dbf465826fbaff4adf59032
SSDEEP 12288:Q/Z1IynOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:UZuS196yB2w0f1uqKxx/RMPe
TLSH
T1B8E4128B339560FAF1938139D9E51A59FB22784A233183CF1724A62E5F33BD15E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e040c6d58f007c16ed29ffd93558a2e441975d1c4ec54680dae72fe910dfc547
MD5 f08caf6a5b0db85ecf2fec53a1ae5c04
SHA1 e3de7b851ba25535e800f26c6754c374b9e2b7b2
SHA512 6ae0fab80e8c8b8a7996495fc1712ab0ac501f16a8049ba07d3813cc6bc04e52895a75a95cc5c1b99581ce55a4d4fd33bd096c33d4371d56b26c5feb60da9f11
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uo:5QRQyi36YOcPhLvw2gAf+PN3vAbKJ
TLSH
T1C8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6a35ed8a2f2c22a9cfda0dcaebc784c32634382fbd66457e5ff68aff73f26e8f
MD5 e08d1e99f5a0748c6565d54a68a68119
SHA1 35d5759ad337224c9e1316fb40649c4c693bfa3e
SHA512 58302512763edd04b089791f649254fce1886bc587278b854c7436bb73c6558850e35298632fa4613ebed637342c47f4b130a2cc438f69d30cb79bd3d6db1309
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uo:VQRQyi36YOcPhLvw2gAf+PN3vAbKJ
TLSH
T13F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f4f13c188ac46b065a0879d8b7f200978b78ebed1efd6b6027e533209af694aa
MD5 a440a3fda20b0ad65d5be4919a36b557
SHA1 853b3d60b407397d8f37b3ce81dab74229be341c
SHA512 661c7c28692172754260134c3d208ff11bc8df940b47a26c242d363bde02bde8844c279a30f40348246aa1816be3d661eb47feb9b177f3e8f2497632181b9c4a
SSDEEP 24576:FwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0C196yB2w0f1uqKb:h68Qg55nhceWu7PNU3/H1AbbKH/RM
TLSH
T11BB55A33B2F20099D44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dec5cd3fe69579519e2c6ed04375b8c1a8538a024a4dc532906ffc8da4f488ff
MD5 03bb2ebe9f09f91a0cf64004d08fb4d5
SHA1 c71bd68c2af576c3049ced439f4df6b728e05637
SHA512 97b7e0d85629da7610b1cd1ccf3e3099b3652e9804674157b0fd7abf303f22f142ed6ddaf0fae7388cb44578d565657aa06b9c8b93d4e59e8cf1748d038c2e1f
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99W:Qy5112gYy5azzVva69nLKnhZEAbKJ
TLSH
T1FC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6db992c81bc9fb347c554272c153df26702ec0eddc0e83bda04809b597646ab7
MD5 417540fbbf1ef111dc93e805f66061dd
SHA1 4ec3a7ad18f19170ccbde661af99076f4658b60c
SHA512 07aec442bf2ede995571be772b9b179979466ee4f94d0d3092f381a4fd7d675a8331ae8cad28d9b67b668e69b57cdfc02a26816f7ac771b6026fd4db40638cef
SSDEEP 49152:HB+taZ3usBWOBr4tEG20bqx0z+n217aau1glV1AbbKH/RM:Ju6JmUxd2dnAbKJ
TLSH
T1EAD59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 90e74b608327a7f3316c910707dbd8afd2bc634367173009cbd674f9a83e7374
MD5 efb7d501a3c134601fad4ac1c7e7aaa3
SHA1 8844cad0f99a382bc7e81a400a583653ec668440
SHA512 d7da2200dfbc54475b7dce22aa05d2925ced944a21c6d5b64a75f42dd48feb0e5d80d8c0b1b2b76bb65d04e5516c5c35ec64f4cfd346c173676af965612ac752
SSDEEP 49152:f1hpsNoJpF1A6BU44CwH7R4xR1AbbKH/RM:fmifPkRGAbKJ
TLSH
T107B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 df2ee4efaf1cb32f34fa268d842431cb8c74a1d3a5321358a4ae7684c1fcaa39
MD5 566b052d24f1f55367f90dcc7bd38fdc
SHA1 8429370151de947419bdac1c413b37cdfb7b4c02
SHA512 b2291df9b7a80bd1ce77630121dfef1347c6389cd7c86f325b6d9ab851d42a88f097007bdb2352699a3dc8452049737b619cc05322ac9b58634a1a676dde3766
SSDEEP 49152:ZSuZQIY0Be2KNRVtOnks6NMHqS1AbbKH/RM:35dKvi614AbKJ
TLSH
T1FDC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f93e2c7511a16ac88f973cd173ee9a84491edb6f3358d113161cb25acc104ee6
MD5 b28b73f6b219e07e6431cb994dce1f7f
SHA1 74ceac16da200809dfe8824a9b22e686f001d565
SHA512 cff535fca332c00283c4f94975fde9a497489f062980c7af96536c29b554b45928ed6580acea145cb1c5dfc01913c3f1032aaf91c08e01b3a017a580a56a7f9b
SSDEEP 49152:1htSn8EApI0figXgiDn0AP5wl1AbbKH/RM:EX2iyphiAbKJ
TLSH
T11795BE13F2D900E8D05ED178C7568632EA62BC150B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 931f11f25a12647fcc54c4fe48855df9b25eabd2a5ef727ec899103a6a551e9e
MD5 f7ac8153f29dded9f7d2c683966a2ef4
SHA1 219816037da851544877361be8b3773998618e09
SHA512 be283783a98fad6c2cc542ddc18cc6e6385777d13026c36e13dd733c0656e61611f48204aee84b8c09c0ca1935bc2dc88dfe9324cb8ec304ba9fef6af6ce9351
SSDEEP 12288:MGOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:MG196yB2w0f1uqKxx/RMPe
TLSH
T1A1C4238FB94785D6F043C872D97925B9BA1A2E8D710164C33B28F62FC973B24538DB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 0b9f961eba17f2f16897ce145839eda7e2e03162ec0e938ae778902363360ab6
MD5 bdd480ed6961653978984d2c7d7501ea
SHA1 8bc2e7d85e1a5b8eed20b3abf209afd3839d468d
SHA512 b0d841a827383b5bcc9901ee23eff18b4ef79e63ad6a97d25bf24ba2c3bca9ba8f07b9dc3d0e2d6ab7eb54fb69a13fe19b878889e2cbc911b01e9a5e88300691
SSDEEP 12288:bLOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:bL196yB2w0f1uqKxx/RMPe
TLSH
T17CC4238FB94785D6F003D872D96925B8BE192E8D710164C33B28F62FD9B3B24538DB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 49f11898a0d9671b0c471e5441e1667992069c683027226539adf517b808082e
MD5 d363537f3b9a58492a93e06a4b28b7c0
SHA1 267121d87627d3e7ffcb8a3fa08b19e53cee4307
SHA512 55a0b7a11981089feb86b24c2b3be37a61212e50011ef177013e6a175ad309a55691a7bc5808c3e751ae0c7a8605120283aa4076177fbaeffffb702c4d6c7ffd
SSDEEP 12288:RJOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:RJ196yB2w0f1uqKxx/RMPe
TLSH
T1A5C4238FB94784D6F0438876D96925B8BE192E8D710164C33B28F62FD973B24538DB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3dbc29d26eaa43a6e015ba7fc10b26dcbf0605c8e709afb1cc6f759daee49bda
MD5 17439487d748d8fe302006dc32e2171e
SHA1 dfcf57fdcec87ffd8266eee5b91bf28f94544406
SHA512 02a391af577890c806ed6b0a49be4f9811e3e0f1466bc3f624e120a14781324caf55ad9665a5f649aa9d06300e21c82272cfe5db53a5197dd637f73e00362de0
SSDEEP 12288:AVkOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:B196yB2w0f1uqKxx/RMPe
TLSH
T1CCD4238BBB8B40D2F043D536C97615B8FB267D8C6221A6CF2B10BA1F8D73754A25CB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7aa7d36adf61ee48bcfd20aee280321b1cd70ee63c13df07a183cb6ceb618075
MD5 25f59cc9a3d35530824d9fe5736d5a6f
SHA1 83927ccc74c95ec991d82d05bbd6a87138bf6e90
SHA512 bea3afa4b88652c6f1ec30f4ade8c3b925d97079c4f6d47b53765564c1a27cdea07073bb3cab701c16f0c559a3597238ec21af12680ae51b58cc24003721b2c0
SSDEEP 12288:GMOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:GM196yB2w0f1uqKxx/RMPe
TLSH
T156C4238FB94784D6F043C872D96925B8BE1A2E8D710164C73B28F62FC973B24538DB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 5b5c2395ec7f31e5dea3792403967d24ec1834d4f295e70fd8955a9ce426c601
MD5 1e0ce8ab531da4f12fc01e3537153811
SHA1 d390c3b774531f8703e943a516d352a93027a4cb
SHA512 66e3bf4577e6d787289126d6be5d750140d909f81e182722616969aed6d637d0c15b9a837c363cd140b96e3ce57bb8b4baf4d3885df0d453207da6011c6687c1
SSDEEP 12288:YPOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:YP196yB2w0f1uqKxx/RMPe
TLSH
T1FFC4238FBA4785D7F003D872D96925B8BA192E8D710160C73B28F62FD973B24538DB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 2e88f0913763da0d0228447f2606a9957c0b9cd90dc3eabfb6cc47731d1878d4
MD5 07c85ecdf767e5bb808ac17ce6b05b33
SHA1 52f2b65af0e90b3fda4682fdd6c0a820c03e58d3
SHA512 ce81f95e0d1b8b31e5dd42efcce78f121b4584a67b27da07574fe86c81fb6a9ec8c6819bd01da79c5314affa52c65eece4ebdb81866b87df41bd92ddb169bb58
SSDEEP 12288:QzOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:Qz196yB2w0f1uqKxx/RMPe
TLSH
T166C4238FF94785D6F0038872D96925B8BE192E8D7151A4C33B28F62FD9B3724538DB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1afea5ab1c474064411b3e24e54f10025c340bad15570e47f71b41642a1f7900
MD5 2c0891e396f9e7da49fd5b28a9d91fda
SHA1 38d873dd9a7f8681e4e24d077c22bc777b6f5a35
SHA512 f72105b4adcfcfe782a148b9d034dab55fe94ebfa7f9a30e6606571755dbb661b38edba28f07a4f4aa99527f28c7ebe4331a25bf2574acad19692fa9701b9f77
SSDEEP 12288:3iZwbczzFEoS2cPvyrOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:yZMMzFVSOr196yB2w0f1uqKxx/RMPe
TLSH
T13705029AB39018F8EC63813ECD658916E6B27C5A0760C65F13B4362B5F333A11D2EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 29cfd14543c13978a23d8c19bf3a63eadba9a4ce1dc49a1ca4efb977e2b50ec8
MD5 6d705a12a96c54d125e6b6db2db562fa
SHA1 8e13f825d9611b2faeedd386b56ad23ac0daac68
SHA512 55c4ca039989cf2a21ae71929afbadec27279c64053cf656ed4c51830ab1f57ddf522077ea79fd3b079194962d79d6c6e64ce5cea133b8ff99467a064056f5df
SSDEEP 12288:diOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:di196yB2w0f1uqKxx/RMPe
TLSH
T1CBC4238FB94784D6F0438876D96925B8BE192E8D7101A4C33B28F62FD973B24538DB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 9d600cb07f25d3f12121821315312fe489db70a7e387fc983f9c94a3bfdb57d2
MD5 94275e02eaca51443162567696e40b5d
SHA1 6cad6c0d3dfa456237c627caa870bbcacd88c3f6
SHA512 5febcb08749a51fe68870aaedfe705787f8c4a41347d189c2fec84e99d57ba57b88a962e8a2c23b5acd90abea6f3b51f89c1667ac5d5954a7ae68d52f7319829
SSDEEP 12288:oeOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:oe196yB2w0f1uqKxx/RMPe
TLSH
T1DFC4238FB94785D6F0038876D96925B8BF196E8D7101A0C33B28F62FD973B24538DB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 0e3653bcb0a4decff59e197550df44d88f9a6cdfc2487f3c77afdf0b7694e3e0
MD5 17b6e53dc0f1a229134ad28ff6a7e823
SHA1 be0991efdd573ea2a962c1a52b43190bd6841dde
SHA512 bc7b7bdd650ad84416afc43e76ebd97c2798a0887dc56ec60328814ac9737afc299aadd092b1b267aeaf093d82802102ed3333a15cfeb94512124b55be1be80c
SSDEEP 12288:oyPz5L8nOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:pzyn196yB2w0f1uqKxx/RMPe
TLSH
T19FF4124B779230F9E0678139C8A21A55F736783613209AEF1764573B5E337A09E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 fd40190640f574ebca45b2723e2703843b5b51b764942f0f72932ccec15da969
MD5 a8039b61c4f2276639716f52528013aa
SHA1 47f12cf9a638844b643e691b535e0ef2f890db3d
SHA512 35bd33a2ee43f1f88b2d3911eef30a192fb5786bbde42f82db06b1a46af334bdba6a2c441bf2e27d525ff8d3c2997dd45607815b301a90e9b3e8f7ac5cc9a4f7
SSDEEP 12288:HiOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:Hi196yB2w0f1uqKxx/RMPe
TLSH
T125C4238FF94784D6F0438876D96925B8BE192E8D7101A4C33B28F62FD973B24538DB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 8fff9347cce816d2ff127f8d96c4d733bd45b60b5da51daa2d94704fd8d76c59
MD5 90a98119ded3a972800e7bced3e43fd5
SHA1 fca7e04cd52be42d6a1ba2734e1bb1db06341d4a
SHA512 d9f2098c2dedc7f8a0462c486e898e526b2b6b14a950359ac56816850db6a5fb98c66c6b044ba99ab0f8c9dc48ebca8138edf3dc920d07b4e7d18d4a75d508d5
SSDEEP 12288:oiOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:oi196yB2w0f1uqKxx/RMPe
TLSH
T1DDC4238FF94784D6F0438876D96925B8BE192E8D7101A4C33B28F62FD973B24538DB94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 efa39ac2eade7381124df164a2d075982cfd2ed1da769a092db234169ac46945
MD5 d1bdaf66744da4ca8acb3b7daad0d382
SHA1 480e17cbcd48a4850c1c465a55c9c97f0b102569
SHA512 a7e2f47d1c4546a8e1a129e25d98e96367955d5629578c28d4b4a24741a6c53a648ae49bc06a7ce4bf12e9c6aa716be25e2967220a9c4ce1a78a07906c9b3d60
SSDEEP 12288:VyPz5L8nOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:8zyn196yB2w0f1uqKxx/RMPe
TLSH
T113F4124B779230F9E0278139C8A21A55F736783613209AEF1764573B5E337A09E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 08b17501fb5a48310344e6a0520657562a71e1ff7465647e752675190c4e9ae5
MD5 53c12fbbc1e9b3939feab76528dd69d3
SHA1 630146a717baf60e7180dc2de418b67e6777b33f
SHA512 ee785be09df99325a2953c332275f7d1fe2e0c8c02e8c5b8619df81dd6e83185bf3d5df42f9eef36163dafa22ef84f733f5e6c86c1dc1e5982a0891520820bc2
SSDEEP 24576:jCUMpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAN196yB2w0f1uqKxx/RMPe:jCUEPTY+8Wg2lIL8lrIUJLWwM1AbbKHK
TLSH
T12965AE1EA3DC0896D0BB81358A518A16FB32782E1B22D6CF2160C73D6F67ED55E39F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 2a545a35d39de48db36f13a4b697e0aa88c68bb55f4ddf2e4d248eb469ac4263
MD5 4f84aa8c61369539d731255bf417d5a7
SHA1 d635d5b75bb5dbcd247fd24510bda80b26968053
SHA512 34a7e91b0387067b7806ee00e79d59054b1e624527132a047d03cf8c373c457882c61001568eb57822b748e9667bd71b1e3d94815bb5239f7d0bc0ab79a093a6
SSDEEP 12288:0GsfSOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:sS196yB2w0f1uqKxx/RMPe
TLSH
T1F9E4F14AE28841E9E05FA135CB565A51B7233C5993E1D3CB27D0F53E0F726909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 74ff6c768c2a77b6f2deb658336824e0397cf0415f06bbc9a6766679687de7db
MD5 51e22bc078142e2faeb41fa4894eab71
SHA1 b32159b00e0361417625d73a8c3c79e7c37dfa45
SHA512 2f9827ff5c216f7fc1e31147e71fac7e0cb968370e75d42395331257c55c1e84c4cd1958dde96cc8b03c5b63cf57f0d667499aa9d8ac8545c7c7fb0ce503925a
SSDEEP 12288:1pOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:1p196yB2w0f1uqKxx/RMPe
TLSH
T123D4239BF74A8896F0679931987D51787B0E7E4C2300A4C33B14B62FD873B909BACB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 badbf6ff23034d139abfd6cd62a182f5bf0272a5aec2523a3fa9abe5b3627513
MD5 faf827f1c19c2a42d183e82195f19f2a
SHA1 a1728c189306ce79ba0b25ef568b8209bc0d2a01
SHA512 21fe29694820d42ff4ac0299a91d5628144e78478482cfa3fc746243652a1615abd76130a973ff40d11c833c4370ebb3bf1780229c4a4f4736eb541a623e79a1
SSDEEP 24576:l8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC3196yB2w0f1uqKxx/RMPe:6RZwQCyiHiQEaaPnMa1AbbKH/RM
TLSH
T13A85BF1E62DC46A5F0BAD278CDA74407E6B27816573197CF0290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 bcdf70f22d60e122b2b3c8cdca38f07a2cf1413acbeb530b3d26fa8c6f9b6225
MD5 1b29d8ed84784fd16c5b0f22631e8ade
SHA1 8fd5e81fc26a42c89bde6e668cb64b229043eff9
SHA512 905c21a5b7123c777bde444a61eb7ab46f01981a3cff3f5ce12e572cfc03e387c34d563d56c8b835ca6f00bcee5b6c004ec5c972fd950b2410b7b605a904f780
SSDEEP 12288:ZbxA1U7K5OIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:ZbxA1UG5196yB2w0f1uqKxx/RMPe
TLSH
T1F5E4016F669D14E5F067953A89A68105E7327C1A2321A3DF2290D23E4F33FE45D39F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c980f0dd242f66fc140643ebee0c46ca9c86857034d2fec46a83e20d44008c41
MD5 e5f4d225c67a25ec3422e179090bbc4a
SHA1 7f21d589baf8e0ae3d95d067e6d94f151424446c
SHA512 4e5228db0a3c67943c3ac4b731a247f8e59575b234b22447612415de404f8c67086c2476095fec32ee90564b3db4b05dc0692c7ec70c63a971f71d6bc2d0a077
SSDEEP 24576:GjsmP0yHaqrVqHra44KDzMsrn0196yB2w0f1uqKxx/RMPe:GjRP0yHfVqzlAsrn01AbbKH/RM
TLSH
T1C245AF2EF2B910F9D4AAD136454107B5BB71782D1F209AC70170C639AF06EE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 55d124a4b24b97a5e5e7be12ba3adece3dbfd7054e191a4ba1b5a22f46f88dd7
MD5 12741859f43d1d8c117ddc68b97b1db4
SHA1 2e544da00c1402bac703626d627848e9dc008bc9
SHA512 6b9cbb45cfeba802188dc088c6f61fbdb6aa531822202b29309912ef342c2563ed7bc83206648664640f509956e2a21fea8e791760a215ed887df3e3fbdf23e5
SSDEEP 12288:SvOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:Sv196yB2w0f1uqKxx/RMPe
TLSH
T140D4238FBA4784D6F0438976D96915B87B093E4C231165C33B28F62FC973BA553ADB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 523d79e8cf48f847ce3234f27d32217dd9084d44e2d992bf4d212fc052b849ec
MD5 1cdb5b1505e7a5c252e12cc9fdf458de
SHA1 dc1338099c08fe899ff172b8b0057ab9ea4b9593
SHA512 ac660ecadbfdb1e496fba31cb979fb379f2ab238e576ccffec6d78045be3d298eea9bf69c187a7a6a0db3d7fa807fea8f5e1b1516a8cf5eae1619d078b199df6
SSDEEP 12288:ZObvA4LWO+vAYFTlOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:OrLBUTl196yB2w0f1uqKxx/RMPe
TLSH
T16025F15AF79500F9E867C13CC9668926E672785D0364E7DF03688B6A1F237E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 74a0598af4fe9f47cec904e8202f454824f02ad4af62bf97cf111a3be21c7094
MD5 1a9e9d231d4c16e973100c34412cca20
SHA1 810f72b52b724e197630221116147b0e98edbc63
SHA512 a95acc25b36ed7be917aff928dfac17feb9de62fdc02920df632590f88892911e5b37a3bad0a699410fdedfad36aa00fdd0c3be73300dc6ce6afa90823d7d63f
SSDEEP 12288:x70VmuIYNvUyBp2OIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:u2YNHA196yB2w0f1uqKxx/RMPe
TLSH
T15405F11FA69D08E5E57B9179CAC28219F6727856131192CF05B0C27E1E23FE8BD3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b591f96da3d87214623d4bf4c47802daf00dab8fa1a6bdd6376d409a44974c12
MD5 c8d29a135ec8d019c4536b923992085c
SHA1 ca54773778f26fbcf468c2aee5b68cc46baed225
SHA512 5f0a2c69f8fe2da8abaaded2487821601ff5d7677f752c8056d0cbb0129381de7fd5daae823100071a82ad677d0bab58052b965f8efb8115c843f215d4e18466
SSDEEP 24576:QnXoJjNYH84VVSNAApoEOQ66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKj:QnXoJJYH84VVS6AmERJas+cHBjSSKHPy
TLSH
T10C65BFAEA2BC04E8D5BBD17DC5C24506F5B278651331C6CF022182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 92b4ce308c5d20f7c7217127686c3b2ea9aa322e0e60b4942a650251f1730dec
MD5 747643fc13dabd8dc8f1ed37389f01e8
SHA1 073bf59fbddbffe2af22aa021f43e9335815f8d7
SHA512 2c7a31729f99c2d1f6dad1a87ac1752bc87d517129b68e47c217b963b58b4137c47f348ae357997856965482fee157096be21ab4d7f2c914bf9e921a433b5564
SSDEEP 24576:1v7Xbxd9Tuycf8M/TYlSuxwr2PCu196yB2w0f1uqKxx/RMPe:1DLL9TuJ0M/TYW2PP1AbbKH/RM
TLSH
T174858D5EA3EC42D8E07BDABD85B79046FAB2B855173081CF1251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 21e06406decfc1cddeb396e8030671efbb7ba72abf1ab9735dcfffc53c73702d
MD5 0ecb7cd8d5120e65a8d7384c83483eec
SHA1 bbbb6afc16bbd1eedc5193eae8ba79656d543de7
SHA512 f017a1f41ff8cb5573a6cff049c725079e8ba427807a9631e770012605a44e9b8fc2bf6d6f58056dad9df32869390af0486e22376c8b0d7e25adfd3527011446
SSDEEP 24576:JegJgpwJOmPOHWAKR8ZguIGyPsxr5Vin10wl196yB2w0f1uqKxx/RMPe:JngOJOmPOHcl1AbbKH/RM
TLSH
T1E055BF2FB7BC15D5E03FC17D8A968916F6B1782613255ACF0560827E5F2BEE42E39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 e3e3c38155d98cf97bba629489795c3925963e5e7d2d8694dd8390e9a53e2619
MD5 a2c20570516dbe538da3749e70e33311
SHA1 bd9a33765030c32b5f22c8627bce0b1e588129fc
SHA512 66792e3f44848c6ccd3471fa6d511cdb9a36c3d158ee837aa6ee7cfd75f0bfc81089bd3834c4c89a29d7a6df16f24c406bdf8114f1828baf1d989cd180fe0e3d
SSDEEP 24576:eLJnJiTk3R3waE4JrOP196yB2w0f1uqKxx/RMPe:eLJnJK8R304lk1AbbKH/RM
TLSH
T19315E13DD2A910E8E4B7C2B4815A1756FF31346C2B2169CB29B4D5353F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b5f61627b658223207b1b0c4c680612c5bcc863f7053e2a37d99e50e8c39daa7
MD5 5d3354bdb54b61918dc73b2582e5918c
SHA1 3f12b29e201d784a8199ec7a5e55f7b06d6a334b
SHA512 d399dbf292bc2e341ccf9e098e197b9fa6bdd1fe02076b083c23bc5200f83b68a156d32f97e219da8b185d3f9a6ae14588fc64ed27bdab28ae3b552a88505fe6
SSDEEP 49152:+9GqCzDScAZmlvTcFg8Ph6z1AbbKH/RM:QSAbKJ
TLSH
T138954C05F7EB5298E8B3CAF1C96694159B327C409734F7EF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 b3664a205a7adff885b1bc2226a8d7bd90319bbeffff51620399fb98b129a9b4
MD5 262721b7a06c9c91a484b8878dde3fe0
SHA1 3814e27521af8d8eb5738e9704baf9f1453a3a15
SHA512 632a8892147221850465491c124e85302f18efb1242006d511618f08c828d348a3323e83177d03ea1e5721c0d0a5f1490ef830c237eb8174265e437ec8c7ca20
SSDEEP 12288:AlYJeXm5nkEUuE1OIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:AlYJeXm5jUuE1196yB2w0f1uqKxx/RMW
TLSH
T18CE4129E769D60E5F01B8079D9A24564F332B465230167EF16A0D23E8E73BE52E3DF80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 d7cf31b663dd30cbabd5d00ec493c9d9cd0615fbe048a42a756e203f4bca9d9c
MD5 9b7ec2e7b7a6ef2db2d19060d9584195
SHA1 85ecbcbde58a6db0d5072c7e9b1443989b4ff790
SHA512 41d6515fb855f3eb3a96c1d04f96424b79a02add12cb7ac867861dc64a20b58fa850eb8f524cc3d0ef2650f3574bd427509c80701c960ebc3e52cee2fd8be39f
SSDEEP 12288:twu6kyUOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:tVtyU196yB2w0f1uqKxx/RMPe
TLSH
T151F4124A738590E5F1A74938DA7241A4BF39BC14571092DF26A0F73F9E33BD0AA78B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 75e04baf9838d1683c92c132e3e4aedeeb65dc6b983e7d202b319bce8afd8210
MD5 7cead6ba4e0213552a28928a56819ea0
SHA1 6b0dd623e867f970a5d1e70ca27f04e7e63ad6be
SHA512 5b3087a1ede23d54f0ff9f60ca1eb187979e6becf3617acb0d92bedf77964ecb16d56ede12d9a946a6c1b3200f24dbaac966a249bdf71cc65b5e57985a87053e
SSDEEP 12288:xPlOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:ll196yB2w0f1uqKxx/RMPe
TLSH
T109D4238FB64694E6F0038875D93915B47A1A3E5C231064EB2BA4F63FCE7379192ADF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6b7edd286ce324e47b416fed9c355fdb2de987f14299de6b4a344cb0e3c4778a
MD5 0cf48f2e11d49ce91389cfdb13a1dc5f
SHA1 41ccf1afb16952ef1dfd5ecf44e0022880ac21c8
SHA512 e61c31509527532d6cf337fad99621f69aa2ed97eb1c8d483a5313c1708994a7d12609c06756341d85b34e782243b8adb381d8a11086c37963c37f906723406e
SSDEEP 24576:XC+TyQIu93VAumZr7jmy196yB2w0f1uqKxx/RMPe:X/TfIq+Yy1AbbKH/RM
TLSH
T1B0558C1DA7E91DCAE276C575C8A34493EA33B872136196CF2044C07D499EFE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 d710c86d3a9d72935112eb8b21173fc2d544fee8b4ff7d1d70afaabce3963c57
MD5 6dcdfdae6ca96c10d93be30c1439260a
SHA1 679e7f46f19d8494f7958bcdfd459f8530c930b5
SHA512 53c5bdea0d078ddaeb9a9d9f66c4acdbae457abee7d1dbc9c29b0310810bbaa3179331c6deb8204989a5bd6980043379ad1a53d1f4e270a02ce76d97429d4b1e
SSDEEP 12288:CcyrWOstaa3kcshOIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:zLQikZh196yB2w0f1uqKxx/RMPe
TLSH
T1D7F4F00FB7AA00A6E0A7C13CC8954156FA737464531263DF16A0C77E4BA76E9BE38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 5c64c7bbf6cf13bbb45b14a1302ea02b427ceeccd2128a502ca21314ae2009f6
MD5 801758cc4cedb64e120170079dc5d574
SHA1 d8b35e0cd6a1d565d060efb46aa16a3bcb63e155
SHA512 a27dfaf51cd29f35c6ab57b795753741fbd810240c22f5a63b828c8ec3975d5124eef768edc6c203d6d40631a6d9150cc034b1cb1e421aabea75c4f0b8e29a3a
SSDEEP 49152:bpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPU1AbbKH/RM:wpC7b4+80GTkJAbKJ
TLSH
T129A57C3DE2B810ADD8AAC775C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3542758e6d7a485a1560f0d89d0d39487a8555d4744c4fc0ddfd0c3413299cdc
MD5 2ecd11039b69ec635424a36bed14bf3c
SHA1 5196bc2b6f1851c28077da9c95729c462f9038f1
SHA512 5098bc810f9145f82998f26bcebd5741afb5ef33a4ec47fc29b2f3e8abf988812872c9d3ccd1d0744e2a1ea67c7450b79c505e0a250ef547b27242f27986c022
SSDEEP 24576:QSAwJPE1IDAo+4Kt+l4413AUQs196yB2w0f1uqKxx/RMPe:QqPCIo4Kol4KQs1AbbKH/RM
TLSH
T1F255B02AB7F946E5E17ACBB4D663C511FB723822133163CF5290913E0E16AE85E79F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 2ec20d173b4006a97037b870838ef1ead6007e6b75e974ffd97cf71daeba6841
MD5 680f4961f2d1c76d4b90252c0fad7a31
SHA1 52f42b869f036d0ba289749ce2f87e15fffefea5
SHA512 a5dc6072620184de25d176035fd0dfb83ed83889e2d2c3a9efc374f1d9af50c4cdcd6f2c5d4e3b36aeb56d180749589e126250d51e67756a691f7646bd114558
SSDEEP 24576:xyLXPLcE94t8196yB2w0f1uqKxx/RMPe:xy7PoTt81AbbKH/RM
TLSH
T1DF25E03EE66D04E5E47AC17CD6A38906F672389D033166CB1AA0917A1F67FE4693DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 ed6ce7c77c19a6babbe452c114409d5a44ed58e830c318da083e388d0bb9c282
MD5 ad74ef0c2b1d0ab3e55af902a1eb962f
SHA1 42017f52f55b9f8bf113ff9488424e35aca4b5ef
SHA512 c68d467f8b1c24061368f04245113b8c02a97839ae31364b031da30b8208161abe650f5bdfce9b634b2af7339afd81945af5b835e74f6ed62376b017f9b533f3
SSDEEP 12288:w9lyvj3IkxjbBzROIrtQfQ96yaAN228c0fzJuqKhTLILj0/3BMPe:wWv8qjpR196yB2w0f1uqKxx/RMPe
TLSH
T1DBF4124F669464D9F02B8634D9364175A5327C7A2324A9EF36D8E53F8B32BD0923EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/656-172-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/656-114-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/744-374-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/744-160-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/948-454-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-445-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-463-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-464-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-425-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-424-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-423-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-427-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-460-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-428-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-462-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-426-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-438-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-437-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-436-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-435-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-434-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-433-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-432-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-431-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-430-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-461-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-429-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-459-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-441-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-458-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-442-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-456-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-455-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-453-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-452-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-451-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-450-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-449-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-448-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-447-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-446-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-457-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-444-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/948-443-0x0000017391F40000-0x0000017391F50000-memory.dmp

Download

memory/1100-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1100-39-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1100-33-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1100-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1172-231-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/1172-121-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/1176-109-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/1176-166-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1176-101-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/1176-107-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1196-157-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1196-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1456-74-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1456-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1932-71-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1932-153-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2088-163-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2088-88-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2088-87-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2088-94-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2192-17-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2192-113-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2192-27-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2192-18-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/2360-125-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2360-132-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2360-342-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2360-130-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2648-55-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2648-68-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2648-64-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2648-61-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2648-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3636-82-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3636-84-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3636-76-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3636-159-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3656-419-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3656-164-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3668-420-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3668-168-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4140-183-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4140-422-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4140-176-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4140-177-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4140-193-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4140-209-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4140-225-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4276-98-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4276-15-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4284-418-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4284-118-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4284-175-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4608-9-0x0000000003550000-0x00000000035B0000-memory.dmp

Download

memory/4608-375-0x0000000003550000-0x00000000035B0000-memory.dmp

Download

memory/4608-70-0x0000000140000000-0x00000001400DB000-memory.dmp

Download

memory/4608-378-0x0000000140000000-0x00000001400DB000-memory.dmp

Download

memory/4608-8-0x0000000140000000-0x00000001400DB000-memory.dmp

Download

memory/4608-0-0x0000000003550000-0x00000000035B0000-memory.dmp

Download

memory/4688-173-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/4688-421-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/4744-373-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4744-150-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4944-147-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4944-143-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4944-371-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4956-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4956-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4956-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4956-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download