dc3548f31d8340e5e6689996e799f0b55f6fa700fc9a2650815982137115f664

Analysis

max time kernel
150s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_a2ac3ca1f7804c2b5f9c4e226c93ba63_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 2.9MB
Sample260604-rec1eagy9p
SHA256 dc3548f31d8340e5e6689996e799f0b55f6fa700fc9a2650815982137115f664
MD5 a2ac3ca1f7804c2b5f9c4e226c93ba63
SHA1 ce06cf71eba29b02788b36b903180690fec3bf81
SHA512 80ef3f806a5f94ea0bda35878f6c395878189fd122448ed914fa89ae95209b0e2ca82c5a699e0a39c9e74f3586d2110ab5ca4182845a62b70a266214d5beb8f1
SSDEEP 49152:GFv/Fgg8tv0LNT3uLa2hcA8VVsB9Gj1G1Dv81qP5jAxjVTt:+8tv01i5jE/
TLSH
T13AE59D03F3E951E8F1BBD2B4D7655232A972BC564B34A9DF028076251E72EE05B3C722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2156	alg.exe
2456	DiagnosticsHub.StandardCollector.Service.exe
3044	fxssvc.exe
4008	elevation_service.exe
4984	elevation_service.exe
4528	maintenanceservice.exe
1532	msdtc.exe
1436	OSE.EXE
5004	PerceptionSimulationService.exe
4780	perfhost.exe
1136	locator.exe
3700	SensorDataService.exe
4608	snmptrap.exe
2624	spectrum.exe
4860	ssh-agent.exe
1544	TieringEngineService.exe
2468	AgentService.exe
2888	vds.exe
2476	vssvc.exe
1008	wbengine.exe
4204	WmiApSrv.exe
4588	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-04_a2ac3ca1f7804c2b5f9c4e226c93ba63_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_a2ac3ca1f7804c2b5f9c4e226c93ba63_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_a2ac3ca1f7804c2b5f9c4e226c93ba63_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c069f5b1fe8d2f74.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-04_a2ac3ca1f7804c2b5f9c4e226c93ba63_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_a2ac3ca1f7804c2b5f9c4e226c93ba63_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_a2ac3ca1f7804c2b5f9c4e226c93ba63_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_a2ac3ca1f7804c2b5f9c4e226c93ba63_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-04_a2ac3ca1f7804c2b5f9c4e226c93ba63_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ef64e8c2bf4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007631858a2bf4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b403198b2bf4dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3e9de8b2bf4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2456	DiagnosticsHub.StandardCollector.Service.exe
2456	DiagnosticsHub.StandardCollector.Service.exe
2456	DiagnosticsHub.StandardCollector.Service.exe
2456	DiagnosticsHub.StandardCollector.Service.exe
2456	DiagnosticsHub.StandardCollector.Service.exe
2456	DiagnosticsHub.StandardCollector.Service.exe
4008	elevation_service.exe
4008	elevation_service.exe
4008	elevation_service.exe
4008	elevation_service.exe
4008	elevation_service.exe
4008	elevation_service.exe
4008	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4780	2026-06-04_a2ac3ca1f7804c2b5f9c4e226c93ba63_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	3044	fxssvc.exe
Token: SeDebugPrivilege	2456	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4008	elevation_service.exe
Token: SeRestorePrivilege	1544	TieringEngineService.exe
Token: SeManageVolumePrivilege	1544	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2468	AgentService.exe
Token: SeBackupPrivilege	2476	vssvc.exe
Token: SeRestorePrivilege	2476	vssvc.exe
Token: SeAuditPrivilege	2476	vssvc.exe
Token: SeBackupPrivilege	1008	wbengine.exe
Token: SeRestorePrivilege	1008	wbengine.exe
Token: SeSecurityPrivilege	1008	wbengine.exe
Token: 33	4588	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4588	SearchIndexer.exe
Token: SeDebugPrivilege	4008	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 2700	4588	SearchIndexer.exe	109
PID 4588 wrote to memory of 3764	4588	SearchIndexer.exe	110
PID 4588 wrote to memory of 2252	4588	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_a2ac3ca1f7804c2b5f9c4e226c93ba63_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_a2ac3ca1f7804c2b5f9c4e226c93ba63_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2156

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3428

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4984

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1532

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1436

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5004

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4780

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3700

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4608

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2624

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4860

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2888

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1008

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2700
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2716 2848 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3764
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2840 2792 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9d7dedf25c17e7d31b173758d12bde42bd7064c64880f197b1941eacc76c6193
MD5 29415a2d757c7155999188647843590d
SHA1 ec87a2cbe0d64968e918cbaae69e6417ddb738a8
SHA512 8b0b91dcc85b52eb6656339de441b4f6dbfdd19fe0e92b3a04165fdfa888050cdfa46a5f7b4df7fa5d8bc5b0f516c80742f1839b185b9c321752c28969366827
SSDEEP 49152:tb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnJ1Dv81qP5jAxjVTt:z3q6mjBI01i5jE/
TLSH
T1FDD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 c23f6538cb42821f750a197dd1f63ae9097b01cdb9f38fb41201176816d59db7
MD5 c87b56a90d67e91270d7009d8af763ae
SHA1 caf9300a29ab90f76e0f845ae4afcfe4666eefeb
SHA512 28837a927fd940c4453e96dafa548d2f946c4f753f64e05cfdfd94d5555a054e66f0e5321c3609dffe06ffdf5de224b016784793e821bd29856a5b298dffd1b9
SSDEEP 12288:t1XLsswWkxy2lRq2czAamLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:DXYfDtczAa1Dv8q+qP5jnAxjVN1hzM
TLSH
T1EA85012877A409F9EC778279C8A1C512EA33786547A4F78B03E489251F337D46E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 235e84a74f036a277a4c0010774f8b2774d71447eba2dd5dc25f43ad60ac8dbb
MD5 c557840abbd7b172ce9d0394286bfab0
SHA1 08896930bca695c426131f167e41a97940983c79
SHA512 823f3adef5c74651051845ed4ff1a8b24ecaa6cce9a7042321d42fbcd552b4b4bb293e79831eb26819c75ccd8c9eef2d737a650cf7090f2d50183fb3178c6bb9
SSDEEP 24576:a0Le5ji0hmxyrMI1Dv8q+qP5jnAxjVN1hzM:aPji0AIF1Dv81qP5jAxjVTt
TLSH
T108959E16F6788735D073C0B9C5D2A69AED71308657308ACB4286C77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 819eb66c44cdfd27eaf629725d303b838bc3d92bdc50aae9cc1b52b59e4b3a2e
MD5 e666a171defbf782568d3b0a2162ce19
SHA1 46fc510e803a07893b65b9e4447bb3bcd09839de
SHA512 18c1ce0c4508e36a84f709c2ae5d15e28886611d630980154d9f9538f66cf28878305f392ece2e790704fdd1df315cd69464e81db25870405bc912f0213a9d14
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWj6q8wyu61Dv8q+qP5jnAxjVN1hzM:Z/ezSC6vUzPv+HjyR1Dv81qP5jAxjVTt
TLSH
T1D5755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9a49c53e2f50838ac23460d3cec40062885b8e6b0f4afb0d97b8ac252116b697
MD5 4508285f0b2951f52201a1dcbc745523
SHA1 f0bbcd4bd8d7676c3de1dc0d83aa1d323e6d1feb
SHA512 c6280f1634937b2f33eb855674e68b440fc98c35691a91f1a1aa575dcd2b2d344da5a8a17f0f44857aa134bbfa953872f29f9c4faed852a7599075cb3417a2b4
SSDEEP 24576:vVbqPb88hv/l+BL1Dv8q+qP5jnAxjVN1hzM:vVO88hXl+l1Dv81qP5jAxjVTt
TLSH
T19A559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 d19d92eb447ba53b794c933a6a4036608835d759a4470d234773554c6d6c3128
MD5 4823e4a53c2d3d4050dcff1bc4450feb
SHA1 1eb649ab241ac8250d7c8327dbca25212ce2af72
SHA512 4ed680150704fee77a1e61fd3099bce8f84a7b1acb09b6b62ce6d52d76a7903f0fcf37cb61e2ec21d29a126c6a2ebdf1f3fc6cde584ee1e2f1a0a6a4b0a81d10
SSDEEP 12288:fFMmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:fFM1Dv8q+qP5jnAxjVN1hzM
TLSH
T108652312AF1C4D1BE6B75AB3C0ECF8562C187EB954DBAE03C7D0950514BA7A0FA07927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 f5ba3e3cf77e338eb77558b016d0c0e122249223a04523ee06d2f81ebc870858
MD5 bd003b786ffb93e4739b15e5c6a9ca4e
SHA1 9c14da58dfb5b2d166ef841c14cc23382076a69d
SHA512 4321adfcca339512b97725cccc7fb146a5826a59d929ba30f88c4d15dd3e3b079ad446bf53df646a828d2071ddb55a46188825352e594423b482f7749eeaebd1
SSDEEP 12288:reBNUbTVO86UjmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:rJIUj1Dv8q+qP5jnAxjVN1hzM
TLSH
T1CD85C03BEE28FCD2C27A5DB95691C600977278714F62A3CBD164C20EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0bf4cd4cddb4fbdef09ba2877fc21a62af2b55e69d00948f7cec27aa097f6517
MD5 0408eb866aa4274232c093941caeddff
SHA1 d37f581a1716270189e5a87a2056eab9d10ffb96
SHA512 129e9d47fc2a202aecb3b5c40934f2bbc396b156d552fc23e3062d343b8ee2cd38ff0eede7b2c4287ec09cd9c7fcee23d3bf883a8c0c969ad035d8a9dda231ba
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THE:gQvGAdlCEL8c/WRNw5CM01i5jE/
TLSH
T14D266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 094a5652bddc7e900c84d1ab6c20254f082ba083b19084b968e9d4e1c5f0fb02
MD5 03327cdab929992f5a9b69e1c828c192
SHA1 aa2a76a68acb5a3cde8ba4cd0c9989bf691111b4
SHA512 f3019f4eb72df17710425c3e0bcf98fbe853b5716e0eedc4040c7f7f23a1fb7dfd03761d59f7714bb2983be19f68ccbc29a1c5ae7ce3d0bc0033e62cc3822c91
SSDEEP 12288:PAwSfxL/2Dc3jDLLmt0LDQewsAj1mLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBv:YOewsAj11Dv8q+qP5jnAxjVN1hzM
TLSH
T11F85E031FF34D436C2BB0DB21B29D716182D79604BA21AC3E3E88E8D59742D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3c60097dbfa18f3b8cee744de845ded0328a134f64093e2e5d26deda13799757
MD5 11eb30011130ef78a6019aed6f5e5fe0
SHA1 8a5d088c86ce2fbef7167b6e4cc8ce7d573b1dea
SHA512 21a5d3603252bb3e57fdbe4fc8b92a6e54c6f353e3a912bbb10e6d33aab596155b3059ec6f6535ffb5e43295f61a5437901ba251ac28619b325c76361fd68b84
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHP0c5:HUEtQevvqc2W1cpV20I32s
TLSH
T14F474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 38d3f0c4e95a02879b28ee350cb43043c02e5cb7bfcb4645c32694367123db44
MD5 326677389c740c652607866e956c4566
SHA1 f063745d1ff90065d91706c6078ec4cc2bfb20eb
SHA512 7f95f57ff7ce7a387e5e8b6940e86e373fd9fec318fc71a6926d18bb6c8230c44af4dfe4fd1db341e3fd5bed6e84f815ee62ad2f9fca9558c43467ff6a86b4e4
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zV1Dv81qP5jAxjVTt:LoqtVjnmY01i5jE/
TLSH
T11FD58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b7edc2274b17c62ae742d72fb9052861f09573159f3a51f781de2d77c2214289
MD5 97189fb6d4be5bae8f59f0e5b9350d89
SHA1 d380bd628b4621c1110a2e2723c2e4509092f410
SHA512 a276a2de5aa1784a9a97712a15b16de69eee72ce38b972b6cc22b17ae4db1b5661f7a7e421e1de46c670da63f9fc1dff81122adf4bf95abb4027b9e68fe1e101
SSDEEP 24576:uAhGL6IFoiwtA5l7S53W1Dv8q+qP5jnAxjVN1hzM:uAM5Foiq5m1Dv81qP5jAxjVTt
TLSH
T100359D81EBF945D4F5B3AAB899B69571E976BCAA5E31C20F2150C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 c8d6bde3068e33d79b1cadf95a1a0dbec7f66e9fd1bd8ad81e56f4c3c69feb2c
MD5 205f337f5b68bce90ba08bd12d2b7526
SHA1 f9cd7c30162f263614bbed2918922fd796a7b332
SHA512 af5afcebf50fa5fc73aa63b363ef0933ea32cd6b7c0dea083aa7bf241dbd4c6fec74cfa81169cb552d63954d043de658a3e26a96304c72b5d7b22a7f88449d1d
SSDEEP 12288:tmw5HEjsChNLBFgl0WDm+CamLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:IwuGOWx1Dv8q+qP5jnAxjVN1hzM
TLSH
T19D75F14677A80CF9E5778235C597C536F7B2B8122A65DB0B07A0C60B5F37361BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 8200a3b86c529ecec20c73f94b56ed1cd625951cc0565a2e91d32fc7e858c329
MD5 6c8ced2933572572aec06233d4c2741a
SHA1 02c47c431c3191192bc50953d1c88f7cf164baf8
SHA512 f615d52c01954bc2d6c81f313a7f8d07b2393b8cd10fc2a61f7095c0a7b5f0793aac7d4fdaa392f8770522f27944707a5ba8bd290f25b29993e0506f1b09f313
SSDEEP 12288:e/Z1IylmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:KZuA1Dv8q+qP5jnAxjVN1hzM
TLSH
T1BC651246376814FAE1B35275C8F89905A731747627B693CF16A082061F73BD1AE3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d70dcaf0c0305b055b9023af37319979a13fa90c5f59c10d1a53cffdbf12f702
MD5 d8a361b267550c89b87c9327719a402a
SHA1 d5fb643a4817927182ffe2f396d983063317659c
SHA512 7d939b13449820e813330308f8a20bf4317d4069f82fd93dd6b153bd754336fc8df6bc98ad706b8086345ebe62bc855043dbf1ca40b029a02db922928da22edf
SSDEEP 98304:jQRQyi36YOcPDLvw2gAf+PN3901i5jE/:yQyiKanX+PNN0c5
TLSH
T11C666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 af5d939735df4a7c42baeb5a521aa85e967fa6c84eaa8e9bb514b5e0bc82c361
MD5 1f9e9b9b45a7c29cf26c5366529d8133
SHA1 40b040ed9aad0c65af73407ffeb0a022ab7dc3f3
SHA512 8f78e053cb411739275177fd8d072655e003f2a9cfc70145c498f1bc92c3978a91186d5c4d31fa18be5a2d4c819f600084c5500d2ab94c8b6b7ac37b0aaa62d7
SSDEEP 98304:IQRQyi36YOcPDLvw2gAf+PN3901i5jE/:fQyiKanX+PNN0c5
TLSH
T1A3666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 aa702cca5b0b31399ea454ea2672f6c18eb1ca00af422d545fb918037996c68f
MD5 4c177e583808f0c58290551813226aaf
SHA1 62cb01622b1305ce4e7bbf2bee61feefaf04f09f
SHA512 79423b7ad3d1cfea627341b8cd09e1048adfb6e23010f36a459459debd794288d95587e16a69d4623b08bcdc6e9089bb97a6fe60b95e3005ff9692942b8640da
SSDEEP 49152:Z68Qg55nhkeWu7PNU3/F1Dv81qP5jAxjVTt:nthTRc/H01i5jE/
TLSH
T1F3B55933B2F600A9C45DE1769F4A872196D27C758FE0E3DB854172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 caf6171c5cfe7c35c480846abb7f84574fd25171b66fa99f010463c73bcce819
MD5 10ef3068fdf39a105ca759f0e5aaeb27
SHA1 826f556786c5a0fd0ba8be539fae30b19c15419e
SHA512 448925ebbf311a8a2306eb5572cda084fc3797dadb1cc01aa960670bbd221c2f099b235fe653b92e7386242b18e944349c5e8bfc7b752593d384fe3e2c2321fb
SSDEEP 98304:9y5112gYy5azzVvU69nLKnhZ601i5jE/:gLIHRWhQ0c5
TLSH
T19A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2ff1eb272a0aabb7cf813001658a90f3ec2e302e04bab0786c62af7f7e3209a8
MD5 5adbf1897ac1197122b60f5a09812a6f
SHA1 c03e155c855278e980eedab5bd8d2055a0d109ef
SHA512 bee6c8300a627f175af78a44265ee5cb805ab9454b989979d67a381ddcefe807161a36fbb1726e58bc3693e23d58dc1b888e2bbed39c0c2682046e9bbe7bb093
SSDEEP 49152:pB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glK1Dv81qP5jAxjVTt:/u6JmIxd2ds01i5jE/
TLSH
T18CD59D13F2D901E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1e2e28067d5468682255836780fbbbfc8a405fcf489be5192893ea2f6b1eeb01
MD5 f633c95682e1f52aaf929ad1eb49e1a6
SHA1 42b7ec9588cf3228a5ccd1dc011c8b733735ef68
SHA512 bc4701602b276f36c3309bc944f1167172948e8cb7649f85725ede61e7c8dda47d8014f3de3f23a9da0c595a9f14c1af73646a5c3fa61e59483066d5e4aeea83
SSDEEP 49152:j1hpsNoJpF1A67U44CwH7R4xD1Dv81qP5jAxjVTt:jmifPqRY01i5jE/
TLSH
T192B5BE13F29800E8D06DD17887569232EA62BC460B35B6DF0A90B7961F7BFE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 257f80335368197b78d4a43c76e1397a5ec861d612e47324edd7c843a3458519
MD5 a59b6f459c9170a204a2e6312cd10734
SHA1 c261713b144cba29d73883e381db6cc061d5c39e
SHA512 9301121e0334702b91cc577b038b13fcdcbd595fb2d1287300d50b97ea5eae31c5502f486e6e62ada567bd729ba4e0d4a73320ab1d5294bfbf9af9d8db314ca4
SSDEEP 49152:5SuZQIY0Be2KkRVtOnks6NMHqA1Dv81qP5jAxjVTt:X5dKqi61+01i5jE/
TLSH
T17CC5BE03F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 19614e12740c3a2552503d89c2557d17969ff94a24ca47cead46ef0aef4b1c02
MD5 e3dd5117479ce85b2fb51239c3a28bad
SHA1 dcdaa6bca7f217165fb8d427e83335c285397a4a
SHA512 73c06538336603cfab28c9069c90bdc36fb4a83120728e12e516397b899319d9901be0f3d0622aea7fb0f3a03e8bcb87c910451c964ec4f7737907614ff2d42a
SSDEEP 49152:thtSn8EApI0figjgiDn0AP5wH1Dv81qP5jAxjVTt:8X2iWphE01i5jE/
TLSH
T11A95BE13F29900E8D06ED174C7468632E962BC160B39BADF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 bc3dbd61926a0272155ccbcfbcdbf65780838a85e1657fa0d3df89b309ffb1f9
MD5 a3f73014d27d3e80a752c380bfc73cc1
SHA1 3e391b7eeedbcb7b5960fc2590b7d70a3cf431f1
SHA512 41a1d366bf6cbc0ffca1c4c0c9199435fb2d8f2ffe359251ba54b849a6bd398b6d6f2e048fb0ed68a95079b0d1dc9035e6cd4bed8e538b490eca663af5110b39
SSDEEP 12288:+EmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:+E1Dv8q+qP5jnAxjVN1hzM
TLSH
T11B652302BF1C4E5FE1765AF3C0ACE445281C7ABBA4DBA643A7D4810115BB7A0FA07D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 0be35a09c70dfe075253954a91324596a3a24d9f2b96a811315936c8089f17ec
MD5 4b62ff21db80f1db5556f2d8df99e259
SHA1 23123a5e23eea81066c060d19014b83c93a98b17
SHA512 3948c937fc5aa25e7d709844309b00b418b788671d41b1f973d592cba6b2ccce42e9ee0f98dfd02f2b2c867f5b76071a88b5bf3b27efc00142c1bd4525ba25a4
SSDEEP 12288:zZmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:zZ1Dv8q+qP5jnAxjVN1hzM
TLSH
T11B652312BF2C4E1BD17656F3C0ACE4452C1C7ABBA4DBA643A7D4810115BBBA0FA07D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 0d1584588f5470c4587ba358e18c3bc7eae73b11bb5e43c369600b7e03b96475
MD5 3ba5c4d230c431a37afd7c517a697ea6
SHA1 039e08c04c00d1a694ff5c3f19d1fb12b22124b5
SHA512 5723bc3269b42f1ed40737177d01d2895e4dd11b65311d2a8214941e191349fa744e420e4e65335dfbbd29e5fd11ad7f5b80560191b381e4cb146f3001a4c513
SSDEEP 12288:1bmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:1b1Dv8q+qP5jnAxjVN1hzM
TLSH
T113652312BF2C4D1BD1765AF3C0ACE455281C7ABBA4DBA643E7D4800115BBBA0FA07D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 4eb22f74a0e4d67f44f017df435535308b29e7b3381335a554232c4ea445002a
MD5 ac87d8f94fcbd83994b508ef9de9dc99
SHA1 5cfb97cddc3ebb16170be3e14d38bf1e505b4cca
SHA512 51ed52bd3014190adb0fffb972b2a02cf0c934d87c2198e5251a8549747589280524d1ab0484cf03a96ebcc1249f02898735c671053912167961717c8245f701
SSDEEP 12288:jV2mLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:I1Dv8q+qP5jnAxjVN1hzM
TLSH
T1A26523027B2C09DBD477D6B2C0ACD45168287DBAA5B7A78B97C045050DB37E0FE26E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5d81033eabab832d8968378bcdba336c9ea5de78c31c0c2143a04fae09548f1f
MD5 6d20d63009fa616c994f3cbbf8cd8cd4
SHA1 a1e77e8fafd295c0e8a506066cdcb9f16536ff49
SHA512 158ef80bb2ecc4be46a6c24536dbbe12b6d78d54223b45301f535737e4a571dd42f4c70c1cab06dd4fccf523ab03976e052ca42b2ceddb703db6a8165c2fc5b0
SSDEEP 12288:Q+mLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:Q+1Dv8q+qP5jnAxjVN1hzM
TLSH
T10F652302BF2C4D1BD1765AF3C0ACE4552C1C7ABBA4DBA643A7D4810115BB7A0BA07D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 b74ed55b32cd3229e1ef56390177fcdeae73448ef065ef74ad8e8bec4400b64c
MD5 6a3429c621e6ae223a05ab3900ec40db
SHA1 f867c0d73d78ef89c9cecdcdf7aafd0961498bcc
SHA512 2e9f67a9619761dc510aa41d82840b335e0b13bb9c2887de2e20f3630be6bd23c711002329966d60b985caf2c24f97013f1733432b89ef0981fb512c7555f35d
SSDEEP 12288:jtmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:jt1Dv8q+qP5jnAxjVN1hzM
TLSH
T115652312BF2C4E1BD17656F3C0ACE445281C7ABBA4DBA643A7D4810115BBBB0FA07D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 30f77ebb28ff91749d28044ba4c75f2ca265c41a709c8ef33235b4368223a459
MD5 32aad1ddbf6319e7d957d30261e0bed9
SHA1 e2275bfad7c31af74a19e3bf519853488dd34031
SHA512 c76a959c880b60958cf437005f6ee61f57ea49dad9c13652939e73efda8f02e14a21d88ef92775ca298e2565078e2793a0a1c68cdfda8f8875328c3d960270a0
SSDEEP 12288:4BmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:4B1Dv8q+qP5jnAxjVN1hzM
TLSH
T186652312BF1C4E1BE17656F3C0ACE855281C7ABBA4DBA643E7D4810115BB7A0FA07D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 cfb092657d2fe70a8993524446fd6ea323d05ba2cf0f185624970f5be8a98d99
MD5 009235790ce3e938a3ad6c99120ec1d7
SHA1 fef7eefb07438a1cb462c77618bf1a393d0d7f5d
SHA512 8b2f2a5e78d4bd4eae37fc73b32683656c0ade73894285eb0516e7432eefbfe87170c9f9da85bb4794e0006a4c6c5d74ca14e3cead048cf5c67f293b5e8d3016
SSDEEP 12288:ciZwbizzFEoS2cPvy5mLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:/ZMazFVSO51Dv8q+qP5jnAxjVN1hzM
TLSH
T16A850195B3540CF9EC77827AC8699906D5B27C6A0AB0C60F03E436171F733A15D2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 5ad38f28ea1b2ee3ec8feade7b53f51dfa8fc4004660534fa43dd3b87470b4b3
MD5 8c6745f616df46454ac91f53f83da16e
SHA1 14bd0b6adbfec034496c3555ce4e1122811f1b51
SHA512 da42a0337bef9daae7c19316f07f579a898db74687dae1facb4b6a1b0ab0b49ce1628528610868e1153e7573af5d4d9521ba3efa1774276fc538a19b7db080af
SSDEEP 12288:xwmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:xw1Dv8q+qP5jnAxjVN1hzM
TLSH
T1DA652302BF2C4D1BE17656F3C0ACE8451C1C7ABBA4DBA643E7D4810115BBBA0BA07D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 775190b8a01d1fd66f57f6da21a0fbce80ac8b7a5974b03a8931780595a3207f
MD5 2c52674e6c173db78e76587b425ed9a9
SHA1 c87b0dc5eb7fcf081085e539ccb417b5745f2e86
SHA512 2379fba0210b847ac707c3db6bfb0268aa4daa5d908e5f4dfae261b6b7669265e7c091b920a5ffb78b950a43b10540d992089a314d226541c85190122f408dde
SSDEEP 12288:n8mLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:n81Dv8q+qP5jnAxjVN1hzM
TLSH
T1A7652312BF1C4E1BD17656F3C0ACE8452C1C7ABBA4DBA643E7D4850115BB7A0BA07D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 971fe4807821d98dc822ebfd8e5f123da2041ccb614c38c8f959994740e0e832
MD5 50fd7e32d0135a63e438072999d98232
SHA1 2801d09619cce5ba3af0b96e872ed0889b98b0f2
SHA512 3bb30b675af592bbdd07b654bca1be652ead4a3b9a2c875f3816361f2ba52781b0691ce5a14ba849e334ae28987d520932bfef686199c27e3db667cb5a4b8373
SSDEEP 12288:EyPz5L8lmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:dzyl1Dv8q+qP5jnAxjVN1hzM
TLSH
T1CD751203776820FAD0779235C8A55902B735B83647659B9F53A047362E377E0AE3BB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 d6b44953725fb0ae72cc670c312bb99e78c1efcf7049b332be37f4c0a1eeb737
MD5 88aa98d288549080f080bf41be9b4ee7
SHA1 6bb155838942da9076cb8155779be3c19d966579
SHA512 7b515dd9d6e2aa585c422a33a2855b814a6b7a3996e578fcca760059d01fa2d26cd1e97f872dad77208cb45c6aa4f682518fc8cfbcc50a6c05cd41f4d71a6511
SSDEEP 12288:DwmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:Dw1Dv8q+qP5jnAxjVN1hzM
TLSH
T1BD652312BF2C4D1BE17656F3C09CE8551C1C7ABBA4DBA643E7D4810115BBBA0BA07C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 e1b68589cb28602a434c02ce0dcc745a924ca0c571a4fa13490f1f54d0616ada
MD5 dadd7abc9ff82531007d151645b8917f
SHA1 079e9282dd2214a2d8e0d5f60afde406cea83ce9
SHA512 1afc42d53e502ae2f0d04173d7fc6729ea13be569d220f0a8e1d953ef8b5ad8321f60aa24b1799010daa3489e698f03119b27334a175e63aa67a735212313ee8
SSDEEP 12288:8wmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:8w1Dv8q+qP5jnAxjVN1hzM
TLSH
T15B652312BF2C4D1BE17656F3C09CE8452C1C7ABBA4DBA643E7D4810115BBBA0BA07C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 ba47248f2380bca658bc6106202bb74dbf4bea0656aba802d2fb87fe415003c4
MD5 8ee981146fb92637460d0f58b7b7400d
SHA1 8ef13540333dcf614bc834857341c44249ba8ff9
SHA512 ef0d397d3bdbf95b54c3f9d8a61b6d6127cd7bee2e5d7df9f322e9498356c83075be36107852e2ab4ccdf2ccbe5b45a8548f035baa5d805e844ed56f98269d50
SSDEEP 12288:OyPz5L8lmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:Tzyl1Dv8q+qP5jnAxjVN1hzM
TLSH
T137751203776820FAD0779275C8A55902B736B83607659B9F53A047362E377E0AE3BB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 01565365368f0fa046996f6652d7595fd40c822023779ec00d5ead58b93ce3d3
MD5 81651361907acabb0e2827730b2a438a
SHA1 bb5f32bd42a9fc5b96ce0bbc8f8a9a45b860b007
SHA512 b7b8ef40babc5fbd8e11d55fe479c51e4c991ba3483a80a21ccc3d0b45b3a5adeb095faff48ab4116f16e04d23626358dceeb6d2462902b046e7f4435fbfc112
SSDEEP 24576:FT/aLl3z0zDr1Dv8q+qP5jnAxjVN1hzM:FTiLlj61Dv81qP5jAxjVTt
TLSH
T1ED85F195B3540CF9EC77827AC8699906D5B27C6A07B0CA0F03E436165F733A05D2EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 b362d5d93d7b2c59fbf02efc25648e140e846e486a0a4cb7bc6e24e4f55d84d6
MD5 2e53d9b1f68c0fd6a43031b32bd306a7
SHA1 9ec59763bd1df3539d755d51ee0072a00a77aa73
SHA512 b1d9f5a8ab33bd7171c54b3fa3ea5eaa5cb0f0c1bd88f157fa4433fa21a16d24705c8d633baff7c596fe6f3a3c15600438c566f83387f688a9f5d6ab5c9cb817
SSDEEP 24576:03Ud9CHKy7GZ/1Dv8q+qP5jnAxjVN1hzM:+Ud9CHKyad1Dv81qP5jAxjVTt
TLSH
T1CB95CF90F3E814E8F0B79A35C8769511D9767C6A1B71DA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 df19d3a8f8bd24c3baf53d893ed56619d7972c9068a10fa13af0f7a182d8b82a
MD5 219d015a2564ae4b176b9e0b8ce64a32
SHA1 a927775b508e8c47b495204f1ac88a58062b10d9
SHA512 2a219059882e31a985f20001af9c9afa0369b4899748a88d403a9a5be0b9387a810b350b3440874025275774669ca902f4212a224fd2efa28bcaf1cdd72a6603
SSDEEP 12288:N7mLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:N71Dv8q+qP5jnAxjVN1hzM
TLSH
T1C1652312BF2C4D1BD1765AF3C0ACE4452C1C7ABBA4DBA643E7D4810115BBBA0BA07D67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 410ea26c796d186a541cbc1838793c2673334c2398083602316e7f0e56f9a151
MD5 ce98be8cd8ac08e79d4ef4d4bdf9115c
SHA1 111964e74f74939701bd0e1a958377f21db8a6c2
SHA512 737d3969c000dc286c60cf2e38bbb579708d5b611c0b24ff0841f6e9d84b815402e28bb2cc33fc4fff9b8cc6d7c71b0060f624af6d023e9cbfc427cd58b1ce7d
SSDEEP 12288:sEsfAmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:KA1Dv8q+qP5jnAxjVN1hzM
TLSH
T1DE75F10AD31802E9C06E6272C7599A41B7277C7583E2D3CB53D0F53E1F76690ADEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 dc7b7c188f2b285ec7feaa134eb404f761e54525c88da3bbc63a4d9cb1d5c1f9
MD5 0686b5a236a4034d48b728d555ab56ed
SHA1 99158aa870c01dad773041bcc974573d090be3fb
SHA512 2ae07f11ab9bc6b55c53f3f1e31a0a305374616e40894badb6c1bc4988425fc76e703e50b5c8d9e9b7a68dc6e88043335608d2e1e4b013aa2c542787c5023fec
SSDEEP 12288:MovmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:Mi1Dv8q+qP5jnAxjVN1hzM
TLSH
T131652312AB1C4D1BE0BA5BB2C0ACE425241D76B99FD6E5C3E6C082051576BE0FE37E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7d7a5bdabe2469a66039d6107d3c046967d2464a5b13b6259dbb7e2038a0435a
MD5 77283c3612cb6c53b4a301d2ffbcf4a5
SHA1 0fb1e134100a6a5003a360b4f9c0e6e79b2ee946
SHA512 eac20b3ab9b04046aec2c99c115368317ceb41ccd6a1d074db98fa09602f200d79851b6943c73e7818764ca858e57c5f0d0322641bb2390434dc278d9218700a
SSDEEP 49152:mRZwQCyiHiQEaaPnMd1Dv81qP5jAxjVTt:89xvPC01i5jE/
TLSH
T1C885AF1E63DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 5062cf86aecf4d43daf25e0272895236b1909eb05a4bc87dfe9f5a0486e9dbe9
MD5 633ff45f09b57c5ebbbe54adfcbdef6d
SHA1 f3b763a7ff9b0bc13c5449098449f328c05655a6
SHA512 be882e518568771cbcde9b2d04f6732f10dfb2fbc708af2885207e8e194c5a069070a7aeb09d7fbe973ea7c61ca9175ce500cbf8bfca1ddeb698818c03264b15
SSDEEP 12288:YbxA1U7KWmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:YbxA1UGW1Dv8q+qP5jnAxjVN1hzM
TLSH
T13D75022E676C18A5E176A67AC4D98006D731783A1761A7CF51D0C22A0F3BFE0AD36F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2cf7b0eab50b0d853562c447830d03b0ebbc2c7fa6a0a6fb1bd3363b9cffdd3a
MD5 569aa26b4866e51f5b98528399a95607
SHA1 d2d9958c5d5ecd9b335fbf23c79ed4055cf298d6
SHA512 df26b6f3084a274f2ee3cbdec01fd2009e0e4020ca81c6e4cef275ee8f6e8a3c0ec8b6c5f99a7712adb09b7a74901b3f06ef5e86f9217c71780fe465c737caf1
SSDEEP 24576:JjsmP0yHaqrVqHra44KDzMsrnX1Dv8q+qP5jnAxjVN1hzM:JjRP0yHfVqzlAsrnX1Dv81qP5jAxjVTt
TLSH
T12945BF2EF2B910B9D4AAD232454507B5BB71B42D1F219AC701B0C634AF0AEE49F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 b186250a236bf9e99d181a065d933002d86dcdb92669e2c7520c4fbe1fbc0b69
MD5 53e316691045b9f299a7c27121ea8562
SHA1 e543a6807455e5728011ef467fead1b113081cc3
SHA512 93c19d60da2d46295bd23bc9115b1a8130ace2bb9db6be558ab7fa295c6b418d7f96ee29170feea70f346a0455e8e0ba585a04dcd4e5f0e55b550b0398442f3c
SSDEEP 12288:jSvmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:jQ1Dv8q+qP5jnAxjVN1hzM
TLSH
T1E5652311BB1C4E1BD1765BB2C0ACE815280C7A7A56EBA7C3A5D0810115BBBE1FE37D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 06992cb46eff59a096b11f3f174c4a2a79a2aa5a6bd68fb40546024f70c5a53c
MD5 3d260a2a8a58ede2fe564b1a95d2f5f2
SHA1 d5e30c9d971a9c10c6bffd36f392fab52a816503
SHA512 669882628ef59d53711e50cb3e57b89ebe56d545b4f84ef61b7ff5ecb579d6dda58b9bf1280f3b06002687aa8fab5b946fa2f2e3b7b8eca162ce1fb6b2ea88ea
SSDEEP 12288:DObVA4LWO+vAYFTEvmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:sBLBUTW1Dv8q+qP5jnAxjVN1hzM
TLSH
T122850115F7A804F9E87BD13CC8A68916E672B46D0364E7CF03A84A551F637E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 505b10440afcd67501e0b89c3633d151dc0dfc103fdff824e125f323b754b2a3
MD5 54db8e382af2b5966e5f27e805b57035
SHA1 afa932f1f30dafc618b3fb2bd6399f9d4bb31355
SHA512 10c781e7d24859877a8e443089bd41d353023be8dcea9f7f65ee6695baad3fd90d5890eb4b0574e624272991b9dcb63ab75d6f1e16008a610920ec7e36926a43
SSDEEP 12288:970VmuIYNvUyBpVvmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:6OYNHL1Dv8q+qP5jnAxjVN1hzM
TLSH
T18675F12FA66C0CE5E57BA17AC9C68109F1727866135193CF05F0C27A1E27EE4BD3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9a63f6b7c30547dc5cbd06410c868bf8386265ec76563c0e71b8f59f82799736
MD5 34429b0add040e8d640b508ed0fe6321
SHA1 a0ad14ee4dd4648f2a8d62f7582bb264d39c1447
SHA512 8e4fe410bb8ba6d708b6314be47f165ccb61314422242bb765bee7ea07942f59e6e7bc71f7d5917b50d37279225342f9d048ed1f3032e3a9f75d88facb470728
SSDEEP 24576:fnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK8:fnXoJJYH84VVS6AmETJas+cHBjSSKHPn
TLSH
T1C765BF5EA2BC04E9D5BBD17DC5C24506F5B178661331CACF026082BA7F27AF1AE35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0500077a487ed7100ddace2f8e1b8be2c6c1b4607804782d7582508d6637a036
MD5 8aa0479fb2d8eb83398dc4659a3d18f3
SHA1 974d10635e04ff6697e765758d84caeef1d1529d
SHA512 9bd38f438d1967de7f498c10c24cbf135ce214e0b4e9f37d66578096d9d846cc27e35455b05817ad15fb0541009e43cc601d083976a73b54e9f1c6959f8855bb
SSDEEP 49152:+DLL9TuJ0M/TYW2Pw1Dv81qP5jAxjVTt:9h01i5jE/
TLSH
T158858D5EA3EC42D8E07BD6BD85B69146FAB2B855173091CF0290856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 22f3190193545d12fe4dcdafd495cb6734b42b2248b6a18fa526c1f3e72bff1b
MD5 3487e594a929116851176493d686163f
SHA1 46bb3b0f3542fee16c9af2f49075fbef23e9b41e
SHA512 e6f6e9b400d008ffcc5b58a91f48ea709a1c8ee3d03ab5a484576232c1a4832a6e8f0f9bd48183f10d6a24632d0b2836c96474a9b686d0e43c9b47fd8fcc49bd
SSDEEP 24576:jegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wW1Dv8q+qP5jnAxjVN1hzM:jngOJOmPOHkW1Dv81qP5jAxjVTt
TLSH
T17D55BF3FB7BC05D5E03EC17DC9968816F6B1782603255ACB05A0827E5F1BEE46E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 2670438e41140573e16b9ed1655968a51eb249edf228e058ec92073e0bf92bde
MD5 45607f5a65f7046e80ae60b5661a65f6
SHA1 64f85c0c3ccb72bfb35224f8dce1df17ddfec60d
SHA512 da9967bf14015c6885f8cdaeac83e8ad163c1e6d4a3dd0263472b93bd12229df962978a5218469d6ea771b1f1e189d1bd839ce86417123f8760208e96bb54670
SSDEEP 24576:6LJnJiTk3R3waE4JrOw1Dv8q+qP5jnAxjVN1hzM:6LJnJK8R304ln1Dv81qP5jAxjVTt
TLSH
T13085E03CD2A810E8D4B7C2B4815A5A56FF31347D2B2269CB59B4D5313F12FE0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9c1d2c716c4ddcf6f3098fd74da022d0decd4a798ebd309cacd95a7dddce907b
MD5 dfc01766099a4c99ad3a69bd3d895ac8
SHA1 04d7d97057cdfdcd03c323ebba883ff99a205677
SHA512 c9db71e840490b8a36b64820ff126a6b67b5a090cf16afe2124259b171983369d069f54680e207fd379e51c26147a0e4ed7bfb117d13226bcb35c1c2f0157aae
SSDEEP 49152:u9GqCzDScAZmlvTcFg8Ph681Dv81qP5jAxjVTt:gp01i5jE/
TLSH
T17D956D05F7EB5298E8B3CAF1C96694159B327C509B34F7DF0A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 1c2f444a3a78351a95d9211292bdf0504e22b5fe48a16b64c52cf95c2c076e48
MD5 27fc21d2c8ea47fe644f4c1b1bfc7fe0
SHA1 fe40a0c7281ca43da03b737222d89fe8d6ea7d9d
SHA512 fc2ce8c2bf59a48af6fa0ce8fb796601edff8eaef0ad9874160dd5a0473a3a91c9dda0197d21431f4ba51e30e98dfbf43e2fc4bbc7421e993fa9281fda339499
SSDEEP 24576:PlYJeXm5jUuEq1Dv8q+qP5jnAxjVN1hzM:PlYJeXmRUuEq1Dv81qP5jAxjVTt
TLSH
T10E75121D7B2C20E6E17B9176C4A58905E331F0B6139267DF52E0C13A4E67BE17E3AE42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 81f1b3b76a3111d1407ec51e3e011121bd635eb14f5e414d7bf1e5cf1f0cfa08
MD5 cea5ced27d77182ad0927979e6f18c86
SHA1 2705adce9907184be09268e7cf59389006abc073
SHA512 4ff62fafe016859a7e347547414633debdf306db43ad426448042e6f283e7b1d107804acb03ca8025f3bea4f7483ed02e79687587fb1c6c77f93aaf96da9f5a8
SSDEEP 12288:xDu6ky3mLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:x6ty31Dv8q+qP5jnAxjVN1hzM
TLSH
T10075120177684599E5BA4A71C8A680905D38BC319F6297CF91D0E62F2E77BE0BD32F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 048d0b3fd0f44bfdc1ae1d2a7d40a96505a545dcafa7d1ff7fbf6a084a6c353c
MD5 753ad26f105b761cb4e7edfe849ecd16
SHA1 168ba964cca19ff4e84649140dc4f29ce30e8e2f
SHA512 85ed47b840c2d952a5d3f79f89a91055f0fdc47315689151d47cb3f3e28a628595961ac7f7fba22b746d353309a9909d8e81a43da6dce6dd7d68efd405ef40ad
SSDEEP 12288:FPEvmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:ZW1Dv8q+qP5jnAxjVN1hzM
TLSH
T1376523157B2C491FD4725AB2C0BCE841242C7A7956E7BAC7A6E0C1114ABB7E0FE23D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9bd9a318ab30c1359ef3fab2f89b1181983702d87afc4f01714c3fb43c8cbe6e
MD5 6182b47b43ee885ac5c39e6cdd6da0a4
SHA1 14d2509a4700ecbe7f866625ec09189188d08c71
SHA512 6536940811e56be4c00308e698193d227c2d9239e315ac50784d1087daad02345062750006f155a229f70db822c40df6bfe0ff9f81765d6fca4ace75823e2210
SSDEEP 24576:/C+TyQIu93VAumZr7jmV1Dv8q+qP5jnAxjVN1hzM://TfIq+YV1Dv81qP5jAxjVTt
TLSH
T15C558D1DA7E91DCAE276C675C8A34493E933B472137196CF2084C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 732784c4f951fd79d6e715c343451312fedf8f5a26c554db691e2b5b6fc41426
MD5 f051fa582ed80390a6ca6f98fa010663
SHA1 1cf9da4371ba34ed241a141103754a5a435dfa99
SHA512 f1f95fd2846da42febd5d63c74427781a753f4e5dba7b24c75c6a689f5add85747371f9ec1919422cfd639b545c0844ee17282f64bf19d3d4df6c8968a1362cc
SSDEEP 12288:GcyrWOstaa3kcswvmLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:fLQikZa1Dv8q+qP5jnAxjVN1hzM
TLSH
T1B275F00FB76E00A6E0B7C278C8898112FA737475575267CB42E0C7790BA76E5BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0999f03aa4ee9d438dd8f0d0c16bd492252196d9029c81ef9ab5c8b528842dde
MD5 c87d49103f4a030ba94bd89ac801119b
SHA1 63b7110c210583f9464b1192e832d7456f10646c
SHA512 063897276edba539b20f1a641084d9fc836429554a36b5e5d0aefcf75202bdb73c4ba50c0f9dc80cb7492122c08f18cba340ad764669a7dfb71d27767081fda4
SSDEEP 49152:6pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP31Dv81qP52:XpC7b4+80GTki01i5jE/
TLSH
T11EA57C3DE2B8006DD8AAC776C5461665EE71382E3F2015DB01B0C578BF1AEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 44e9a074e68cfdf57f0b6f2919ae5b1e91629aa4e2c784ab0b4000ff2a1303cb
MD5 6769fcec3ffc15d314aec7eceb84dd0a
SHA1 ed231f1bed0a75f8d374380f0c9f6623bc1d9952
SHA512 9618be5918ee0f6a84add006bdf2d51b5152378f3b5716ebb0b847a59fb31939e7f085d83ab37b6dd4d6895d19c981cb3877923174918f13fc966f3c4959af4e
SSDEEP 24576:oSAwJPE1IDAo+4Kt+l4413lUQf1Dv8q+qP5jnAxjVN1hzM:oqPCIo4Kol4jQf1Dv81qP5jAxjVTt
TLSH
T1FF55B01AA7F946E5E17AC7B4D663C511FB727823133163CF5290813E0E16AE89E3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 668ba0f918ae77835105d75e827596909bdb0fc3393246af3d98279a994cec28
MD5 20395dd0727fadf91375373ec5a29b03
SHA1 856b476acbdf8fef7322452f0d95bd3e23610ace
SHA512 9d273ccb6b6e05b6cb8b74e736cf9434be834c017eb6c119db21af67347e55a492c4a156937e33ca4460427dc1f0216c7c92c0dbadc2e04a8ed8e5d87db95244
SSDEEP 12288:G9lyvj3IkxjbBz+mLIrHYAvH8q+zOGDGg85rHnObKwjVnN2ISBYdzMF:GWv8qjp+1Dv8q+qP5jnAxjVN1hzM
TLSH
T12B75121E6B681899F07A4770C079C1255435BD7613AAAAEF71C4C53A0B36BD0E93FF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-326-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1008-424-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1136-329-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1136-275-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1436-83-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1436-246-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1436-82-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/1436-89-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1532-71-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1532-245-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1544-308-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/1544-420-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2156-229-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2156-13-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2456-25-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/2456-17-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2456-26-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2468-311-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2476-319-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2476-423-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2624-293-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2624-416-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2624-291-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2888-314-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2888-422-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3044-69-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3044-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3700-278-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3700-421-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3700-332-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3764-458-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-438-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-432-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-431-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-459-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-460-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-447-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-457-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-430-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-456-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-446-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-445-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-455-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-454-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-453-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-429-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-435-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-452-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-436-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-437-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-451-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-434-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-439-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-466-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-450-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-449-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-448-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-471-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-441-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-442-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-443-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-444-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-440-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-433-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-470-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-469-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-468-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/3764-467-0x00000255438B0000-0x00000255438C0000-memory.dmp

Download

memory/4008-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4008-39-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4008-243-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4008-33-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4204-425-0x0000000140000000-0x0000000140195000-memory.dmp

Download

memory/4204-333-0x0000000140000000-0x0000000140195000-memory.dmp

Download

memory/4528-61-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/4528-65-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/4528-55-0x0000000001AC0000-0x0000000001B20000-memory.dmp

Download

memory/4528-63-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4528-67-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4588-414-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4588-426-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4588-464-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/4588-461-0x000000000BE30000-0x000000000BE38000-memory.dmp

Download

memory/4588-462-0x000000000BE20000-0x000000000BE21000-memory.dmp

Download

memory/4588-361-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4588-378-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4588-342-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4588-345-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4588-336-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4608-344-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/4608-282-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/4780-76-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/4780-266-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/4780-325-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/4780-271-0x0000000000960000-0x00000000009C7000-memory.dmp

Download

memory/4780-1-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/4780-0-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/4780-77-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/4780-9-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/4780-265-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/4860-419-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4860-298-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4860-303-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4860-305-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4984-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4984-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4984-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4984-244-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5004-262-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/5004-260-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/5004-254-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/5004-318-0x0000000140000000-0x000000014019D000-memory.dmp

Download