a97d2db77b350d810fbd0829dd9f91473e50becd7edeab382a5b8b01082289b0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Size 1.7MB
Sample260701-e3sdsaes9p
SHA256 a97d2db77b350d810fbd0829dd9f91473e50becd7edeab382a5b8b01082289b0
MD5 6e60519d19908204b38f30be60a29bd9
SHA1 84615ea008af676fd1bdd3f5a5c0e3a61939b804
SHA512 fed75d382fb173238120fb163df50b179024f587131779698a63052d713cf513bfb1e08c4b1b3f346d29ef8f8de4b45ca8e181aa67435111d2e718efc1d9c507
SSDEEP 24576:jVf+k1ixOFthHE8MEX1XsdIAhb0VECwN:5flixO3hHE8MEXWI4bMQN
TLSH
T1ED85F10A72D0A2D4E9E5713CCF91C6785362BCA409124B5F42E53E5B3DFF2D74E26AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5040	alg.exe
2824	DiagnosticsHub.StandardCollector.Service.exe
3680	fxssvc.exe
2020	elevation_service.exe
4004	elevation_service.exe
1824	maintenanceservice.exe
2580	msdtc.exe
2344	OSE.EXE
112	PerceptionSimulationService.exe
4824	perfhost.exe
840	locator.exe
452	SensorDataService.exe
1032	snmptrap.exe
2392	spectrum.exe
3276	ssh-agent.exe
4064	TieringEngineService.exe
864	AgentService.exe
2808	vds.exe
1328	vssvc.exe
4320	wbengine.exe
3092	WmiApSrv.exe
3012	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\668f836de52bf895.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088ae45121209dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aae5bc121209dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000426fa7121209dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052f14b131209dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1988f121209dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b62d28131209dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e7288121209dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce1853131209dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
2824	DiagnosticsHub.StandardCollector.Service.exe
2824	DiagnosticsHub.StandardCollector.Service.exe
2824	DiagnosticsHub.StandardCollector.Service.exe
2824	DiagnosticsHub.StandardCollector.Service.exe
2824	DiagnosticsHub.StandardCollector.Service.exe
2824	DiagnosticsHub.StandardCollector.Service.exe
2824	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Token: SeAuditPrivilege	3680	fxssvc.exe
Token: SeRestorePrivilege	4064	TieringEngineService.exe
Token: SeManageVolumePrivilege	4064	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	864	AgentService.exe
Token: SeBackupPrivilege	1328	vssvc.exe
Token: SeRestorePrivilege	1328	vssvc.exe
Token: SeAuditPrivilege	1328	vssvc.exe
Token: SeBackupPrivilege	4320	wbengine.exe
Token: SeRestorePrivilege	4320	wbengine.exe
Token: SeSecurityPrivilege	4320	wbengine.exe
Token: 33	3012	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3012	SearchIndexer.exe
Token: SeDebugPrivilege	4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	4380	2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
Token: SeDebugPrivilege	2824	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1792	3012	SearchIndexer.exe	109
PID 3012 wrote to memory of 644	3012	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6e60519d19908204b38f30be60a29bd9_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5040

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1164

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4004

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1824

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2580

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2344

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:112

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4824

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:840

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:452

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1032

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2392

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1644

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3092

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1792
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 75e9e2f9a14474123b35782e8d1e4144e980c3e87035dcd05693fa2ea79d34bf
MD5 9acf0d544bfe8a35941dcf3a4183948e
SHA1 c17ae299117dbd9275f89c754aca6be9fe620f10
SHA512 94cd3494589e6011a7820c07821758bdc71a23246e3319ccd5c990ced4ce4ba155cf676fab8bb3d75a464e9f205b23d2fb8d24cefaa9f51991988f07ed41e1c6
SSDEEP 49152:6b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn6ixO3hHE8MEXWI4bMQN:s3q6HjBSo3tzfG9btN
TLSH
T18FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 634b4970b416807641d1c360df4f67c01bc1a5e66fb812e1dbccb8b67659e937
MD5 35265f2a12a25ed3693113f6b659c3a6
SHA1 aaba48dc88a6555767c144660628e7e08a3028a6
SHA512 10e825e8feeece83694d2fafbeab58c14421aedc76927bcc5dd8e097f1a615a08f5e0fd602e1c182bc79b82a36b0c5f91885367d3ac1fb8e281257d36e6d6d80
SSDEEP 24576:hXYfDtczArixOFthHE8MEX1XsdIAhb0VECwN:ktcoixO3hHE8MEXWI4bMQN
TLSH
T1B385F12977E405F9ED6B923CC8A28615E673B8910760E7CB03A499261F333D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 aef455e8742f026f96f062cc32d1c291f7806bc11b850819e7871b7dce9dbdfb
MD5 13f7096bfa093813b3c6f247902fbb03
SHA1 83d1c0ec2881895d9b5434894947d5efd9317497
SHA512 5ecc0c5afec5ff125124c630410a9da8920106fb2493599cbf10e1790c5b29af94a75191db7b8cb31bf7555d56c867b98824f2cbadca64f8679cc64acb43617c
SSDEEP 24576:Y0Le5ji0hmxirMiixOFthHE8MEX1XsdIAhb0VECwN:YPji0AcdixO3hHE8MEXWI4bMQN
TLSH
T1F9959E16F6748375D073C0B9C5D2A69EE97230821B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ff5a2f8ff3a0dbd04b785ef1508fdc070f6e3dedf0cdb9e4041a430db4c2b758
MD5 fc7ce86f5c8844ffab841be3d5c4a2e1
SHA1 22025e0b7acddc7b7fb9cfc50e17db801c3cfeb0
SHA512 7b79170ecdebae0a4e1b497704dabd0bc7b0f487069174091bfb83307616291bf76ea36ffbe3bbc5124e06d5b35f019584585c6f3ecd37a00613b39b6bae115c
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWE6q8wyu4ixOFthHE8MEX1XsdIAhb0VECwN:j/ezSC6vUzPvxHjyxixO3hHE8MEXWI4H
TLSH
T1D7755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8c1adf54b0fafd9b5a533eed7584c3ed8662099382c2a7f76be42951b82d7a0a
MD5 160bc0d5159b48b581d5c693bd49724d
SHA1 acedd570250d308700bcc9bafe15d2995a9fb58b
SHA512 5010c2347e2a2177bedf008701bcbe43968a54217cb60acbf99aab2bdff8d5c091c85d50189d137a62bf5a4595caa27ebb96cd06c19b9f748284963b726da0af
SSDEEP 24576:5VbqPb88hv/l+6HixOFthHE8MEX1XsdIAhb0VECwN:5VO88hXl+GixO3hHE8MEXWI4bMQN
TLSH
T145559E66F6B48321D073C0BAC4D2AA9AEE7234415B318ACB0246D76C3E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 74ba7f0542b1ed08ebfec2f6dcc1ab56c1acc9b7bb0bcbb58f0fd7095d23cdf0
MD5 a4d4854c6e2a704b159b978157511c6b
SHA1 31c6fb1b5c9d2759b241d7319f891312d648f9e4
SHA512 d37bcb3cf183d5380617b34279d432c26562c406dc409ab38abcac9c21025b0ef3185903281b550697d21b16eabfbc6394647c21d173cb5c1b3197104c817839
SSDEEP 12288:zR25i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:zReixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1F9652303ABD481C6EF8B3B3D609A6BFD66D2DED0081449C3C2533566687A2DAD93BC51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 a65fd68e76a73597029a0a377f7469a9ff0ec2bf90ab88e62fadf732ecd8befa
MD5 06e14bbade1fa9f9538bd9929faff611
SHA1 897d1697df6b304d742037e138dd476287967bbf
SHA512 d2fd99dc5f98b0b2286713a4c92cd4bf0c17fb68e8a569a5724e6ba9ce1c98762ec6994a03385d24b0d357eaaadc0897188b7c8198e45fb91de29e871debb641
SSDEEP 12288:ieBNUbTVO86Ut5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:iJIUvixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T17385DF2BEE28FCD2C67E5D7856918740E7B278704F21A3CBD165820EDE235E15E7AC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a4b5c5314a5d9cee16c9eb6a8957ddd06679577b1dacafad90db31a47f1692ed
MD5 5deebb1f883c59c5a44369fa4fba243b
SHA1 2adea24f2c34baf7fd228f56dfc41e26ee22d278
SHA512 29c99f586824c9d4d310f07794fe5cbc5f94bd7ed12c47abb67f8b95f1b4b432aedeedf4bb8c28abf7d8f6d4ae25da02922f3d7840a4fd72a76af2fd35942b9e
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:XQvGAdlCEL8c/yRNw5Czo3tzfG9btN
TLSH
T134267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 8bb4ef2f9b017eff53b264c2985bca53d835df126c348dcdf0f63df0416961f9
MD5 beea4de9ea589080c99dcc4a330f23fd
SHA1 0ff7ff7e64c550342d572c91529823f9d25dd832
SHA512 185d778f68679d21993520088149ad45dde4c7c9ce7c181d410c85853bec390540cf4bdb658955b95e4b97b8193057012d3b1f5f0d690bbd471ab271e0a7364a
SSDEEP 24576:XdewsAjtixOFthHE8MEX1XsdIAhb0VECwN:tljtixO3hHE8MEXWI4bMQN
TLSH
T17E85E031FF74E036C7BF0DB61B26C716146DBA600B6119C3E3A84A9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0651824d392af69f78cc8498ba525c4b0f2ce8ada0dc0a9f8b95a9c5fc9fb81a
MD5 decc6951e2c6f51041d4c5844795624e
SHA1 176d14b07ccd7cb6adddc1a1a60ab48b690feb11
SHA512 86b8f09e318480fae9ee4ee237e4d1a5f1a427baf887c2bcf76f7ac684022e2707fd3c2d83d0d0c050dd15f31a0e26bce62a240c1014025e287d001c60b24544
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHl3U:EUEtQevvqc2W1cpV2EI32B
TLSH
T147474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e3b5ab072ac7d0a1c55a41eb633c308e5cda0aeadc2639c27354e2f13401b887
MD5 59b4cbf4f67c263ab1379db889e35138
SHA1 c0940ecbc5342a9ea00739f15a2d3998108d1e45
SHA512 8a8b0a14ada7587f2bf5c892507a83b3a95b905b825187b86aa2334957f41030351331369893d5ad5fd7be53ea83a3d8cf38acbeb5fcfdf712ad2d9d87f795fe
SSDEEP 49152:WCbRquA/m2yL5zQfFiV+XenmE3/zNixO3hHE8MEXWI4bMQN:boqtVjnmXo3tzfG9btN
TLSH
T1EAD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ef8653cf7407498b376475951fed594a3e43a7eedf2d2b43c7260c86f22d5928
MD5 5ab9902b5c09d1063edbed22eda84ceb
SHA1 adf06b432e3754e7e2af52602ef21e8c883e195e
SHA512 dded3663d51f0b46b25615eb49562983726ce50af73ac92b624d219cc859d752c306aaf1f92281cbe9b43e2cf85bc2b9a68e27a9d1a0a65a97e2237cbf7def70
SSDEEP 24576:WAhGLJIFoiwtA5l7S53sixOFthHE8MEX1XsdIAhb0VECwN:WAMyFoiq5cixO3hHE8MEXWI4bMQN
TLSH
T118359D81EBF951D4F5B3AA7899B69171EAB6BCA51E31C20F2150D11F1E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 7833f00522d094caba10747f62591ee660ee246775f45b85aecc9bfe7d0a56ee
MD5 42ed3b0277557ffa86b4bf4bc02e2a13
SHA1 486c440ef115de71dd4c03e4abe70ef3073c445c
SHA512 79544573985699e74e9210583997da1eb8b3d76a544a014e47370c8963385e492e232015489b314856468e226a94f0733b278dfb82e91d1b90b79fd973c35c04
SSDEEP 24576:QwuoOWRixOFthHE8MEX1XsdIAhb0VECwN:QwDOAixO3hHE8MEXWI4bMQN
TLSH
T11385F14677E408F9E96752398557C236F7F2BC012A21DB1B4360C65B6F373A1AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 7b23175d432a836e3f7e13558ac90a39cc4fbc5c7a257bbd003ef5efcd521d56
MD5 3b340a8d12523237c7dfeb9fa5aa99e8
SHA1 402ccae42ae66509c47e9f1acb6d78dad897827f
SHA512 2d44aaa06a9c608d5a0d858ccb429d78bf087e073a5721f1bf9c1d59504720e75de8da89e4b69d888efd6936f0b8b7a6e289c1f071a272ca4261363c2c290ff1
SSDEEP 12288:/BZ1IyT5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:JZuKixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T18675124A37E461F9E597223CD4E55799E3F2B892273143CF422202662F73BC65D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 76185c32568d93a54d18ade9a2ada970a4d254b6c37dedf0bb38aef6c398d3b0
MD5 5576991a6707133b504647ffc476603d
SHA1 a501fb0a1d084a63c5af1f4666c975cb981cf85a
SHA512 f4cd04b006033d8daab018b5e12da619de5101ee673a08cd9eb16b1e1f4de68679fba9b0163997f42b926395d4840b35414cc74624b45de51aabcf3855b7ddec
SSDEEP 98304:iQRQyi36YOcPQLvw2gAf+PN3+o3tzfG9btN:5QyiKayX+PNP3U
TLSH
T1B6667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e6ae138213fdeb595d7dc857710b0e7b70eec0b64fe9f7726c6e7d277f6fa3b7
MD5 f0360d830d15a07c05114d0a6c467d9e
SHA1 47c89e398fcf167c76fec0e09551d1813b685304
SHA512 94ec56d9f54f57a41f78e1e14940abc94f025f1d773de8779a33be262f6a8dbc7cddab72f250db2ef86b8b0974b79faafeda39928165c36bed4b9dfab1df00a6
SSDEEP 98304:kQRQyi36YOcPQLvw2gAf+PN3+o3tzfG9btN:rQyiKayX+PNP3U
TLSH
T1FE667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e2930ab04489eaf638e212db4e23481edba55172df42dd6cd912248b2c429648
MD5 1c5281c3afd4c6f0ad16be62758fcdbf
SHA1 b1974f1c8b6f81a15cf7dfd50ca89341df9a65f0
SHA512 0f3776ff4d8c0c61ec6fca000f40688d17abcca8b8b92b0335db55ee596dc0cfb01e3869d6cfd71778be8ca2119cd67a362159959f209d435c737b99b3e65a44
SSDEEP 49152:O68Qg55nhheWu7PNU3/dixO3hHE8MEXWI4bMQN:cthWRc/Eo3tzfG9btN
TLSH
T1B4B54933B2F60099C44DE1769F4A973196D27C758FE0E3DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8097ececc8d600392a84f6f7c4e0d1ab9f846a0809a7ff96492e096c988d1230
MD5 1419ab5fdb0072ff4f38096d7291db0c
SHA1 d8fccdf8f9ed775b2b9206d06b0b65f0b5c16db0
SHA512 d983deda65147a606fe598d85a7eec5dfd8ffffca4c5167e4677a5bbe34cd8a23c44386b0d9579ca55a785a1e58e2cf2960daa2d7086ed435899a17a061fe853
SSDEEP 98304:7y5112gYy5azzVvL69nLKnhZ1o3tzfG9btN:WLIHmWhg3U
TLSH
T118167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 afefb99778eb3e770501936fefe9c1609aefaa222277b8ba63d94a60bb71d3ef
MD5 f49f038d5fe006df3808840329d2b489
SHA1 ffe950156dabdc8aa43f9edad786a84d96a295bf
SHA512 0720dfaaa595606a23e703ccce0e1772f4c9fc95e29e7cff28158764546be37964323f22435b666648f175b016b272080e162fd9597a4e534183acc53ad8fde6
SSDEEP 49152:+B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glbixO3hHE8MEXWI4bMQN:su6JmVxd2d2o3tzfG9btN
TLSH
T153D59D13F2DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 64c67d78c97110d9e42de29cff8a7e8731c5420ef3e55b85d774d798d6e53702
MD5 30c58af6c5568fd0ecaf7c188501228c
SHA1 a6f02dedc26e481e909fce7ed94dfa773c133501
SHA512 be1f3fd602c1e40df81230fcb7809ca94d3ada96c637580f53ee20bbc201d9c0dc233fd47ab529b319cc072a6e07c14da116e6b9568cb383b754a22e232213b5
SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4xPixO3hHE8MEXWI4bMQN:WmifPbRXo3tzfG9btN
TLSH
T1A5B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3a19b5f10819108ad6fa892e9c6f614ef7e8d5a6b2594d3cfba236dc3995c213
MD5 ce0e0b5093adaec1c54163be76be247b
SHA1 fc6f46a63a6fe0a7c5d530b2ab114172f1415c14
SHA512 a5eaf443ff26bd678e0bd34e84eec59a394e2ebbafe03bbea2c38a6f1af584751410a24b2b91a7c447319ac416d9ea6d4947f6b327aea2ee28abd523f4e56b14
SSDEEP 49152:LSuZQIY0Be2KRRVtOnks6NMHqKixO3hHE8MEXWI4bMQN:Z5dKTi61Ro3tzfG9btN
TLSH
T19BC5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8e710148de80274f9da0171d1c076326eb4ad263bf306fefbf06139ebfc112ea
MD5 61850ba4f5b868eff756bf58afd7427a
SHA1 992a1d153b85500b87b360515d814d285553f2a2
SHA512 57e22327b79e3fd1132788eddbef36f1f14c86b3b30b8f703b94358a7151c405ae48128f76e88559edc20e8b843b4cd5f072e5d9772e08a67dfdbfccb29aa4c7
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5wrixO3hHE8MEXWI4bMQN:ZX2iyphbo3tzfG9btN
TLSH
T1A895BE13F2D901E8D05ED178C7468632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 80d2e677d28ef1fe8c34a10650147a498d805bd3da35ef722e8bdfbd253500f3
MD5 a72f371d5f95b382c71799893085a05b
SHA1 5868c2bc97de3b905dec8c7fd98267bf809e06f9
SHA512 7bcd88d01b21efbf45eeca0c38059bab3633f32357d58b304805e05055e436633891f2c6f70b48027d6d6917d42abd315e780aacfd3c4d28d5fa57dbf01491a6
SSDEEP 12288:Le5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:LGixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T14D652303BFD5C2CAEE4B373D909653EDA6C6EED5281405C3D257203268BB6DA593BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 38780f79b936cbc7f8f88802bf36a5637ea53aa55907666ae8fb6fd7ac5704df
MD5 7a32a102b1011dad76982e8f1a50e045
SHA1 12d53f80980724f6891ec9bba9513dad784cef48
SHA512 c1626bdaaf3bdcfb1b897face9bc2e9e34a8182dd82cef56052b889215f7b53ed279ea2f942311ac2dce80a143a535ad8c91c44d4d054291a4387c8a1d77f051
SSDEEP 12288:CX5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:CpixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T125652303BFD582CAEE4B373D909553FDA6D6EED5281005C3D257202278BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 5f5c29fb76420fc62203d4068972c4394e5c32ba8a4aeb4db1dc16f388bda3aa
MD5 0142c53522e03e0c49043eaeacc846f9
SHA1 a85bc9817030b77e01c6e07ef0f73bd832248d9a
SHA512 0dd292ece91f469bf6f3cce6b0ae1462f3e73320e31584422edd7d39879b4c2dadd421f4293eb3f937540202a001e8bbb944bb7ccffbd760356d36212a7f3609
SSDEEP 12288:U15i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:U3ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1C9652303BFD582CAEE4A373D909653FDA6D6DED5281405C3C257203278BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 4edb3eba6129e5f3faded6b9b5d420cbbbd52186fd6393187aaaaac9a873a01f
MD5 62ff21272e49423422acc72b927d6807
SHA1 9f48095805f99b389869f4e4aaf2793f5a479a32
SHA512 514fcc290055a7847e4e7ad1079d4d2df35722bf295274675cb0761e13cf178239e39c9f969557e5dd72ebacc9a86e868df3b4c89b131e186bbf024551ab4f82
SSDEEP 12288:/V05i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:+ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T12E6523037BD981C6ED8B673CC0A693A9E3E2FDD42A3156C7C20215261DB73D59D3AE60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 4e7e3e60ea0edcc8b6a7d704829b353330f1e989f49c4d0e4b99d93977c4c925
MD5 b33ce5f3f8813fa3ec4b296ae3087537
SHA1 9d3bd1b2de13d34c8f4f6164aa37a1f66da22b50
SHA512 8706d3307d1cc529d97fe67868f2358dc24e8b62a603fdfb6b26d2c59f482ff7e3fd1558bfd1950f3d528d8b8df17554100b9e9dc6c2e7fc2a1146d6e47b3f37
SSDEEP 12288:Ds5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:DEixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T19E652303BFD5C2CAEE4A373D909653FDA6D6DED5281405C3C257203268BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 08bdaac40b9758934d8caeb3c5e9dca1d8578529056c686902c989dc2c50c850
MD5 146fe7e567ea5b4f3c0550ef2af2962e
SHA1 e01ada439bce1680a6695409d02b235a10537ec8
SHA512 03abb13f4c1bc6720e5b4b1f45d1e20088c00968425f4a6cca6046781f4092207805bdc4f7572b959ea81ea0cffed4ae38907cda559e6152d0cc0af628193e43
SSDEEP 12288:5L5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:51ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1D2652303BFD582CAEE4B373D909553FDA6D6EED5281005C3D257203278BB6DA593ACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 e64e75aa9a2d66db0acfef7fc388d9a9fae8ed989767140affcac66a1263a2b4
MD5 e4462a6462028a890c8fd433386ba694
SHA1 a088fb5f1fcd2d6e6976eaa3406e949c926a8bad
SHA512 fef91c3f0ca23ef0e69a0737e17bddb428e81ecbf9f3f3cb6629de0ea0b9336fb08f876c448f82cfd2d411a86244e629ec79ae3a6c418956721e9094580cf2f3
SSDEEP 12288:VP5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:VBixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T18B652303BFD582CAEE4B273D909557FD96D6EED5281405C3D217203278BB2EA593ACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 431046aef25060e6c8bf3256d5e7c7663a6b3a0ffbfdde94961e1e440bc68eb9
MD5 03d4a44c936340683d96997a30a6b3fe
SHA1 c06364de611ae0eb83f008c3770c51a35ddb5cd3
SHA512 412c451874ac8bf0d61f34202f8002123a3c094a7f407897d37e2fc56aa40686470105285c829aa5ef682c5a212eb560cddee0302519052edf07ac93dbe958f8
SSDEEP 24576:VZMSzFVSOJixOFthHE8MEX1XsdIAhb0VECwN:VZMSzfFixO3hHE8MEXWI4bMQN
TLSH
T12C850195B39018F8EC67823EC8558A56D2F2BC5A0A60C64F03A536275F733E11D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b6d2566a99997c383686ffead8fe572906baf3066cc6e1dd542d627e2f5ab069
MD5 d44fe2afc18b30e6c8ef62d3a56ab757
SHA1 9ecaebf1ee1247390872265fcde2ffbacf890e41
SHA512 70c7b72b3453fbc580ad4d2485aebaafab65f2eb8b62d0787abd58bbfc90c4636e9cb8f4042cf305c527f55173b9e3335610e6db107cbd24a3d3800d57b6e5f1
SSDEEP 12288:nq5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:naixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T155652303BFD582CAEE4B273D909657FD96D6EED5281005C3C257203278BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c8c5738e1fb635143c0a37ac5e4e7f7ec24d16b96cfc9a265f95c814f171b165
MD5 7b40f2ecf508fa63f5addaffa9e379cf
SHA1 1f08757e2a31e2e61f0c15d4add8689e3c440ec2
SHA512 f49cffc0ad47bb07405d7e15618faa0ce84e4ee083b8ad13a8ad3dbe0d2c2c975b184d72f9ddd3f4b2ff72b2dc1a2840391c713e4f8fc8bac62ffe79a4c467a6
SSDEEP 12288:YG5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:YuixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T157652303BFD582CAEE4B273D909557FDA6D6EED5281005C3C257203278BB6DB593ACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 6f0470fcb65051b0bd524192990e579cafe3bdf0d327db4809b586513b227b46
MD5 f146eed6623c9fef65dbd71e8f8a7bc0
SHA1 1dca78fc67577456ecce829a1be32966b97b3e3b
SHA512 3930e901fc43c22ba8a70ed175c5af4d2aac47692288e342d74efa689e5db96b5d5959cceec4cf58be419d8fbebb2614fe0daaa7ebe965f5fb5cc64dce17c07f
SSDEEP 12288:jyPz5L8T5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:Ozy9ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T19875020777E120F9D5675238C8A21B56F7B2B8720B208ADF536106762E376D19E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 6b3845d9108ed1ea99e0412428e6096ad6c156213569d877c84a222a4cae00c1
MD5 545102f1d7280427b521d84611d69002
SHA1 263fd7daf9cf778f0ff04a1c85597fa4869b781b
SHA512 c0f116354431d067a2dbffafd0037cb64e7f4e8af40b9ee2f29e187f34baa1772d95bc1a91b07f0a64a8c59fbbf870bebe73f95f2b3f5dc421ec45d1a5f9c550
SSDEEP 12288:mq5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:maixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T16D652303BFD582CAEE4B273D909657FD96D6EED5281005C3C257203278BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 57b74a0105a44e662f0079f24d59959354708677ff431810c6ce75de1c6ca8f8
MD5 833d87b166385b377fef394e6e90b619
SHA1 8ad4e6e2d261c8c1422e150d541d44fc88883d7a
SHA512 e59a6a54fac53cbfac9b9736a8564deeb343b1e4b325b354e38747fca1f10c31963f9026ab85fd78fecac5b9f9e685aee7c9be7ecb40a962d526660d49fcec49
SSDEEP 12288:3q5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:3aixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T159652303BFD582CAEE4B273D909657FD96C6EED5281005C3C257203278BB6DA593BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 2329296ba2376f7619bef0965affe02d65027e6a8b15e10861673b9bd2dc4508
MD5 37b3724a3372f9a8877e55281573413e
SHA1 3bc3bed371826ce0647318d5d6f53720e35d9df1
SHA512 ef7782cda0726f7fc049e83de24387effe2d31652c2f957986888b8608bbf2c49244978dffab025c63c4521644618c6ea4bf19d39e9ac95ff1eb46e78224e10f
SSDEEP 12288:TyPz5L8T5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:ezy9ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1A575020777E120F9D5675238C8A21B56F7B2B8720B208ADF536106762E376D19E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 5f4ca620b2acf03b3362cdc4f794432278235618a71c9f7af748cf765e2620ee
MD5 1911ca955cdf4138295d74b63d36b37b
SHA1 a6434655bde66cc97e9e741b781f378c26b388a6
SHA512 aa1e3037ad90ff7c4ddbd7057cac371c54c96ed479a0becb06b938aaaa4deaaaa670e0199d5ee12734b02135f472951b9b21e4303884f5860d9687d7a10a421a
SSDEEP 24576:OcP4mcvIjkGOxhKP2l71nNKbrh/8KBSixOFthHE8MEX1XsdIAhb0VECwN:pP4m4IpOO67W8KIixO3hHE8MEXWI4bMq
TLSH
T19F65AE2DABDC0096D0BB913885658B4AFAB1742A1F3286CB1160933D7F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 61376fbc236a02cc41a68007d58722f1aca3048a76061c727c7e854dfbe19832
MD5 6ea1490415f043bcdb25817a08567296
SHA1 cb56a31c3f715a7a5023aa0a65ccd9b2da952d33
SHA512 c101557fb2232afe4cc84f4d7355e3fefbc2698f921c5c6fc2674ae44205e461504d481442c9b3dc5b43de46cdd0991ee8ff3dc8a886d97fe5251261193cf2b8
SSDEEP 12288:cNsfa5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:NKixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1FD75F10AE39842D8C45E2239C7564B85B3A3BC6547E1D3CB52C1F53E1F766D09DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 8e5912c55418a304e44be0823d75099773cfff4b5ccd71770c7a39b48d435c25
MD5 93c4abe995048ea2d6b1126ad1c52f1c
SHA1 01ee2c4c1f7b211eca1e256784c3eed25222a65f
SHA512 6aed3fca9ef8ae040c16ccba8650fc599a6f8e71f920b6ca6ebb79ddc58d74866dd7b6bcf141ab04d4fc1d972b6e79157b532e44d04d669b0662915e47902b1f
SSDEEP 12288:q65i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:qqixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T141652303BBD8C28AEDAF3B3C505697BC66DBFEA41E1085C3D103213668766D69D3AD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0f195d6f6ae7e514a12e3e72af49a92262282865877da73168dbb21bcc2a6ebc
MD5 ed7b984169e6ea4be94940e40a9ad5bf
SHA1 ed89ab6bcbbe4c219037d540b4b3eaa90eeca6aa
SHA512 667801a0a54d4c686e15fc3bab4476d3fdeff59ed831f6184b2597d9c99c6694f1d4bf8476cc137a0b27cf1c2f1fc25be1dcb8f7b93568e1407a85a6a9b1259f
SSDEEP 49152:Xa0h2GEkuAe73q3pp46zwwQEixO3hHE8MEXWI4bMQN:Xa0hNYG4Jwco3tzfG9btN
TLSH
T1B2859E1E67EC82B5D0BAD278C9A6814AE6F2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 ad2d6ff3a284a3490d3922b013d84302413227cf3be8fc44fb3dbd22869fab66
MD5 7ca9fbe8e3f43c1e5ffe11c500bdd1d8
SHA1 c7a28f6625b62b167eaba42aaf45d2a7dc428e80
SHA512 e504b81bd0bf69104147b8ef07e45657fb1b94199952eb4aa463290a799c696b22ce358a2eb4e00fa93674d61b4321ad806da2603a9592e903d24cc1459c60a9
SSDEEP 24576:yhbHjPZixOFthHE8MEX1XsdIAhb0VECwN:yhbHjBixO3hHE8MEXWI4bMQN
TLSH
T13475126E27EC10C9F576A23C9196874AD3B1FC651B2193DF5382823A1F3BAE54C39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2d60666726c29e0c9d5fd33aa92b2fc8a75b0f8ca94b0544ef7853919ef8ddea
MD5 208ceba0279a3a5aeadc6f3760ccaa3c
SHA1 d9f3544801d3051179b94e22431f16e81e837794
SHA512 e4139bc7c3517a060dc0b6fdbaadeda149f479c994551fcb5b377f5b189916606975da590637ccdd0bae60b88013f1e739a823fee143bb9cd4df791d73454786
SSDEEP 24576:G3YgnJcRTk4yti+R5dBR/RixOFthHE8MEX1XsdIAhb0VECwN:GIgnaTk46pBR/RixO3hHE8MEXWI4bMQN
TLSH
T13445BF2EF3B910B9D8AAD236450147B5FB71782D1F209AC70170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 74e20f134c7f2d683789c36bf0da555271d3242816b047d383036dd2beff1642
MD5 98eb26c32bbad6ae7c7acdb4a4ee084c
SHA1 b86c4999a63b695349d80b5d0989530ad5539a1f
SHA512 2252dc22234d427aa4551aa9d638dbb07f55fb3493c6fe969e32a86365377304b71e537862599f39bf9776756a793335967fbbb1e66a2af3ce4f3942433cdf2b
SSDEEP 12288:TW5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:T+ixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1E3652347BBD582CAED4B3B3D509697FD62C2EE901B2106C3C157213264BB6EB9D3AC50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b778cb84a475e38ccbd6fa8f1b9ca732d564ea40d7225ba3dcd0855f52372086
MD5 1e733a42eecf9b581b953cb40a29a163
SHA1 f96fc3258032608abb567da9536e707919ccdc69
SHA512 4592d93380227cf9722abaa98430d48c3e6d9c77fc755a37f6c56c11ad78b76f51bf51a2b5d2133cedaef9a6c66f3b1c21d0a52869b777a58a2841a90240b812
SSDEEP 24576:dpL3UTrixOFthHE8MEX1XsdIAhb0VECwN:dpL3UvixO3hHE8MEXWI4bMQN
TLSH
T111950145F7D400F9ED6B913CC4A68616E2B2B89D0764E7DB03A94A651F337E24E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 25cdd37d3c555bad28bda8c4a9c880ee168d76c7200b082d391988f2ea9807a1
MD5 ab1ac5cabd60070ba17ac572417c38ca
SHA1 27f426baec6311dfe963bb836ca64fbc64f6ecb7
SHA512 b3e1f313dd17995dc182b86fd41d9125492dcd52b8f3be833147aeb7c4a31409f907efafcc50b7cce1309188c408c0316554c9cf005d98a624d28049d58643ec
SSDEEP 12288:kpFtpON5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:OOPixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1CD75020A37EC10D5E56A623C8592835DD3B2B8A10B2257DF4291817E1FB7FF86C3AE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eac2e5f42a8c8a51d2474214fc1eac336a83ef20b08500b81e2a33a6f1fe5921
MD5 bd18c6cf27d41966a99350eb6e85a53c
SHA1 5f90fd9579eae420b11217fece880f2fb3ec5bcd
SHA512 bce18bff4efff85d91b66500941c5ad59efa9621be5b408db5c2c9e4bc8dcea6ec8067c759f2dd7e56b95e6b23296b690fbbaed77939f3133c138221c4165ef4
SSDEEP 24576:s7NM9YqZqmWMUkPjZM48Mv6bEhsaixOFthHE8MEX1XsdIAhb0VECwN:s7cBWMpPjN8DbEh5ixO3hHE8MEXWI4bD
TLSH
T11165AE2E6BEC81D5D477D13DC9A28245F2F2B4611B318ACB5152833E6F37AE44E36B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f87d2910d9effdfce94d980622d02f611a8eaeeb0c3e739522b68e772f24b466
MD5 eb9a07f115f8ceb605357603a6a43a0f
SHA1 8b8766527085eb553de75bd58d431d4de429b8da
SHA512 c1bd082620b9085d3a5637c4642dda5113812ccc6a29729d9464a483cfe62733fd5261519f56fa16bcc9da9a62ce0554ba1d8008e2e113efb3a442e29a782cb7
SSDEEP 49152:OF2YuHNETovAvNYf8km6ixO3hHE8MEXWI4bMQN:/6BCf8k6o3tzfG9btN
TLSH
T1DC857E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8177881a9dcbf7f408368d47f7d5c809525ee9da74e0c84633fc1a68a23b65d7
MD5 4932aa05aaad9265db201716b2c2af52
SHA1 e80d59ad454cef06e1b362e295b751edd362d1ab
SHA512 b70ee15cc63c491aa92370d040b35c023d7b669f5d3c28bc9c4f6810fdac14662bf51df73ada1a69a30c6e859b88ab55a0cc0feae0b8bb804ef408e2cf8c6010
SSDEEP 24576:iAFs06+Omlf3NXEbTozixOFthHE8MEX1XsdIAhb0VECwN:bFs060lVXukixO3hHE8MEXWI4bMQN
TLSH
T18D65AE2F66EC00D5D07ED17E8997C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 4461236a1a82cc6283e56993f224e02201541d2dac71b2d53f38b953c41a98ae
MD5 56e6c8d9d585c85d75507432ce8ab309
SHA1 99e791d45cc741da95077136c96cedaef254b867
SHA512 e48807a94b8bf1ce1365d0ceadbdb81f16ce0cd69fad065275aca3cf08a31c5e71b72dfba4a669f3516d3b0943ddb643dc03c9b3d5117b0469bc878de39068fb
SSDEEP 24576:aJnJ5D3WXkixOFthHE8MEX1XsdIAhb0VECwN:aJnJ5DGXkixO3hHE8MEXWI4bMQN
TLSH
T1AA85D02DD2A810E8D4B7C278815A1796FFB2387D2F2269C724B4D5353F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7d03797b0ef2750d7b30ea6dfd1658f8117789cc812af27eb4d0859787d12971
MD5 b336223fd5004068317c82221d4b8d9e
SHA1 4ab95c814b71b5f9a0b3dca04116ca18bdee7176
SHA512 b67c231ecee8d0e81b77b13d31137b360013de493f8a28a97da80bc3f2a3f3db0573465b448b6e21da3deadf6103899031a07139d3e04386352fc4d0b1556054
SSDEEP 49152:Vg06DIKdwc+eQnSt65aVGixO3hHE8MEXWI4bMQN:uLo3tzfG9btN
TLSH
T1CC956C06B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 39c31a7c7d22ef73068be8304d866750311c0be2d579efc08e1c3f192d9603e7
MD5 8781654c24dafbd0373e422816584e81
SHA1 43e060a80d9c035d457d7c885ad962c2aea25bad
SHA512 2da99d1a8132585581adbf1b38d3c56050dece7a5c1473d8d2cb7f4d3c5a7885cc35548ca36c1638413616dc931e0ef6008425ef3b40f8ca4531e001047ff82d
SSDEEP 12288:tEP3RnI5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:OnYixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T12C75125E7BDCA0D9D52A613D80918759D3F2F4B02B1227DF4292823E4E77AEA1D3DE10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 cd1c62b730c629c51aaf03f0b046c7b60eaa1ce9d35f7085043c14b3cf2ac1b3
MD5 7c900f544de59623bf1791eab7fe5b09
SHA1 96630357c4cfdf0ae11f838c8d190971ec847169
SHA512 a8609daa55abdd38fd8233c5b992d50d8221fad30be7e98ed5d3feebec6d7e942680773886afca1dde460fdae6483d76a25204bcd93293ce2d6050f09a152fe2
SSDEEP 12288:OjkyX5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:OIypixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T1D975120563D890C5EAAA163C95A383E89BB1FC601F2056CF9181B23F6E77BD5AC35F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 ca6c6977505a95c6c1b47c76114bd3b854d713186459e1f65ab9c1e20d01ed1c
MD5 699b5c005d56e356453c19133a477d2c
SHA1 ddecd470bbd743f074a3fb0aed5070df8dfc980b
SHA512 e6fa8ce302e7705751b0cb207aadfde98471cdd33d0c680779263f4a070369edb4c714b95c37a571721c5dc87ed996cb276b7deef69a5eed44e273674c212b4e
SSDEEP 12288:8yd5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:pfixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T17965230A7BD5A1CAED4B273C506657F952E2FAB01F2018D381D3A132A9BB7D7593BC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 456416ac83875940a12f32a6e57318cb3b9e0ee9e09a46d7184773ce19648116
MD5 9d7951c2fb1bfd12ca77e15911b90446
SHA1 d312e07b7b09a496a7f04f10f3b3454becd2c3ed
SHA512 dc53c83809cc4d7abd7e4082d92cde834f943a7e225ec4c80bb2e927a9790e4a495b64492ea8f8b77608e515a2077ef2c3d416aa294a82285b46b1ad4c551e34
SSDEEP 24576:bQ9MxZKdcz9dw3CixOFthHE8MEX1XsdIAhb0VECwN:bVKZCixO3hHE8MEXWI4bMQN
TLSH
T176558C2DABE9058AE177D23994A250C3A673B4311B31D6CF2449D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 75a0762ccdc995309ed6711edd63ecb0a3b4687b303cb658ce4b6eb5aa22966b
MD5 4bd387727c585bc2db95df7156f4aa37
SHA1 97c33344ed26fda89cacf0c65f6f8a7c12cdcb32
SHA512 97658eb56c9a9312ea043cb20c8aa718ba02d3b7876fafcf75570e787e4d0540f3b82fb867cb7dd3393206a53743f28accee027321718330e1f5df4d028c519e
SSDEEP 24576:oyocDAptixOFthHE8MEX1XsdIAhb0VECwNd:FocDAptixO3hHE8MEXWI4bMQNd
TLSH
T13985F10FBBAD40D2E166923C88858345E7B3B0701B6257CB5192C33E4E77AE9BD39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 da059fd20870923878f672a33b501fa856ccc748a6a47fcb951c64058b5095d1
MD5 2547f9ca3d4aa044b7e1894d937abbbe
SHA1 ad03a7222d3bed0f4ff02a20ed251475495da7b0
SHA512 51644481c4614ec51e9d0fb2e611a001557957390c4fe6a57f7c6e63285d7dea460e4c58c835ea9e0f1775ab6d2a015f54204135c600678e7b1c7b7f0f03b869
SSDEEP 49152:5WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKtixO3hHE8MEXWI4bMQN:h0zuNImo3tzfG9btN
TLSH
T1DBA57B3DA2F800A8D8AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4c8b6767ad104107fedcb7dabad305d71639d160f4fd4167b8cdb9ef21ee4332
MD5 2e8f167af5160bf53f7545029996b26e
SHA1 fa423c58c41d825210f4c0b82c0cc4fe1e496d34
SHA512 f7eca830ebc323efed52564078d7e468f9c8cb42021ec48ff9a8fd36d9dec8d6a49d8fbb1053c3d08153750dbffd08799604068535009651a12eaea533b14603
SSDEEP 24576:U1QT7EcpfxR+N5AWAz3ooiYtjMqbYixOFthHE8MEX1XsdIAhb0VECwN:pTDxR+N5YzTfjMvixO3hHE8MEXWI4bMq
TLSH
T13955B12EA7F815E9D1BE85799A23C512FB727821033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 350d66d32484159d19cafab6c06d788e0b6d0d28068b2be65c1894f82a2c7bca
MD5 a690750b809beb3d1165e409cbf4be1b
SHA1 96511455d391c91c9576a913b44071260deaffda
SHA512 2d81425f851080f80fab5e2b4cd73ca8f7204a786395c3000de1c3cc429a000fae896ad3761fff3a169073cbf50e03a93fd4a1fb85275ece0bafa7509a064316
SSDEEP 24576:STMdOz0FFS+imSLMixOFthHE8MEX1XsdIAhb0VECwN:+0K+imSLMixO3hHE8MEXWI4bMQN
TLSH
T16585E13EA7AD14E5E47BD27C96438A06E6B27461032166DB0290C1793F6BFE4793EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 65709bf91c398597bb9b8aa133787f51af92563cf9354f8a52cd0e5b773666a5
MD5 8da2a1ac2228b8ef5023c3e4ccb7a8bd
SHA1 e0e5b3eaa5c426200708a55ccb4fc99da941e93c
SHA512 3d845ef8e5e43c5b4f46d1fb27e611881243c95db9b34be58c164b798e7aa33e1b89d7e9f80ad122b01f1eff53cb2a05d99efc0cc61330e183b621c6d3cc7147
SSDEEP 12288:K4KB5i5wX6OFFmEhHE84P6vdUw1ZB+DuskmIK5dG8Zso0VECwN:wrixOFthHE8MEX1XsdIAhb0VECwN
TLSH
T10575120E77E820C4F867623C956643A992B1FCB127201AFF21D2C53A5F37AD59939F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/112-172-0x0000000140000000-0x000000014026C000-memory.dmp

Download

memory/112-85-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/112-91-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/452-354-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/452-175-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/644-389-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-395-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-388-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-390-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-391-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-392-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-393-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-394-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-396-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-397-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-378-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-379-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-380-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-356-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-357-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-358-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-359-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-361-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-360-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-362-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-363-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-364-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-367-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-369-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-371-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-370-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-368-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-366-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-365-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-372-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-373-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-374-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-377-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-376-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-375-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-387-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-386-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-385-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-384-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-383-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-382-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/644-381-0x000001C5F46E0000-0x000001C5F46F0000-memory.dmp

Download

memory/840-174-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/864-138-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1032-176-0x0000000140000000-0x0000000140257000-memory.dmp

Download

memory/1328-217-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1824-67-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1824-65-0x0000000140000000-0x0000000140296000-memory.dmp

Download

memory/1824-69-0x0000000140000000-0x0000000140296000-memory.dmp

Download

memory/1824-62-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1824-56-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2020-40-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2020-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2020-34-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2020-353-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2344-75-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2344-81-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2344-222-0x0000000140000000-0x0000000140290000-memory.dmp

Download

memory/2392-177-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2392-114-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/2392-120-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/2580-169-0x0000000140000000-0x000000014027A000-memory.dmp

Download

memory/2808-183-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2824-25-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/2824-299-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/2824-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2824-18-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3012-184-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/3012-200-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3012-437-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3012-223-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/3012-351-0x000000000C970000-0x000000000C978000-memory.dmp

Download

memory/3012-220-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3092-436-0x0000000140000000-0x0000000140287000-memory.dmp

Download

memory/3092-219-0x0000000140000000-0x0000000140287000-memory.dmp

Download

memory/3276-178-0x0000000140000000-0x00000001402C3000-memory.dmp

Download

memory/3276-131-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3680-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3680-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4004-355-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4004-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4004-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4004-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4064-182-0x0000000140000000-0x00000001402A3000-memory.dmp

Download

memory/4320-218-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4380-0-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/4380-71-0x0000000140000000-0x0000000140297000-memory.dmp

Download

memory/4380-8-0x0000000140000000-0x0000000140297000-memory.dmp

Download

memory/4380-9-0x0000000001F60000-0x0000000001FC0000-memory.dmp

Download

memory/4824-173-0x0000000000400000-0x0000000000658000-memory.dmp

Download

memory/4824-98-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4824-103-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/5040-295-0x0000000140000000-0x000000014026B000-memory.dmp

Download

memory/5040-13-0x0000000140000000-0x000000014026B000-memory.dmp

Download