1e96ec20d3dbb537a804d8a5ed56112355adb0524fc17d64afb191e06805f46e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Size 1.5MB
Sample260728-p5k3laxbme
SHA256 1e96ec20d3dbb537a804d8a5ed56112355adb0524fc17d64afb191e06805f46e
MD5 7cd03fe6bc854d3fdcd18507837c9ba8
SHA1 5d46d50f06a1b183c39043f551d9f2ce5eb2f8a9
SHA512 6a94d51e9f9c1c6c2fd7ca91cff9b1ca205a2759bff8d54c5627542cb5e04433816384529bade2cfd5c6539b792c83fe7c706b75466b6bb61bf0154401980d1d
SSDEEP 24576:ruqj3f0uerbtBivK1sqjnhMgeiCl7G0nehbGZpbD:rnD0t/tUCpDmg27RnWGj
TLSH
T11675E05AB2A850FAE96B913C8892D149E672B8110B70D7EF13B1066E3F337D05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2720	alg.exe
2484	DiagnosticsHub.StandardCollector.Service.exe
4816	fxssvc.exe
2108	elevation_service.exe
4584	elevation_service.exe
1532	maintenanceservice.exe
4948	msdtc.exe
4540	OSE.EXE
4424	PerceptionSimulationService.exe
220	perfhost.exe
4316	locator.exe
3376	SensorDataService.exe
1844	snmptrap.exe
5008	spectrum.exe
3532	ssh-agent.exe
2756	TieringEngineService.exe
3512	AgentService.exe
708	vds.exe
4748	vssvc.exe
4196	wbengine.exe
2236	WmiApSrv.exe
4796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8935ae2f3a3ba122.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\java.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\CopyConvertFrom.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1ddc64e901edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c239614d901edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b56414e901edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022143b4d901edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b47f04d901edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4816	fxssvc.exe
Token: SeRestorePrivilege	2756	TieringEngineService.exe
Token: SeManageVolumePrivilege	2756	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3512	AgentService.exe
Token: SeBackupPrivilege	4748	vssvc.exe
Token: SeRestorePrivilege	4748	vssvc.exe
Token: SeAuditPrivilege	4748	vssvc.exe
Token: SeBackupPrivilege	4196	wbengine.exe
Token: SeRestorePrivilege	4196	wbengine.exe
Token: SeSecurityPrivilege	4196	wbengine.exe
Token: 33	4796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeDebugPrivilege	900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	900	2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2720	alg.exe
Token: SeDebugPrivilege	2720	alg.exe
Token: SeDebugPrivilege	2720	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 3260	4796	SearchIndexer.exe	111
PID 4796 wrote to memory of 3160	4796	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_7cd03fe6bc854d3fdcd18507837c9ba8_cobalt-strike_icedid_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3992

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4584

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1532

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4948

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4424

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:220

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4316

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3376

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1844

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5008

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2152

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2236

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3260
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 212d2cebb8bc2db9465df38e54633291d18edadb5f2160bc16e8f11855e63835
MD5 5b617f137695898a69871bf1907eaf2d
SHA1 e6c037ff4b692090c293d0b022ccc98b1925811c
SHA512 1d152f1c6c0cefea2be5864ae32f10fbc63ee02297a5566e8ef91bbb9a5cd32b5e12c069fe1c44d998a9397c819e06e0828221ab18818beedae2b02efcfb9751
SSDEEP 49152:ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnmDmg27RnWGj:M3q6sjBtD527BWG
TLSH
T1D4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 598fc717e12b792d46f90305553ae4aeb0fd3651aced162703c0f284536bca44
MD5 1c786c60385a061669085fd69285a1ac
SHA1 6685d303a92043e109459e2cacb18701637baccf
SHA512 9f0406d103ed365fa9e3d169f68bbc133c60cbafe33da694743c361db976157a5ef4d6088507e4ea1ff1545cfcfa880a91eea5d204485585c9e59d2bf5d02474
SSDEEP 24576:mXYfDtczAdsqjnhMgeiCl7G0nehbGZpbD:Ftc4Dmg27RnWGj
TLSH
T13A65F129A3E408F9EC67817CC9A2C515EA337C554760E6CB03E499795F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 677bd771391e3db9c0d21b2576e90a4fce4669578750e698e62cdc97d48ebbb0
MD5 69b7b8ef20f667aa2ee3cd1f7c9c7037
SHA1 08d44a2844f8d3bd86f20bf41c57dee42ff847bd
SHA512 f12608d60f0d1c11009070243464ae8ce558c2ca136956deab1a8ae45c3cac66b677d9bb583f7f4ef97d299a2fe5007adc8a55ad3f0ae50da383dc747d45df59
SSDEEP 24576:B0Le5ji0hmxxrMasqjnhMgeiCl7G0nehbGZpbD:BPji0AjXDmg27RnWGj
TLSH
T173859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b74eb1d2a31a9a891993ab2ebd79674e3d6864e673dbacf71d3dd7df90e17cdc
MD5 73059ad3c4a973af0fd18f56e4f03b5a
SHA1 75ad2505b3a2b44bc3734c1301e94d158ba552da
SHA512 7cfa06323f2812cec088c9b51e3ecf1c1bf0613a45de2aefa128ae117c90fef802f680d8600c15bd0420ab8b304afa384a4b293e0670508c03a3c8c19568e6b1
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyucsqjnhMgeiCl7G0nehbGZpbD:w/ezSC6vUzPveHjybDmg27RnWGj
TLSH
T194755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 46f1d575189cc0990b858189a1cfe1a552c6df1371560bebfbb44135b48bccfe
MD5 895ffa833bfcf25bedea68833074c7a7
SHA1 49e7d5bed9e5aee82e4fd83a97009a63b00281de
SHA512 bb49f1c4864de7fb9b91d9272fe442207fefa2dcef8193f0568b65b555e969f1c0937518aa1b099dfa6639b1804bc7eca314cb96a971728a4863aa146474a0aa
SSDEEP 24576:0VbqPb88hv/l+Y5sqjnhMgeiCl7G0nehbGZpbD:0VO88hXl+gDmg27RnWGj
TLSH
T1DD559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1a7a8472019991cd382ee16646d62366ee1d984f722af9b2ec8633d6e903896c
MD5 845f946786a02853c8c5f0d5f60dfbef
SHA1 7cb38102a1d41eae1a1b41f3773a12fd65cf4db3
SHA512 540c644fee005225bf2fe6c42cacd877ecd630294a47d78518a70c8ba12404adbe0d96d2b84ab7329c7a797bf0553ed9108e69c4f2336ed1ac8db416ac42e8da
SSDEEP 12288:JLWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JLWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BF865C50CAEB7608B5C3E9F51EAC137E56982008536AA37CFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 36d570a8ff1def1a91715b0f262a87d4dcf9f6ad7e6e170a5bb3927941b66536
MD5 cfe2fb32493896dcb1e01752e7aaef3d
SHA1 9f02785a453503b56e8e5b9e0427d75aa24f3ade
SHA512 282b07520ededded2f7f962e3dca22af13b1cf162acbe12e43df5651b3c68d2f4b3a7031f96b8c339b426f0183c9ae1e7bc4833efc761469acefd4cd1492ae64
SSDEEP 12288:VeBNUbTVO86URXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:VJIURsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 563b92ae6c6cfe2e3e8d9c93e42603b34e17c539ec3d5c6e455ff3f645a80e0c
MD5 12016f961217e7ac6d47573a5448428e
SHA1 ddec54e542fd8182e509b9d7a47021852ad68fbe
SHA512 478ec8ec48cf9729b49b0cdadefcb91ddae8a2493ffd8a3cbc10c42027047982b23914b8d8b2b840a34c3b1f7bd54a0d84b366f6b9c47ef847152f06374330db
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THQ:0QvGAdlCEL8c/DRNw5CYD527BWG
TLSH
T107266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2fade10baee540ba3b2299db13596bea9848f2709dea3ddd8791494d217c68d4
MD5 44c33f39960e31543cfde35fe21472a9
SHA1 7cbc70c0739f5f876792affa15fe3cc54841a6d2
SHA512 907a5d904c1043e55a4c63368b9907fb65b9e087550d8e45a014fe30c41bdf23c2e4e3cd91f85f65c99d34348e358ca713caeac9719a36bf86981d8ef5601c65
SSDEEP 12288:+AwSfxL/2Dc3RDLLmt0LDQewsAjjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:j0ewsAjjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e368e1bc0413bade6877edf596bb58f15aa81492187cf9d086647f8d38075656
MD5 8a9befec39dd95ec36e4ce0fbcf9b538
SHA1 01b7d9653367ebbaec7a7bda1b49f7d20b090ef6
SHA512 01d6f945c7c530b056a127dc0441ee7cdeeb52a2218f7d436730539d54efb3d0e1e2898e5d68aac7bf305916d778b8a8a03f01fbbb5b9033523bfc53b41f699a
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHfVQBWG:rUEtQevvqc2W1cpV2tI32WB
TLSH
T166474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b1a059cfd15e7f95aab77d0979b9bffad7c4d16aa0e42885739079c68ad99344
MD5 1d766a0c6f329003c34af84d56b94726
SHA1 2414e90db9a4576bbbc6369bc6fb5f4c0743d5f1
SHA512 9b9eec4bcd29f34e57729967f1fc5932eccd4ad6a19d26d0b20556029023e30a2f8bf0838db39b813b1c829dfd3a1e64a493f3f02acbe933b945dd2608253018
SSDEEP 49152:jCbRquA/m2yL5zTfFiV+XenmE3/zHDmg27RnWGj:coquVjnmcD527BWG
TLSH
T162D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 749d45bddbbaa3f45d7d5eccc954abdb9b0fedf869208f25183d47ea59cd9b0e
MD5 74475cf95533833828f08e614941fbb9
SHA1 93f06835fd5d2ce303dd1af94f7e345216cf8fa5
SHA512 2a61233fdd4e0548004de89f365f11b77ba102434d647effc17968f3fa5a2265206144bdac3827b71a90ad69319f870c8012813c03955b0fccb65a31b8b8d183
SSDEEP 24576:6AhGL3IFoiwtA5l7S53AsqjnhMgeiCl7G0nehbGZpbD:6AMUFoiq5sDmg27RnWGj
TLSH
T178359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 78e856fb554feb6035fec51aec533020abe06931bce51c1d30912682d64eb91e
MD5 592fe3d276932bce0b3d12479e3edcd0
SHA1 efb9d831c6c674ba67d04748e25ed7f6c43b733f
SHA512 7d6d666ed361cacd389caa66c92bfef2f87164f7ccfafae179830fc9078a6fecee64715ca1f388d144eba423d9c638c059a3a0b45238b5d12e97899bdcdc009f
SSDEEP 12288:Fmw5HEjsChNVBFgl0WDm+C8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:gwu4OWnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17365F14A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 fb90ec8ea9a66293d3a8651d6e37d04cc28fb9ec96c6853650b587c22beb43ab
MD5 37298dd73f5ae6759b00c6f47736e377
SHA1 10b9d7937bb3c605c89e4c5a7c7cd5bc6724ab1b
SHA512 ad025c2d7d8e309ff80bf21416d96f7dded039a83e9fb092f4cebca99715df867b26b213b93c30bdaf0a5517d4e6f14c9fbf4fa0cef43ab241f1d562c464b44a
SSDEEP 12288:QeZ1IyzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xZuysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D15512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 195f8867cc244ab70a2efb044b643d26e9b5c4e825a11d699cd4685137900125
MD5 e875d9c4b97db12531bcf92729dd93df
SHA1 1bdc43ab52e8f1176f9e9ec0bc5adf14903ebfc2
SHA512 4f39bece1f8c8a3bb7258eff63b5907ae6e96f1b874a0fd3464d6c4b8e8b4c34cf383b0ccb15dcef6747eb785ea8104507dcd050fe2cf02254fe14e262a03b7a
SSDEEP 98304:zQRQyi36YOcPbLvw2gAf+PN3pD527BWG:iQyiKa/X+PNZVQBWG
TLSH
T1A2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cc30b456d0e4f34b169197b2911d5bdc723aa82664c4ab753281a48fc64ba5c1
MD5 7250a17378f382ce7f324bf5e7693973
SHA1 557cf8c861453f71664df043f304546b8e4b5171
SHA512 ef835f34a1997039b351bd43148efaea23dfccbc901d48e61a7a26b93530c1ae5a4e11cda51cd6f892783cf252d27ba5aea72f857070ad8e18a72c0374bc612f
SSDEEP 98304:zQRQyi36YOcPbLvw2gAf+PN3pD527BWG:iQyiKa/X+PNZVQBWG
TLSH
T1DE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4b6834f01d4be2fdc31a7131772916b015439694af4e9b0dc178d869ccf4ddec
MD5 6c5216af4935b81a4309aada0e515ebe
SHA1 472528db10fa45add9b67067487de50512e93ff8
SHA512 58c617406d14530e35e00e65cd8fbb28f3e578f50cb57626748bb0ef6a99fd177cc3012fe9866a90ddd009bc40b5caf10598baed142bde95e0abd6c54b8bcfda
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0isqjnhMgeiCl7Ge:j68Qg55nhceWu7PNU3/XDmg27RnWGj
TLSH
T13EB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 001cdfb31132357f4d9108ec1f210a211122f12358514044320533a629993e5e
MD5 86b347304b671fdb2ab56ec9657c979a
SHA1 66d2d5769fb256bef7f109e8c0d6ff9961182264
SHA512 8b655a1e2c2f8fdcba01557f595e5a0d12482bd67c33e20a6236d833a746bf87ad04c2fc038719abe40cd8e024afccd49630c886e2eb955704e39cb45a6e359e
SSDEEP 98304:Xy5112gYy5azzVvt69nLKnhZaD527BWG:qLIHEWh0VQBWG
TLSH
T189167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e4716138144c8d634eb48f5ca20971ebd45890fcf09d3b04d4bc518c5972bde0
MD5 f83b9019caf2a153206252bc06d26db6
SHA1 6d7b73d5ed63369b94dc7a3b3871c0730130baea
SHA512 b81a04b2f66092ee9a42057c0408c935c39ea31d6d429bfb3aab556b1b7911a99b112f069c6229018f1564f031dfd37ae93ccfbc0f8e91d65a68bbe37fd5fc71
SSDEEP 49152:zB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glxDmg27RnWGj:Fu6Jmdxd2dxD527BWG
TLSH
T159D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f5abfeeb106c3d3f7c2cfbab39196f31be93525ab184b5607a692e29b6f0f5f3
MD5 5219eba180dd8398fb68193aaa311bc4
SHA1 bcc34fe34e70e28ae6530ba32c9574c6c273985f
SHA512 868bfdae37631dd6b01a24b2615e128517f6962b54d2e6ed4d0c7b70b034764c7ae424d0260cfbdd1d0c58c0887ab741583b20e7b2d704d038d47779599b85f2
SSDEEP 49152:y1hpsNoJpF1A63U44CwH7R4xFDmg27RnWGj:ymifPWRcD527BWG
TLSH
T1E9B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d2d2dbd831fb4dcdd6598f3e3a291740e6f0359c7d74714e3692791579f59b9b
MD5 2247ec4d45275f61cc38133ba9b4e55d
SHA1 28edd842c91433c5187c155f044f2abe2670cf2b
SHA512 742efeb2b240fe86d4af97cf93ef8de180a08197228f7b9c2de6e901d2512df7a8297e3019e2e8e1f200aa3fd4de26940ce2a6de3b11a1696c3b1c3dfa1ae0f4
SSDEEP 49152:rSuZQIY0Be2KcRVtOnks6NMHq2Dmg27RnWGj:55dKii612D527BWG
TLSH
T152C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ea3a41c72920a2da0a5cc30551ab97566db4f3fd30b37c09f104648657a0de76
MD5 9bfb76e77e63d95acf75d3c86910fb4c
SHA1 56e61d4e246dc7f1e20c63d41056351d116f281b
SHA512 7a0c5c645581c7ebb9c4b2177b98024308cad485a064fbec08970b57c2b8c802e0538aa2f95f9fac75c815b0f3f6521db1f0c1b458f9f731874a86d15bcbb1c2
SSDEEP 49152:VhtSn8EApI0fig3giDn0AP5wBDmg27RnWGj:kX2imphwD527BWG
TLSH
T16795BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 dfdfaa1c6c3e907cecabfd1945ec2395f85797fb9fa81f762b3794269e46d3ab
MD5 d9bd74ddc452dd8c6d06dc24b9b95a89
SHA1 7872553671f34f3a24e865e1d34df919a37543de
SHA512 114f77581b29d14f7c5d4f040e95a2193ba216e1506ae530b6b2c52bdb49bc68daa23abe4161b76c699ed26b6232d026dd3a27cf87283a2209b709e60935bfd1
SSDEEP 12288:zuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F34523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBAFAB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 56497c646c3358d5de5a9e8aa485977ddaabe2de4ae9817461949494e4fe9ba8
MD5 1e6f84f2fce472cd52d23858a4566115
SHA1 06bc7daa7bdde7c28ed0ceb63d9c62c572bada0d
SHA512 ca44f03864c3b4d7cf62ead3eeb08ec06949564a90a344d64d8b7c99f8498d3f3deb8e578e6d79e90e41fa3ddb65f0ed28ec7c56958701540d4a029737ffc486
SSDEEP 12288:JPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D4523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 47d189ba95b6320660bafc0631b4b0ab406119060af185df3bcc6e87f3cfeb0d
MD5 adf29c03f9823cd847c86e9f1c43b27b
SHA1 86d2e4f10de0bd13b1f7d633380b6e01dc3eff31
SHA512 69284fa4323ece30d4566423fcb05c858dd72e22bdd64612cb178566ecc6099e8af97fc6b6df1a09c973b26d962a35c6ea4a465c4b62d5d54e69af97be70c1da
SSDEEP 12288:opXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:opsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F4523BE965C41CBE52648B5C3E5F10DAC073E5BE9200493BA977CBDFAB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 979153f9a86b1f29d2f286ba5cfaf4f5a599e05919915cc3075d29a9290e9124
MD5 5b69471604eccfc5138a9b5c2cfae451
SHA1 8fd1e893d30c53e97433bd47bf1640efd1a52b6c
SHA512 60362a6018301c518c9dd8ded9ac7a574f4fd8d690fb21a0db66aa84cfe1ef1143b886b1933d7edbaa6e3f093aa247bade8353793ee3804e7be18dd1f43df0af
SSDEEP 12288:zVgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17545236B675C01CAD83285B4C2F5E11DE8237D56EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 90a52f4e33070035f2ada1722aa9381cc2e8a6d37a4af21636c71da7ed79fc5b
MD5 404e87a532767ec24fd99e84ad3b3d5b
SHA1 e756e600dfee4d729b75a8679271154bb462f758
SHA512 3ec063c02c1002f51b69c25272dfbafa5252fa766a547a94d7510d735e68550fd3994c99fd6aa4f84278223ebe0d2542a0b401a22bfdc830dfc62d223f4ac22c
SSDEEP 12288:1oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B74523BF965C41CBE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFAB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e23ffb75476cee8fe94f36340a93180ea13c477d0de799dc9bbe3d9ce9bf75b5
MD5 75d42e8e90451d490c50e40b1961d5e6
SHA1 5eeaa95ed4e95c439d891514b91edb2882985dbe
SHA512 cb06223eee4b672e473757f705a2c8ccf73994e9925d105a2e9f1ccd3521315d35b9d7a943b9607e90f348d17495152c1afa0bbda5d3259f3a97458d957b76ac
SSDEEP 12288:H7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:H7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD4523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFAB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b7092072b45cfdad818bb5a83a046bc47e51de9aa04ac074eafaed46f090adb9
MD5 00fc6d7ef832dde61f946685b32a240e
SHA1 75bfd3ee4c92520e98b0681ad56388ccdb9103d5
SHA512 438da751a427a913d53a6751a630f456339b0fe2626bfdda8901b74654cf42280e72f7f2bef424b2e5ee9db2901e03656182f553ad12a3e9f24f32a76801244d
SSDEEP 12288:WXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BF965C41CAE52608B5C3E5F11DAC073E5BE92004837A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9d672e52265ed215bcd3cc5540182a11b50857b6fc91c58fdb9676e6de7defca
MD5 14b4a31c3c90dc95b92f3bfde268b0e7
SHA1 b6bce666d44123a02d8b3732c850b7addf3b8db0
SHA512 29d7b93549e1ce6a0bfd19a6010874dbc5741ae00ed66e8db81d0dd6d930d6f50e4858dd84dd167db27dff6a2b3e243292995c86d26081ac45a56b749d6397a8
SSDEEP 24576:hZMRzFVSOvsqjnhMgeiCl7G0nehbGZpbD:hZMRzf/Dmg27RnWGj
TLSH
T1D36501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0134cc8983235d60904a8a5a12ea1b86e221d193846580cd15a6eca7c9052e48
MD5 939547fc6da78316d0d77c265f7b6704
SHA1 a081f34d5480e8cb35d798954f2056b4430ca7fd
SHA512 b2d25682c591c7b0c541e82257529e437025b5dc74e0cf4fea31d02a906dad722f266ce26e9c114536549123747925b089d9f16cd2223a51bb511a82df1600c7
SSDEEP 12288:xCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F24523BF965C51CAE52608B5C3E5F10DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4f38bf1a2a0fa2c473259b028b9f567e74c345b6f1baf4f83645a3cf493e2682
MD5 c55ff875feb5a5dce510d05a287e42ff
SHA1 d878b81ed1b82b527089cf146305a247a6b854d0
SHA512 af050b532562d3790edd1d262029cef65f9ec5b8b40968a9b231c080eaa6d2bff1442a21aad4e5fd4f03e98c01d8e1c1dc8cde6e582d74cd400fd60fba20dd06
SSDEEP 12288:jmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1684523BF965C41CAE52608B5C3E5F11DAC073E5BE92004937A9B7CBAFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 89e6f61bccfac8c5ccbf74ecf6f3a6dd9c0e352925236b6da0430ce82b56e1d9
MD5 3564092559075f94c5ba85b9b22c9356
SHA1 142caf8ac8c449c769aa3b0a8667d257c71bd16f
SHA512 8b4502e0a5236287d3f4c4629527b9c71fce87f7f069a1f52ae2ea428bd104a2326d05a55194e16381908aea288ff3642f2a0448a55f7accb92c24c91dd26f00
SSDEEP 12288:YyPz5L8zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5zyzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A755125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 108ee0dbae6cf0e72613c1fc5c4d0543df5a9a40d9fc3b290bbacd4591ac1239
MD5 8a5ecb689c3a091c5235a0e85b8b70b2
SHA1 2092d4a7d5e5736eb44078ce4ef5f773f39282c6
SHA512 c73024dc558c647651fea65b917abda30fd122b6e31d912907a8573da6eb366d72061f8a7139c2bcf37747a3e5c52c4cac2c81b62c05aff96c068e09e49f5efb
SSDEEP 12288:OCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1724523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2a6171810f394b467a251a93f38173b95f481fd375ff76bdef9d8319aeed454f
MD5 b754eda51d05e9e8b5911a2f79f3cb43
SHA1 d113fa2212d5f66ee4d3ffbece12e5a5a6bb7cdd
SHA512 c62fe5c5aa200c056f9b88c6a812ce65025f51e3731e452f7b65c4a09b5bbd770244d9425f0873cf9f2cea0d767df1210d4eb9221a149c84f3c823a2070c69aa
SSDEEP 12288:5CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E54523BF965C51CAE52608B5C3E5F11DAC073E5BE92004837A9B7CBDFAB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a16bbd47f14f73f8a3c8315a65ea0126ef1633fa25f568cc97c516c2adfe4892
MD5 57006339a74ec1abeed6a91a5e290790
SHA1 e2bc131746f3838ee6e4d6c6fe17e42c0828743a
SHA512 3b6e3e280190e9ad62276a563b7ac9af468baf37ee327ba37f173bd75a1548b45d5ac20491502450b21602a5158d0eadc075aac3c2ad6d5a84f9a46e6f196334
SSDEEP 12288:5yPz5L8zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4zyzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16155125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 81b9b0974afce9acbcde47848ee02c6bd35c7f1ec0cd1a902fe5ef468fe6ea7b
MD5 ff1b731fde645443c9ca6f805a7f830e
SHA1 639560b81fbaf437cfbfe41be039db2d2f77f52d
SHA512 2ebb19f75e9bdecaa50005503b20695ad3dc17c6353561c1d89e080568128a1590a05c6376b62e20eb59f52dfa8b55310d459b633f553acd210ef88fc1e9fb35
SSDEEP 24576:LcP4mcvIjkGOxhKP2l71SNKbrh/8KBKsqjnhMgeiCl7G0nehbGZpbD:gP4m4IpOO67N8KYDmg27RnWGj
TLSH
T17165BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 fa6bf352cc8a386ee485c7eac339c69ebabfc7f0e74f62f9178d0ac6fd893d87
MD5 11295250c6dbc1188fbabe95501dab94
SHA1 610852facdd6cb83a2434e66ded10e8e0b3339e2
SHA512 bddd4599fbb135a23f97d128d0fc02955590cd7613629c91940ce2d6ec95cf7aeb42e919b01bd2e48435c2442d32de6d1310edd7fd47aee67140201316073d53
SSDEEP 12288:ibsfyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZysqjnhMgeiCl7G0nehbGZpbD
TLSH
T10855015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 85f03972a2bb172ce4ad451e9d9573051a9118429f1189eb57226a6af47b38c4
MD5 4d36ef5601cfaf3bf3e68d7c44511c54
SHA1 0349120399076c14efacb7228ff24e4a1c47186d
SHA512 07cc238d23a0ae63a563ececb07ff346a52d56e5f69c4a868ae8af960290ed685863c0954ca62c5bd7ddfaad9c02d2117edfaadac720fa0dc978d894bd3f9d77
SSDEEP 12288:eSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED45237FD35C518BE57649B082E9E12D781B3E669E204483BA473CFDB6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 244333f133991bed64ec28e3d149e6c7646672306768d11c4675e20fe001658e
MD5 ded410853a2156e8aa89794d5b6cbde5
SHA1 282db6df4d6387a734c5c2850ae2ea07249376b2
SHA512 dd82d49d87e5ea9f73b65af16d4220b43f360e29b7ac485cf4c2b845dc368b1b846c049f7d5ef496726c363226f13381a81cf26c94bc34a0887ec92cfc85a668
SSDEEP 49152:1a0h2GEkuAe73q3pp46zwwQUDmg27RnWGj:1a0hNYG4JwfD527BWG
TLSH
T12785AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 499f8d2ef1d0788d9589e614551c4664453ae25a1aca054f30c155138160086c
MD5 12d8e1dcf7678ad636678da9d3d09f1f
SHA1 ff8286ff0fa697d0ab632bb4fadcfcc6e9ce957c
SHA512 04d0de9322b6dfd53b04253b537e49af95cb291cf53c8755aa46fc7336951b52420dc20dadbfac4529cb223b203e22385f28a5e710c0886fbaafb582ff212d9e
SSDEEP 12288:vhbHjfX/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vhbHjP/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D255127E16AC20C9E57291BD8296D10AD632BC261B2053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ca9a6bfad99f64c5ae35cb81df31d6ba829bf0d311e9e68c9e806da7917833f6
MD5 fb64f19b33acbb4eeadd58aa93ac66e6
SHA1 b2b1aa1cb17d1832bfb3f56f13c18ace31ebc82d
SHA512 6bb142cbbc7cab20fbd2edf988f31dbdc962cc4509393556d3123812def90fc75f1595c582c3ec4ded859f4461ace42c0f541afef51c2c5f4a82a1f370d918cd
SSDEEP 24576:H3YgnJcRTk4yti+R5dpR/nsqjnhMgeiCl7G0nehbGZpbD:HIgnaTk46ppR/7Dmg27RnWGj
TLSH
T1F745BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 6b2a6a71430751041732132b228a2d0d54444dd3283df43f29e66c1b47a19e47
MD5 889320f715b44e5eb71dd073df9978fe
SHA1 457b800598ac0b392267329399baff12d5bd11a0
SHA512 cba17a415d6c95241fbaff688a55501759f6d1cff028a776578d1ba4efbd28af1b2eb4e54bf4a7eae1145b16a8daded5342673356ff3ad125a858e9289d8b582
SSDEEP 12288:j2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:j2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4523BE924C51CAD53649F5C3E6E11DA8073E56AB2004D379A77CBDE7B28E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 483cd67165bdea7e64d9b54b98e002b8e869ec7e24d56368b76f1f2e547c7551
MD5 fd977ce13b2cf00ab9b0d675bc08a006
SHA1 1179d6641bd5113eb454877b7d3a04c113da037b
SHA512 ee195a20389f37bcca1dc340933acfeb91eb92443d01f8e9e156dec0fa385469902874d30c798b68bc307b3006216b6d596b0ec4987c434ec7764bc159ea9329
SSDEEP 12288:HObfA4LWOsvAYFTdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:obL3UTdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB750159E7A800F9E87B813CC5A2D616E672785D0720E7DF03A94A691F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 840c3d332c2204c045f598b3239c9b7b758be4df3078931ef6c73bb4e6bb47ad
MD5 81c0e7fbc4b0caba170bc5b6f84f9a3e
SHA1 e74f21a8f38e768c953b0ea51366cf27e748a771
SHA512 4635f7dc21ffa2a694c1ffe173daaebc2deda556657b7b78c7e3ba1a0e59d53e77709db247f28538e393d061230aa2e7aed606c62a05bc7e3be6b6fcfc8cd57a
SSDEEP 12288:4pFtIOxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zOxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B55022E33EC10E9E536917C8692D20DD6327C660B2117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 961060bbc383ed775ebe656aa3636652acf475e0de3bc92fad96f8519eddae08
MD5 aee282907c3bd68d03ad7fd75a330976
SHA1 ba3ffafcce5a37c36d7fbbefe4a549f9dfbbd44c
SHA512 90ef0ce14815e9d6ee528421156fc1f1101717f3a663d4ec30d00d2350ba5670f0f8b3741c805a28093f3ee79e944ac68304c65a8c9792e32743634cc9013370
SSDEEP 24576:y7NM9YmZqmWMUkPjZM48Mv6bEhsCsqjnhMgeiCl7G0nehbGZpbD:y7cBWMpPjN8DbEhDDmg27RnWGj
TLSH
T1AC659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 74d838f8fccfdaf04e3e435b5b7fee79c03232a66628ef40391b8e04f290d760
MD5 c0decb3b942f0c804498a42e14668461
SHA1 822f9ce2cedfffcb85d7b4bc37a69601476c007a
SHA512 e3c2ee338b38a78ae41df3b0c5c7f56992c80fc01118494be875fbc62daa5e8cab6b817d53f31fbb5265b17c7585e09613a2ac49287cedc26a1068ebd24e6cbd
SSDEEP 24576:cW6BApg2YuyuNDYTabvcRvNYf8km1EsqjnhMgeiCl7G0nehbGZpbD:cF2YuHNETovcvNYf8kmmDmg27RnWGj
TLSH
T10D857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 24ed5abda91c7febc3f3f1d0236c37c2d43a9432e7444be6dbce00563cce2aa8
MD5 cd1352133407c7660cdc05bfb3558690
SHA1 4542ae6c7827722b23eeae1d54e248a753f94a5e
SHA512 cceaa14f754c597beb8df0b02ded26a799bf84b6a42af31bdb23805633ca7c7e48b7f557dc65f1e138a19af9bb11764ce9c387468f696a0a33c2362a6112fcb1
SSDEEP 24576:4AFs06+OmlfkNXEbToVsqjnhMgeiCl7G0nehbGZpbD:9Fs060lwXu0Dmg27RnWGj
TLSH
T1AE65AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 48160ab468c27de480b43dd1e05bbc48f9574bd7b8db34057b0e4dc52dba8303
MD5 b41057c506b5e13428a56dbd0e7bd471
SHA1 a74733462f812a85d74b93d235b37672a1eeaf01
SHA512 3f9ba0552f522df57ae3694340fe83056912710226681f12f8b1d3cbcb9690de4f6494ce5a2852fffa40e3b341c9326c62c88b9ad75471af0fc5d295d6838b5c
SSDEEP 24576:CJnJ5D3WtIsqjnhMgeiCl7G0nehbGZpbD:CJnJ5DGt0Dmg27RnWGj
TLSH
T16D75E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6be5e1ee23ce6e3b6698a5fd599172095c28ed35109f2ff3be07c189c7d58a5d
MD5 1fc0ab509a36bec99f06948fa067e21c
SHA1 3f222df6a3b850dd47970ff2b812a2ce5ff9d64b
SHA512 a8ebf8a9695fc2fd5bfdab4722178b0b2a140ec4a719f4d0d93bbb1c6ea7d7d09930d1992bd31d2633b228faf9acfabe72fd5517e60c2472f107966c7ab43766
SSDEEP 24576:NEPohm6/7IIXdwcXrif7qQncjlP65i3VunsqjnhMgeiCl7G0nehbGZpbD:6o06DIKdwc+eQnSt65aVCDmg27RnWGj
TLSH
T116955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 15e950cfb5d6e9425626112cfe92943dc22828c053a57c1f0b21ed9cc80e8892
MD5 44bc016200365aa8ba3ee65d9fc602ae
SHA1 5a039e76a51369442fdebfefd42d036457a92f3c
SHA512 c2c950ae11e8301204b40227291d0150da751c509a764b3f19cd4a545b37aa1a0abff660f479410f119939ec213b773a1f1502f45fcf25336e1d08f9d6e6814b
SSDEEP 12288:fEP3Rr8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kr8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D55126E679C60DAD136907D82A1C209D733F4716B2127EF2692D57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 c6fc8c88964efa947c71536b6d96484a32475b245665b7d950c814184a16d49d
MD5 7127d5408c419a5a9454f137a6245419
SHA1 f783dc5a49b97d32110bfc9b0733c2af485bc280
SHA512 b0b32c8c34d1a7ec888b89c23738eae53f544fa8b3ac66a6f5473e25e196971f70bd85599b179c7de8164fde65a0a64d2ffa57bff610baabf2036b9bdf0d8c41
SSDEEP 12288:DjkyPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DIyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D2551219639C60C9EA760578C6B3D1589C32BC319F2042DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 dfdb9373b7061eae387453dae0aabeb46b72b4987a1a890bacfff7a5f57a3dd1
MD5 38c2bd0988e5c6899f4bf3f3106a1dcb
SHA1 806cf1bc8023ae218f0871fceb18d92737c53818
SHA512 4f5fa158ea7db81198890e3834c0ac6c5ad2423c275c1fb4a929be2563a8da5eb50b73f88259f8d39e6dec713ce631756b2aaae613136ec2c6bf94b3baa4a51a
SSDEEP 12288:BFBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E45237E525C61CAE93245B8C3A5E51DA8133D366B2014E739E3FCBDEBB24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 62590b84d42d30e83d3c2943426660d10adf38a875c21a1f84a99d3299708674
MD5 f8f4af9539e00abcc3075230b81511ca
SHA1 b0952aaf64c24dac7aaadb76d52f0af53123b5e4
SHA512 768afb93b6798ea4510dd28e08a3c5e13b2ab4fcc38324aec0147f2962d12d91dd60c78c89d05e907665591e550cab989e20fd02854a02e8bd8c2e0f01146144
SSDEEP 24576:IQ9MxZKdcz97w36sqjnhMgeiCl7G0nehbGZpbD:IVKXODmg27RnWGj
TLSH
T13A558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 9c4de8a42be57b53dcc78f116be4943c1c0c1a02ceb7aaa541cb7364fb6a84b7
MD5 c1b2cccd9f67834fbd8194e9bcc638ed
SHA1 ad836df47ca4a300ae46740f909e0e943ac99918
SHA512 2a438f63c1b7f097980dac3202bfbe68b2108e938f22dc44f74f1e1fc7dbc102744826c1b59c486d2ab1d5326eb1c4fe81e96a295815d516bfd34fcd35d056ea
SSDEEP 12288:eyoKo2HRple9pjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:eyocxApjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B565E01FB76D40E2E176813C8985C249E673B4305B2257CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 770d75fc2c8510e1b060e6e48803cd50306acdce295659faf08cd394cef9b5e7
MD5 4df2a9eaaa94aab19f9537f4b0f850d6
SHA1 6b2c2f2cf74c6a6c2068859bb0a6a36ea4b0d145
SHA512 8edf1b58d28c0a37b38f7928b01eb942edd208384e9220d54ea047c641168e2bc22e80700be8b0e47395d9e81a7bd0a11bcd07114a8a183416f9e58d24f640d8
SSDEEP 49152:xWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKnDmg27RnWGj:p0zuNILD527BWG
TLSH
T146A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9fcf8e45801da60a66852a5e826517f6afbe3e2d58143333bcf0f7f49a4cfce9
MD5 8c98c668b72d96e0644355e4c4661f57
SHA1 ff4bd132d0206f40cffd2e04038fd42ae59a207f
SHA512 c778aafcda72dc31904fcb447c6e083c5e364b14564d93381ef85de23c076ee1dfb4fb72ca6cf28d76e1b65b64c92b06f1b71ee4ce456c94bd4b6e18d0d20e28
SSDEEP 24576:S1QT7EcpfxR+N5AWAz3ooiYujMqb8sqjnhMgeiCl7G0nehbGZpbD:PTDxR+N5YzT4jMlDmg27RnWGj
TLSH
T14F55B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 83a2ba842b279a406794eabeb958fb0f4ef706f65f47a028d536128bc8f921fd
MD5 ec3791a9c31666dc21ca6c3a6e5c26ca
SHA1 d080d5e7aa4b1a308dd49858f7cf27c368125977
SHA512 bba81b4546a8f1abac444224a64e7ef81a62ca6e174fc120eb43b8a0eed8fca4e0c562892e91fd4f225400f9138e9256971806cc9a27334449cfa3209eaf3ba2
SSDEEP 24576:ITMdOz0FFS+bmSLgsqjnhMgeiCl7G0nehbGZpbD:A0K+bmSLcDmg27RnWGj
TLSH
T10875E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE47A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 537b38395bc895e38bb6b429e17a92e818a03c8c950c1aad4771f14858a738d4
MD5 24045f47e2721b3eba58d2f2a7c0d5ac
SHA1 34265ad48ea878d22e4fed3ecdd4e033c6db82bc
SHA512 ae013acf9abf57aa238c5ebedfd8be4145d440058f2010d91198c7cec99e1871dc27e5eb375a428b3b0a17363d7b4e0069feb0f304dcd0af06df408cc841fb4a
SSDEEP 12288:+47dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ldsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D055126E63EC30D9E4325574C2B6D1199432BC36272015FF39E1D9BE9F729D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-373-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/708-200-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/708-380-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/708-206-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/900-9-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/900-0-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/900-8-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/900-385-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1532-83-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1532-77-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1532-71-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1532-81-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1844-376-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1844-146-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1844-152-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2108-371-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2108-57-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2108-51-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2236-522-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2236-236-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2236-230-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2236-383-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2484-36-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2484-35-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2484-27-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2720-21-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2720-22-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2720-13-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2720-438-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2756-177-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2756-379-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2756-183-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3160-458-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-462-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-475-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-474-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-460-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-461-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-464-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-466-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-465-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-459-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-467-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-463-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-471-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-472-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-473-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-470-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-469-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3160-468-0x000002C0E62B0000-0x000002C0E62C0000-memory.dmp

Download

memory/3376-141-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3376-455-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3376-453-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3376-135-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3376-375-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3512-196-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3512-187-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3512-193-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3512-198-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3532-378-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3532-167-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3532-173-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4196-382-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4196-226-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4196-220-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4316-374-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4316-131-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4316-125-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4424-110-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4424-116-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4424-372-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4540-100-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4540-106-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4540-387-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4584-388-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4584-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4584-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4748-210-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4748-216-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4748-381-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4796-456-0x000000000CCA0000-0x000000000CCA8000-memory.dmp

Download

memory/4796-289-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/4796-271-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/4796-384-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4796-247-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4796-255-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/4796-523-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4816-86-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4816-40-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4816-87-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4816-48-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4816-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4948-386-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4948-89-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4948-95-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5008-377-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5008-156-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5008-162-0x00000000007D0000-0x0000000000830000-memory.dmp

Download