stealc | b1c4968adf6c649dc01f45860e30a08fd2dc983ee1553b065760ac8c0d6a7892

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample260930-2wfgzazz2m
SHA256 b1c4968adf6c649dc01f45860e30a08fd2dc983ee1553b065760ac8c0d6a7892
MD5 2796e87e52b99df4debdebb010da2b38
SHA1 5c224766f38d81a660900f54241e148f0c8b8e54
SHA512 efe0ddfd43fcd07ae9dff2d93e612fe151d18b25a41a96d2de20a0769159356a7f3ca708e1ae0d322cb4ea5bed8617d6dadc6cb33c4aaa3675236b3dd93588ee
SSDEEP 24576:E1rZCoV+Mi2iBgFJO6/nw68pJpu1bAUwFrlR4lDnQ/tbw/2Mkjy6Fr7g0oT:E1rZgMiCMgnw6UJsFIFEFQ/lFTjN4
TLSH
T13885BF1B626901FCD0ABE17899574A06E775744A03709ACF07E056A72FB7BF16EBE300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 3 IoCs

resource	yara_rule
behavioral1/memory/2220-80-0x0000000140000000-0x00000001401B8000-memory.dmp	family_stealc_v3
behavioral1/memory/2004-42-0x0000000140000000-0x00000001401B8000-memory.dmp	family_stealc_v3
behavioral1/memory/2220-436-0x0000000140000000-0x00000001401B8000-memory.dmp	family_stealc_v3

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Executes dropped EXE 22 IoCs

pid	Process
2996	alg.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
4776	fxssvc.exe
1192	elevation_service.exe
1316	elevation_service.exe
3056	maintenanceservice.exe
3968	msdtc.exe
3496	OSE.EXE
4844	PerceptionSimulationService.exe
3788	perfhost.exe
836	locator.exe
2892	SensorDataService.exe
5088	snmptrap.exe
4904	spectrum.exe
4328	ssh-agent.exe
2976	TieringEngineService.exe
4044	AgentService.exe
3792	vds.exe
3808	vssvc.exe
2756	wbengine.exe
3364	WmiApSrv.exe
4988	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c86a3ec3288da564.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\WaitSelect.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\javaws.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073e3cddb2e51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000931edae02e51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000842fafd82e51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c19473d82e51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000071c42da2e51dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005456b6d82e51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d1c9cd82e51dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000faccacd82e51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b3190d82e51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4728	DiagnosticsHub.StandardCollector.Service.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
1192	elevation_service.exe
1192	elevation_service.exe
1192	elevation_service.exe
1192	elevation_service.exe
1192	elevation_service.exe
1192	elevation_service.exe
1192	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2220	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4776	fxssvc.exe
Token: SeRestorePrivilege	2976	TieringEngineService.exe
Token: SeManageVolumePrivilege	2976	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4044	AgentService.exe
Token: SeBackupPrivilege	3808	vssvc.exe
Token: SeRestorePrivilege	3808	vssvc.exe
Token: SeAuditPrivilege	3808	vssvc.exe
Token: SeBackupPrivilege	2756	wbengine.exe
Token: SeRestorePrivilege	2756	wbengine.exe
Token: SeSecurityPrivilege	2756	wbengine.exe
Token: 33	4988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeDebugPrivilege	4728	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1192	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2004	2220	2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe	92
PID 4988 wrote to memory of 5520	4988	SearchIndexer.exe	120
PID 4988 wrote to memory of 5568	4988	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_2796e87e52b99df4debdebb010da2b38_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe" install
  2⤵
  PID:2004

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2996

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:224

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1316

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3056

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3968

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3496

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4844

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3788

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:836

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2892

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5088

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4904

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2476

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4044

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3792

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3808

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3364

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5520
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 74e0e552f30da61f32f672700cd24aa7ffaf3084a955a43045ff5f959d9ab539
MD5 18d47d62f74c51c92112e713f3d5d52c
SHA1 1c9bb74e06d968c635bcd3d63791cb247183dd88
SHA512 a88318ad943fc5ddb1a8e469868ad639dfd87437f8e397754b890dec5138f3b1e7956f0a5ee914d5f6d5994ac48d57c444281bd5546b88b2ff5054a109abd396
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnxQ/lFTjN4:S3q6HjB5Lm
TLSH
T15DD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 744e25e18aa164799a99973baf306f8f23a6ad5fa69dc68cd33e40ad5e4d748d
MD5 3d6aa989d0a22b82e1d0638972130092
SHA1 f7af0b95338d9a2254d032952118f3e3017497b6
SHA512 1b1f9cd5b7c9b9aa53f2d2ad7c731b02b9ecef55a5320162f65c3b3794919539245d354b7f6598d25d57c6651d2edf91a42ecd8eafdab096158f4b2967905110
SSDEEP 12288:S1XLsswWkxy2lRq2czASGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:4XYfDtczASnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T17D65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b684d78aa479f3970be35f5b9380a12f13901f4f31a45fca308624b20353357b
MD5 fb81e517d1e2474e49154dbb2c650f28
SHA1 4b763215347d969acaa85b5af1585a1ee94feb67
SHA512 6e9440e70bc2d22b847a2895a839aad9e87fca146fde59ad702992f04cb6a7d9c5f6e9ba3483d22906b541d6d60483e9757113d07159b0e9e4b8a5564973b52d
SSDEEP 24576:w0Le5ji0hmxLrMZnQ/tbw/2Mkjy6Fr7g0oN:wPji0AlkQ/lFTjN4
TLSH
T15B859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b96ce056c502ab76fb27dff4c1d1400ec21a137fdec63f048622fcfebf4b7fdf
MD5 c9105edcd22bdfdaffd2e4d7995cd6b6
SHA1 fd2a2753e76d974ca753fb6277a6ed6ef19135e7
SHA512 7e203614236724c5071f7a2e732e02a98a8445f386bca60216ea71b91b398cd91aaddc29bec4297354c341b569682f23a196279a21eb9e3ff0ab0580d2fd9333
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWE6q8wyuHnQ/tbw/2Mkjy6Fr7g0o+:i/ezSC6vUzPvxHjyYQ/lFTjN4
TLSH
T12A755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 653d397ba5d782004d6fdf8453b8bc2fd9a39896657e4b5c6a57e92599eae3f2
MD5 617b49e2d82961af6d0ebbedffaa1458
SHA1 201a4942850b2336d4848528521ed6925a6b0bf3
SHA512 f03a7ddab3f01a09cc01f5367e3491fca54bd02c7c0b59237d79ac4a36e4d6f577757c227dfd199f823eb8107210605c281c0ccd43400d14a6de61dba3676aac
SSDEEP 24576:OVbqPb88hv/l+6unQ/tbw/2Mkjy6Fr7g0o4:OVO88hXl+9Q/lFTjN4
TLSH
T197559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8def1cdd22972cc93abce6fce7446b1d96625b847eecd5e1ea1c2cabedb10528
MD5 cbce7122a855a5a328b8e9b68c4b7b62
SHA1 5b03ea45a323b7f074b6dc77c2b36175814ceea9
SHA512 dd4d67cd7599a9e3132ec87aa8b1faf63933193a931ddcc8efae3515db718364b93d84157d4850d81263910d7fbfe1577cf50b3c191e82536e026d218c7c8dd6
SSDEEP 12288:bzVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:bz1nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1F95523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f98783edd4121b57734a09f8c77bac93e56bdd5efb3b7d108ba17de208a8874f
MD5 e66b45ab5a329bd735e82b1b761cf535
SHA1 d2961149e8165381c22e12b94a031c3e4a03dff7
SHA512 f2b7991c2938948a8a243e00c26ffba67f0a5045ea3408d8bc43bcbe21349be28662c9b9dfa8f5cde8336c1bd7bd1f3f2fc5692de37345a5aa338fcc343d0593
SSDEEP 12288:CeBNUbTVO86U2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:CJIUWnQ/tbw/2Mkjy6Fr7g0om
TLSH
T15475CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 27e1d580bf9fbdfce94a1a4b67403e951718dcbf6f33003701206d7b61ee342d
MD5 acf10239da55b8b60fc36225b4a79521
SHA1 7bdadbc9520b83cd0db28c0206f1d1b4e2672aff
SHA512 76c9c2502865c6054f8b806b65d3eda3750b6910b4b8c09e6ecd03e3e1e3701af161c6d6269efa5d1d082f7753bcdc68699113067a9d4723e90368d0227e5286
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:XQvGAdlCEL8c/yRNw5C8Lm
TLSH
T1C4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 135564c1390970f3d0693537d642b7c7147d5d7290c988a831fd778307da7097
MD5 a70cb1f7962dc66d1ce62213baa87d18
SHA1 a706d1dc24ae98f2c6537e9b8b726d3dfb9cd582
SHA512 4cf1da4275ac65a1db2966e7fc6f5bb3be584a9ed7ade80ec54455a5accf1eb32e82044ac8999058acde637f9071f29872215234581667fa420b7d02e9698283
SSDEEP 12288:RAwSfxL/2Dc39DLLmt0LDQewsAjUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgF:yQewsAj0nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T19975E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 56ec276aca7204c8a0ca9dbde1f3e70c11f3f647158d8aa603940c75bd476a1d
MD5 18974185ae9966fe0300c7e77237cf3c
SHA1 ff2f65c98207dbc05477eae778c13db6a432b6bd
SHA512 95df143cb1843aece95e3eff6ed00d45f78dfdda1056d429fedaf5e1602fa38e490b97e043d8baeff7a732e1bed53ef066d59ca9ca7cd7f626dd6681becfdcf6
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHvL:5UEtQevvqc2W1cpV2EI32
TLSH
T191474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 839210902635ff40dee0b7d91ad6f30cfdb035302312a9fc1dc833ba2cf1022e
MD5 4d2edbee2c5523797e58c4d8110a9270
SHA1 a6d05b446342a895c2fa2ff28412c55a2a2b7505
SHA512 d5b034eab5f8fbeccbc67e0d0c52c71ae54ef231ea40af22983f06b2b3d6c210e4a716b90fc568f6388e2700304d4104016e239e25cc790f61a98b33f0ab4d6f
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zUQ/lFTjN4:+oqtVjnmwLm
TLSH
T133D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 06944e066d6e9736c1551a8fc8557050d39c0a2b9de4552c149309c88ade5498
MD5 631116a823c6fa8a6e49d302ce96fab5
SHA1 712f3d37d1236c2ae40feb07d70924a42f8dfbc5
SHA512 a986a06cfa84736de36875c02fd72f827202b37c19f0a75b09a69e625c8629eb9073bd7bff2716cdbaeda9c5a1b18fa13c4b3224c15d101016e5b8b3e450ad9a
SSDEEP 24576:FAhGLJIFoiwtA5l7S53bnQ/tbw/2Mkjy6Fr7g0oy:FAMyFoiq5LQ/lFTjN4
TLSH
T10E35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 92fb63c1822601235b9d679c6b6e76618c7dffaaea5f647e14f2c1d772a2b0c8
MD5 e15572f7e48a13c72b8b03a7c5627976
SHA1 1727c58dd24813d9bca32d2442d09c7657e6a384
SHA512 ec78b893e347dde794cefaecb2d984451ae74f382030d6e0148217eb1675dced8e95e57c0f8ac8238c57cf1b92f4ca252dfc780696ba0e95243711f5b22dfc2f
SSDEEP 12288:8mw5HEjsChN2BFgl0WDm+CHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM3:5wuHOW4nQ/tbw/2Mkjy6Fr7g0om
TLSH
T1F665F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 da4de63946baaa8c3c104f831cb1504d6ec8d7ddbe05c8e87b79ce72b985bfcd
MD5 3dbb5e2ffc90051ac103c8a928a5656f
SHA1 1d5f55aee31bde58fc948782666af04e211f1e29
SHA512 5b45093f9a618ff13a05dcc958808d8b32e453b9a0bef71f60c448778662e98e1a6b077483ed8d9b638fc3a540e578ad77ad0f73a6cc442890aa5c4be9d20425
SSDEEP 12288:RXZ1IykGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:ZZuBnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1FF55126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ce9300aca43c265c2ae96d74315768925e6f99f7df3e1a3fd012878656993c50
MD5 d3dd044e7fc1384ea316c02b3bfec5a3
SHA1 47d1f44d8ec4ee62cd1cb0a0d7ab5f3e0ea73bfd
SHA512 30ca3a64622a9dde7decbc4af430b9bf452ff5fdb02eb64a9a25335eef975d9590fb568214b8d6b297092a6961f331ab4ffa7649539552e635db02a9ed0a98e8
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:tQRQyi36YOcPQLvw2gAf+PN3VLm
TLSH
T1B9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 18ae283a49cbfaba55490550e945b0537fe01d8d8d565d1d85331a30d74b3fd7
MD5 e02295525bb0188c89055410602de883
SHA1 942b423761be2a63f3ba2d7c71c2570aada70f4f
SHA512 53b521f489387f16c667b25a15589390e648449d99bdb90976a2ade217ecf9afe275ccce6da616acceff5ab6df84a67227b44a4c916c0c5d999b232755cef0c7
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:hQRQyi36YOcPQLvw2gAf+PN3VLm
TLSH
T13B666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 377759b0c23afb3df4f6ffc21bfac3bb6d5a78e8a080472377d1c8f0e193ff0d
MD5 9287030214e87ddba906637d42119fc2
SHA1 0a3efa2f05fc8575885331a9a47936d7d809e394
SHA512 28676f046978f154b00d3239cd8aae17439ed0f808eb276910c5eec09db54a56bf63b78085c4ef948c509064a2dbaf5de795d0c655badf3e60c9e818ea30ea62
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0xnQ/tbw/2Mkjy6U:U68Qg55nhheWu7PNU3/kQ/lFTjN4
TLSH
T15DB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bfc94392b4440d43def12ef49fbddd9513b5aca36cd162a40dd7be9ebbe46eca
MD5 f87b94d34ef98e909ecb57ee8078c9f3
SHA1 abf356285deb13a1fa2cd347e26a68faf80234b6
SHA512 399ee8ecda1130fb22596623f1aad6d08a8a2f6d3c935ab19f59c77393217449abbd8baa54a7c5d7b1fca67606e76308116fcde65046fb13637437718e0b0ae5
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk996:Yy5112gYy5azzVvL69nLKnhZaLm
TLSH
T18C167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d001c2c56c9cb3867e43fc674c25e5d72b09cded861161ebb3e80fe9f73e4144
MD5 f78df11f3d739c58ce2ecc5e56cc013d
SHA1 c81b9e09d73aa0e4c4e4fbfb2311c394df680096
SHA512 40cee7ad95863d483a56845622949a002bfd6e54e47fe92103d1a636290f49cd34db5a12c2522f2f4f8a17e741411f90ee75e3e9ab87cbcd2d219a0827c10f36
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glCQ/lFTjN4:iu6JmVxd2dNLm
TLSH
T16BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ec2e3f231e57515f6424becdfa7c671bf739f2c1e010b38a5d7350d4a4c5f7e4
MD5 ba6dfa1d2f7311f0c618cbc40b00bfcd
SHA1 2e7b8230fe7723b8cd0efd31cd5a94df3299d865
SHA512 852e31b9a2452f679f873ef16a2bb7fa70d29d039fe8b530d600806fe1528e107bc84074520c3d80859c9d1c744445e574942f8dd72931511066e7113a9ba6d0
SSDEEP 49152:H1hpsNoJpF1A6UU44CwH7R4x2Q/lFTjN4:HmifPbRwLm
TLSH
T1D4B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f4d5e0d66933e2b6da7feaedf4b0cb5c1574238e02032fa7657a34588b3fcebc
MD5 0a36fcc3eeb5e9741b0c5a0ddc787d06
SHA1 70fff9c59fb16f4fdf6b728dea63836c3fdab3e6
SHA512 5b612b18175b7bafec81937ec3a4558934b42a5f8ad8395234f00f63fb75dafe01c08332ccff766dde76f5feb5ca1db2cb8eb5c0ada28747b68f0d772f3a5344
SSDEEP 49152:mSuZQIY0Be2KRRVtOnks6NMHqBQ/lFTjN4:o5dKTi61mLm
TLSH
T19BC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9e1c81eb4a595d4e0d6abdb5d9c6a0573425f19716121aa25c54a22d699914c9
MD5 a8fd5a5de94b2f44ace0a59e4ca587e7
SHA1 a2fb01eedb5b5cace3d7b888f9d88c7b5333d805
SHA512 9e55b8b0fd25dcbd724e39e7ab04ea31abf4d31f1143d90ec50f5681203726e88578321526e277d1e995e393e946c8318aa3a509b28c8abd8fbe0f4dab0577f7
SSDEEP 49152:ehtSn8EApI0figngiDn0AP5wSQ/lFTjN4:/X2iyphkLm
TLSH
T1EC95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b2322839aad1b68100ce6b2be5a8a2b73a86a5d0352e48d29211ac22c009d104
MD5 42c94920150ba170feb55efd671d8a9a
SHA1 e632b4a211967ef4570f0e00bb95b9e0bf0426de
SHA512 fc8d6b374dd73a4f21376aedf80bea6fa4c37005683bf5c47b95ef6587ed094db41c91cf1c0530fb2393b1bec4b2c4492754bcbe836f164ed33def6a951bb4f1
SSDEEP 12288:4dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:49nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1435523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5f36e8d8ab6b6848ee8668d9bbab2710c6af6fecf40af8de08797e1349e8b39c
MD5 114e014d05133899d9304216441b4335
SHA1 97b1b37146c64d05d30aa946e943eaa9a1accb1f
SHA512 f8aa1a3d0734fc9e951b5df9a0e81034464305304e9a01115f47e747b09bf9eacfa3887acb1c92960a7fdc9cf211e04d587b2f196a0c370c0b01360f0971f4dd
SSDEEP 12288:MwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:MQnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1555523797965F98BFA1706F14C8281829B3B0EC6BFD1938F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 96e85b7222f28d4f54147ccd76e9fbe087489530f509f5f8d87a8492964bac3c
MD5 454332c4fbda6dd4fff8ddb4ef5338ea
SHA1 f96d9cb382b413f90330c40d0fec3a03bdc56521
SHA512 302691778bc4163079b623353f5d67996072beaf77f0e33b7927f8efd078bfab67cd02212d89c8baa4ac4a435a145df0308b89df5d4d699a7c8af7585b5672d2
SSDEEP 12288:PeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:PenQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1A75523697925F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 220cdacf7d3d3d19ba27432b2bcc9b8dc2d826f7282d02448849ebc71a89cfb0
MD5 cefc0120663d4b9c7c293c6f755bf40a
SHA1 2b9a1a83f32d1274073f8892899c8682e7ca27bc
SHA512 87fa9caaf55225ea5583af7c71c2055a99f77ee5114e66976bcc91f7b21d1657802d485ab8b9259ddb95f94c5112aebcb62be2c70d74e9ae90db8c10c12fa7ee
SSDEEP 12288:qVLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:AnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1065523693A69F4C7FD2742B4CC938142E77B3DC6BBA1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 01ee4c852191a32d9a6417c93235aa34aecbaa3f14644504e5828cad425ec409
MD5 301f8c2da310c9094cefd21ccb8bc937
SHA1 5492bff227cac3f9cf36191e48122f1a88712a43
SHA512 1528e3d7c35c78c5c8878c189fb6865ee0c9ff4ec332ea45f050f8cc99b63cdff8e40c941c94f01a8095f6adf4ae0143ddd4acc77a5964ef0d0b428efd249ad7
SSDEEP 12288:dDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:dznQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1F65523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 90f354efd593b5337025ad1ae1872b048ee078cb81e6c732c93b608667fea506
MD5 62009d848a29ef8306e0f08672dfd4eb
SHA1 550fe2606a08fa64f5e2d4664ae42ae95851c843
SHA512 9316584399781ea827fe9e8cf003f655ee0b6c8a3dcaa5724e9f42245feba8fcc5f606edaf028094a6ee407b968979d16a58d3a439a59f02eba521ec4fbf4b8e
SSDEEP 12288:LcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:LcnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T19F5523797965F98BFB1706F14C828182A73B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 adeb89cdcebe071c34ea6d685f65399ea9e5e57141cb81b795322f3bc39ecb51
MD5 f9ba3ff6f1865652b5733cb419148425
SHA1 fa29c00af9b6f78c60ef925ed58481f1b596e1c1
SHA512 9ef3376f69630c9c9ef61ada7b88d71c5f9176ae872e25950b1c142906c671c7051821c6845c1193b282e720bc1c7b596b5ef4cdaa912acc34cfcf787e1f9d1c
SSDEEP 12288:PoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:PonQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1FF5523797964F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 be552f23338dc80ce745a7142e5781df4b0c584c53b9cf8a88a2635f46531201
MD5 f9ff6df22fa2c8aee6759102a8255f1e
SHA1 ff5c3b10e0eb1010567f50f1bb16264f823b0389
SHA512 e8e0c15140f8145f75542d4da45e663f3ebca07d70afbfe41217c8bbe371b59f2084c898424bca6d240942383b17e02f9c78da721a5ceeb79fca80c0089cc478
SSDEEP 12288:RiZwbDzzFEoS2cPvyQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:UZM3zFVSOwnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1197501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8177c1bde3ab5d33556c3e313dca05e2b59c3d21a2fb98f4d90c16f48141c503
MD5 43650d3c1fe7e725011e8639f478520f
SHA1 51cb76714f388ce6f23e215c1825d2c8f5a0f2cc
SHA512 e4393eaf01f52da2d0b31d583c734380b4a00c301a99c1ec8ab345e56e7328b2fb648f76ae0e1dfca169a82e2aa34c9544e6f741c86f96fbb927bab714741430
SSDEEP 12288:KBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:KRnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1795523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b68d5bd52d006bc10a5bc6e9d88e37c124debc292d35ed3f958e006ea0730303
MD5 ed354ac4e5994cd21584d00e00f7bce2
SHA1 d99a0ff9bd30fa0db996fb669d999e0286aaa535
SHA512 41600997fb32d0237ab96c29b628e777a6cce099dfa527502c49ea2fbd566445ad7bd8dee3eca5562e94aedc75a131f7a89afc048713bb3fd3c56386b1cc7718
SSDEEP 12288:plGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:pFnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1BA5523697964F98BFA1706F1488281869B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 06655482fdecced6d6e5fac8c93011d26488ab770ae7bbbe9c49d074410a926e
MD5 e60048153f9135e4d1c3fddfe9620e19
SHA1 bdd89d1739ad0a8e4269b5d28773cfc7e806847d
SHA512 a4b98d3591b905186508ebf3e56dea2be00fa55534fad3497558048fd5e73aedc1f5aed97c7652c63e81c623d912ab8a62c49d4648aa49af9c8bfe1042db661f
SSDEEP 12288:XyPz5L8kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:azyEnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T18565021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5ab0fc0afcff387efd3377ba3b672d0d68aa055a5b52c8c8556689e4b870c404
MD5 c8f6529acd0820fb73d883d5febb45ae
SHA1 642d442fb3ed072f6aaa95c05c7d6c5d12e5c508
SHA512 d01d349f44be280fe865657c9af2aefcc3cf177e31a3dc995e80a4ec4e3fc44793f87862e56856fa3b37bcd3dd584ebba5610e72eee587c65e7b6ab21317f9dd
SSDEEP 12288:KBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:KRnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1735523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 19a84b3a7aa2c5311fef89cbd1a9f320aad6f19e9fda0aaf460187a250171ba7
MD5 af6a5c87590dafeee818e62e824b08c2
SHA1 bdab40120cfacc7266793ffb73a7a10d72743738
SHA512 cbcba3b394e0ed9b34e0aca0eed27c4254ee24559b1067b10e0d1d326d20e46f3312960d46c87936398462b3bf49d4bd2db011a22da0a1b3936e9f67a27b1bc9
SSDEEP 12288:xBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:xRnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1525523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a4b6459c8876dbbc474281d60d30f40d4c286d736c4a7def3b99ab5cfae38d65
MD5 3cff30a79223eeb6daef476732e0cd0b
SHA1 0c341543747799b7613bf4e4be579900568ce1ed
SHA512 a5c0c513aff1dd2a038f7ba1e000f883178f33e7445117f66930d9e9dfe56ca2c52698d9a8e138c0173d104d4446c8ea3ff9aeda3e3b327c9baa0cfbea9dd167
SSDEEP 12288:cyPz5L8kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:FzyEnQ/tbw/2Mkjy6Fr7g0or
TLSH
T10E65021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 a4cce0eb15a416165e632c842e79f14e4ffd593f65665170d3a9094d61bf43df
MD5 9aa6170059460d29bd705a8a19368830
SHA1 2df774500efca24a1f96383bbede5797ffc010fa
SHA512 0cb65c26bed82fd63c393afde003df55cb5b259ba5af2fca3127cd29d73082c089158ca188d5cde9051da6c72cfab4cddd2ece7b54f09d2ebc5a5431b4dd5a48
SSDEEP 24576:ccP4mcvIjkGOxhKP2l71nNKbrh/8KBJnQ/tbw/2Mkjy6Fr7g0oY:XP4m4IpOO67W8KXQ/lFTjN4
TLSH
T10365AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 dcd6582ec4ae7aa5471f42ad5efcfda159848cb592df48112cc80c14e3fe139e
MD5 0fbe7aab1e87c4a31911586e04d07634
SHA1 9a6ac76375a50c1d090f7c8618e525b6010910b1
SHA512 8046354e8cbf3c73b590723e45dbc39a5950f0948fb24c8249228324be9f1f5928efa7308b88a223fd74b8be7936f18132fce75063325d8d9f5329f92a8bfdc0
SSDEEP 12288:nssfxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:rBnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T17C65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a89065f3b0be9ac877e39babddb78483948aa38d9a559a8982a002d28cd26206
MD5 cf6cbcb482619abaca0557880f3d361e
SHA1 2811e705b022ee3833d370e1ed32662e9aa1f51d
SHA512 7984041e0c51f79ed0c776a793a29915e6cfb3235a390186c3cc41c2c081ddaed11a2d13c78619f4eb6962b2f8b78b7d2c4af67600d7597e46a008837f31fcec
SSDEEP 12288:0RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:0hnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1E3552369A668F94BFA3B06B05882C151673F0EC5BF90D38FBB08222D967C3D01DA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ff35eaeb59a9bad6890269c40d0e8b00f744f6ee336e11d07bbe18da1ac63e84
MD5 f0697a8edb1c8996470dd9d7af450f3c
SHA1 3d279d4b415f5cd7522728bd7819890f07d475f4
SHA512 75e8e96a4bbb4d2d4aa2d88acaf4511a37b02bbb45811ce9a84cbe3f5289b5ef37900931e2165dee7d417b1a47c047d7d889619d0f62a0505363990e7fc08eb6
SSDEEP 49152:xa0h2GEkuAe73q3pp46zwwQzQ/lFTjN4:xa0hNYG4JwvLm
TLSH
T1C9859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 cca9abaa926a9925dba9c2f2763999397191b8a8b7b2a28f664495f689379217
MD5 c1ff5e8329506e99b82504ff96fd052f
SHA1 c7e6359a7b362760d28e08a24b20a7b7e8f183f6
SHA512 c262c00c8280a6c1fbe46875304a8d8c31c0bd080a0d65399c067dcb076485db37ca983936bf2be1d9f0f37fbd4448bd8260b05bfa18913c4a5e3078339b1adc
SSDEEP 12288:8hbHjfXgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:8hbHjPAnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T15655027E26AC20DAF63692BD88928546D7327C552B11A3DF2384427D4F3BBE40D79F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 efbf0ffd0baba8d89a67f2d52c2661b01ef9618a6e869e25354cfc0999d0a563
MD5 382ae95f5ab90f38a1cf4faf5dc53e09
SHA1 13f6c2561fdb038e541cb2e2b7b57c649e64bb81
SHA512 240041eafae5ea301b9a5f27c79a3aac9ed72b006235290a641c3dd2245f45c5e80720435fe2dc21f319fba9004350a4d875a0cd17ea2dee92f327847da52dba
SSDEEP 24576:t3YgnJcRTk4yti+R5dBR/4nQ/tbw/2Mkjy6Fr7g0o0:tIgnaTk46pBR/4Q/lFTjN4
TLSH
T18F45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 8910edd2c5345e510aea66a2b9e3b5a82e4f52107f79ad2e8c83b6d2ea65f128
MD5 19d7ab964545b0cfd627e4e884529043
SHA1 2e021075472525234433d2ff59fd4dde301c4be7
SHA512 7940404e9fe377e7655280cfa284ce3a8c70d221060e67494edd20e8ae9698871b599afbc70e076ff218b0e75558821f627b97b93711e17860c3b875afbf26fd
SSDEEP 12288:f1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:fVnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T16A5523697614F98BFA2706F54C838146673B0EC17B91A3CF7B48222D967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 f963e9cd1f0619e7b074d49fe1bd666f430127b37d5bf174751ae91b93ab8dc2
MD5 0fa99203b694c1d800d56ab71951f447
SHA1 62cdb11d5f7a09d9b985fa9a8d642b7d7d5a30e9
SHA512 01a20db7d8e805b2d0d86d4a42965eeb1ea8af36dca596fb5d58dbeeda23005f8b6cb973202263abf468f8f445dc9302fa9e5cf4ae43e857fd10db54c9890c9e
SSDEEP 12288:+Ob4A4LWOsvAYFTSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:nwL3UTSnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1D775F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 281cea8e19f9fd10ace7a5be7fe3efa502f4227f44eebc3420f69dbdfa132e35
MD5 1f1a10d1e0e9eede77b86733b0cbe6c8
SHA1 245c872db914518c7b4f0d2b35edf81ee6032dfa
SHA512 c494cccfc6e73b4d5e990d526c28f931522f1de427799a03b74583d1be0fc3f9ef9fc3e707701943dda4157d8cb2283e3011597ab67d568252a8fa93b42020b5
SSDEEP 12288:TpFtCOWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:QO2nQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1A455022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF85C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f78fb24248276432119bafb0c4aa86813952135e8e7defcdc6ecf2ffc763434f
MD5 6c3c9d47a69f55b34ec3e729630f3cd7
SHA1 8e1d900e54db1b9cf3d4d93358e6b4a80573f76b
SHA512 f687ad40dd1e4540b69a9c3f948c15699b8685112b0c544368747f4d6d26df81fb782b6bedc918621984d75dad552c0debc6fcacc0551098110c1117e9963d00
SSDEEP 24576:y7NM9YqZqmWMUkPjZM48Mv6bEhsRnQ/tbw/2Mkjy6Fr7g0of:y7cBWMpPjN8DbEhgQ/lFTjN4
TLSH
T1EC659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 199f2eed2cc2f5280197be8cdbbd37afe9d05184c3490092869ee9f62735fc0e
MD5 02d3af6b54bacbd33f8b3db85b9cc933
SHA1 0e2307904bdea61a044fd4e9afc9d223c1d5b09e
SHA512 d3cbb467b7a9d8ca3a77f15ccff7cdd66c1c51711eb8aa6d3e561a5b06dbdd041c8767d12242eb26332efc4f50d6260a90fefd741f1e378b8e2582c37422b7bd
SSDEEP 24576:hW6BApg2YuyuNDYTabvcdvNYf8km1fnQ/tbw/2Mkjy6Fr7g0on:hF2YuHNETovAvNYf8kmxQ/lFTjN4
TLSH
T17E857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 6082e0a38659577f7262588acc0b4a027647dae958b2ff56d5efffc037a9dc30
MD5 ee98cb303a4766fc6f5db9d53260d93e
SHA1 8cafb35420fcc92c0f90bfcb48f8b785238be0d7
SHA512 fd8080bdf8aeab7e9c2bd20edf7aaaf9a7f53607006e361c76831b51fe2f48973453d33da30189a33697e3c85d0811efdd2d623d87d8f7a38de8b6ea1f15c6b1
SSDEEP 24576:fAFs06+Omlf3NXEbTo6nQ/tbw/2Mkjy6Fr7g0oc:oFs060lVXuTQ/lFTjN4
TLSH
T15F65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 e32b5608c8005b50292bd807d5770f1028a3ff1c0a633d1cf7f16c9379861bcb
MD5 b30d86c0b73074bd1779a32372c6492a
SHA1 1d6a8a645a5594fde13b661bdcb61d72c7ff744a
SHA512 1d9012f20a6238864ddb0ccb69bea1669ebda82c2ec1c56e7e1c0ddf8d8927aff7f4d8622470a996a918bb0cbd30f43cf05a970fad57e2d3e1a8da68b65f7d59
SSDEEP 12288:1CJnJ5D3VkrqzxhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:sJnJ5D3WaTnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1B175D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 07091a8c5a50cbac2b86fe5c28875ec192119312503deb8edc6feff66d564fc7
MD5 39c7394ff4d93ae2ad0d383f70cb0e54
SHA1 a2d742aca51c1a2ffbffaed4c32a69d8de3f450e
SHA512 2666884440dfc706ce1ea40afaefd32bb9028a34c86d9bab07627b7a307db847ddefe1cd1f011d845b927d79adc5654bbd3bc1a5556458472dc30c4a2bde0b59
SSDEEP 24576:JEPghm6/7IIXdwcXrif7qQncjlP65i3Vu4nQ/tbw/2Mkjy6Fr7g0ob:ug06DIKdwc+eQnSt65aV9Q/lFTjN4
TLSH
T129955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 4170e7491428c9d007ff38d0d6fa3708df62174af6256576074283a5f20c513a
MD5 d172c756b5e5a5464d929664ba56b8b5
SHA1 88f8512fd75851013cf0bc582a290ed8da44bfff
SHA512 ab7b18c1017d62d7b24953170a8b004a6c49d5c3487d08e799ae72d6677ed1a558068bb882888448ac92adabd99431a89859950b45141ed181487ed18eb88e5d
SSDEEP 12288:5EP3RSHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:KSnnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1B655126D37ACB0DAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 ad34734021866ba3993e39f8f97ad89de3e29d2e237f588cebeed28d4a78fc05
MD5 9121bfd7d301437e275f0e777e086376
SHA1 cb41b565df868e1e49d367a9ac22230e28d7efb3
SHA512 d798f5e38a764bcc8012bbf0e2d46a974a5fc163d9e1002a51aca503fd1fcc47cb175c00496dce6294d50ebbaacbf02f220cb99b3dc38646824684a44420ebcf
SSDEEP 12288:SjkywGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:SIyQnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1896512187398F4CAFA7A06788DA381919B367C506F2193DF6280B23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 f581d3ac4d2757fe3a7e602f55c4a11e7efb27c1d076a7511305c3196628d469
MD5 73f2b7755dab5e563715454be085774f
SHA1 7446fbd0bdb5c8a260ad6b807fe10353fa25ae1f
SHA512 fa51da462a11698cdde486ef69af31d5f63b7914aa3ca17896f33acd3942c1a31d9cb1594334fb64aabeb7b0b182a2cbe3e83965a3922d198a1a9f6d3c978349
SSDEEP 12288:80mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:3GnQ/tbw/2Mkjy6Fr7g0om
TLSH
T14355236C3625F88BFE2706F448928542973B09D17F9167EF36846239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 02ba36600bd05968fd424a26b5e57ecd6000244e67639f1445ae456e82ef227d
MD5 46076c872ced575cc7eaba4df9c64bc0
SHA1 54a2439bf79bd32ea29e5dc3a943b6ee0ab51dd0
SHA512 7032289517390ef6043288e6053622953584b9cae64bbcce62cdd1a60f1b1e852898ddf23e733e445adc4c850b9f2003077442070f5e17de5c4cae7f3e92588b
SSDEEP 24576:BQ9MxZKdcz9dw35nQ/tbw/2Mkjy6Fr7g0o2:BVKZ5Q/lFTjN4
TLSH
T100558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 708c164ce56a45f96c55c286f7594f5c32acf37f0bc1a068c5ac4e39a73adb85
MD5 bfbc882fb527379259e6638a7f6c7ed4
SHA1 71d000cb930c0db94c82aec8b0c19def021c2b71
SHA512 89c983af2c4bde4151c636f60022b5cb856a4ce0d073930e98448f5f1db49f4e3765cd334b6f2c9dfc88e59c8fa4ee629275dbeea653f74870b9885af06f9eb2
SSDEEP 12288:YyoKo20Rple9pUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:YyocSAp0nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1BF65E01FBB6990A2E136813C88818745E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 16998a72c228fd0de8883d0444453edcf5263d6c069a0b86b75a733c96b28f05
MD5 485f143924efcaa8085e289d3f599cde
SHA1 7e00a9a90ce074d77d8d25b5f1c141b64ea7413b
SHA512 a4b6657a267633bdec18da334e3bb833fe42737a11f12ef058cd7549d02159a94e6714eae404ee91947181f116d46fcd2a29b244a76a7a859ef1fd77c6a6aa90
SSDEEP 49152:oWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK0Q/lFTjN4:K0zuNIdLm
TLSH
T11AA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5b0e3c470a56b618a18f70e50f4e5aa2247fe5bd8fb6923fc8ba3ae0d9dc59f7
MD5 b2a9eb57d3335a843dc1760bcc4c3a2c
SHA1 ff64816451cda0b1a921d912eb73355fe770bffd
SHA512 6c1d24c97a0a5081ccea50691edba57cd542b5640c89c91925b190d34abcf125916a2803a02ef91346535c11c8cd09183296daf6b03e19751d82bd04a00bab18
SSDEEP 24576:R1QT7EcpfxR+N5AWAz3ooiYtjMqbnnQ/tbw/2Mkjy6Fr7g0os:0TDxR+N5YzTfjMWQ/lFTjN4
TLSH
T1E355B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 bd8583dc82c41cd4c050397c83aaa0ac3be70e21b8e0b40077d80c338f88e287
MD5 d7fdf79de5c4485eb69dd769b321d465
SHA1 110dd06908db7bd0a4717e9792dee8a27c8680ef
SHA512 9c4282ac1a1507fdabac140160593caf96b246319d1ef2bbf1df05095927c8df3f5d937243e5ccb33aa66c5992d74709a8d7b9829e11eda179a572f64ce77430
SSDEEP 24576:xTMdOz0FFS+1mSL7nQ/tbw/2Mkjy6Fr7g0ot:70K+1mSL7Q/lFTjN4
TLSH
T18A75E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 1345e107cc9c9a6a85fbe6889f2eeb89e45caeb2d788ae67f48e878e19dbeeb1
MD5 3c55c9429d045a19189db211cd766e90
SHA1 a34cf562f510999d82ab505c8edd580a5614a5e4
SHA512 56ebdd4d9126b8eaf9f1ad3880f741fd79c423dab5d3f610553b7c1733c1dd1cef84582aff18a08b3e019c7f5e1f576ad3d7c912ed87345c9d5c48b0d9c19829
SSDEEP 12288:O4TSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:9SnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T19455122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/836-125-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/836-180-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1192-53-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1192-51-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1192-45-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1192-143-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1316-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1316-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1316-64-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1316-148-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2004-29-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2004-32-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2004-38-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2004-42-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2220-0-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2220-9-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2220-436-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2220-80-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2220-438-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2220-1-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2756-177-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2756-431-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2892-128-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2892-428-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2892-185-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2976-375-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/2976-160-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/2996-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2996-101-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3056-69-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3056-84-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3056-81-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3056-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3056-75-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3364-181-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3364-460-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3496-97-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3496-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3496-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3496-168-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3788-115-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3788-116-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/3788-176-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3788-121-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/3792-378-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3792-169-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3808-173-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3808-427-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3968-83-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3968-163-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4044-164-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4044-167-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4328-155-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4328-360-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4328-157-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4328-149-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4728-18-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4728-114-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4728-26-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4728-17-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4776-67-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4776-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4844-110-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4844-172-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4844-102-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4844-108-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4904-141-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4904-135-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4904-144-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4904-345-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4988-186-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4988-205-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4988-223-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4988-478-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4988-376-0x000000000CEE0000-0x000000000CEE8000-memory.dmp

Download

memory/4988-189-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5088-258-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/5088-132-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/5568-415-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-380-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-381-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-382-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-385-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-386-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-387-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-388-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-389-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-390-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-392-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-391-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-396-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-397-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-398-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-399-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-400-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-401-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-402-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-403-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-404-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-405-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-406-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-407-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-408-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-411-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-412-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-413-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-416-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-417-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-414-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-409-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-410-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-395-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-393-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-394-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-383-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-384-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download

memory/5568-379-0x000001B098A50000-0x000001B098A60000-memory.dmp

Download