darksiderat | c2f7a419d1a46830d2188a13f6075e29ef14caec29f2eded38267ea026740994

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.6MB
Sample260930-dahs7s1fpf
SHA256 c2f7a419d1a46830d2188a13f6075e29ef14caec29f2eded38267ea026740994
MD5 3c2ad84678aebd8eedd57fffc2857a96
SHA1 7812ec0e1352821e7db74e595b2ac10228da4e92
SHA512 7d6ab3e91604d61953a685854a8857a59454527afe14b50bdc21e86b7697eb70b84fbfbab0d9dee7a7babdce0c82bd76a00e160eabe43de6758d37cb913ea21e
SSDEEP 12288:F3EPn8MEEh0g34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il6:KjE1SnnrFb4PM4MYgLxEVyGLU
TLSH
T18E851267BBE830F9C97B8670C4A10686F77278319661976F1354A2222F373815D7EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darksiderat ransomware spyware stealer trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 4 IoCs

resource	yara_rule
behavioral1/memory/1036-15-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1036-17-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1036-19-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/1036-16-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Executes dropped EXE 22 IoCs

pid	Process
4816	alg.exe
4112	DiagnosticsHub.StandardCollector.Service.exe
4640	elevation_service.exe
3036	fxssvc.exe
4496	elevation_service.exe
1100	maintenanceservice.exe
308	OSE.EXE
4400	msdtc.exe
2288	PerceptionSimulationService.exe
2356	perfhost.exe
1148	locator.exe
4184	SensorDataService.exe
4424	snmptrap.exe
3044	spectrum.exe
1176	ssh-agent.exe
1564	TieringEngineService.exe
1976	AgentService.exe
3896	vds.exe
3852	vssvc.exe
3188	wbengine.exe
3092	WmiApSrv.exe
1228	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ddb27daf60f3a3fa.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 1036	3020	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe	89

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113156\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007443386c8650dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e4a5f638650dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e8f27648650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a629c648650dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081ab80638650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e1af3638650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000696901648650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1e2f7638650dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0b70f648650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4112	DiagnosticsHub.StandardCollector.Service.exe
4112	DiagnosticsHub.StandardCollector.Service.exe
4112	DiagnosticsHub.StandardCollector.Service.exe
4112	DiagnosticsHub.StandardCollector.Service.exe
4112	DiagnosticsHub.StandardCollector.Service.exe
4112	DiagnosticsHub.StandardCollector.Service.exe
4112	DiagnosticsHub.StandardCollector.Service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3020	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	3036	fxssvc.exe
Token: SeDebugPrivilege	4112	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4640	elevation_service.exe
Token: SeRestorePrivilege	1564	TieringEngineService.exe
Token: SeManageVolumePrivilege	1564	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1976	AgentService.exe
Token: SeBackupPrivilege	3852	vssvc.exe
Token: SeRestorePrivilege	3852	vssvc.exe
Token: SeAuditPrivilege	3852	vssvc.exe
Token: SeBackupPrivilege	3188	wbengine.exe
Token: SeRestorePrivilege	3188	wbengine.exe
Token: SeSecurityPrivilege	3188	wbengine.exe
Token: 33	1228	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1228	SearchIndexer.exe
Token: SeDebugPrivilege	4640	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3020	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1036	3020	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 3020 wrote to memory of 1036	3020	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 3020 wrote to memory of 1036	3020	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 3020 wrote to memory of 1036	3020	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 3020 wrote to memory of 1036	3020	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 3020 wrote to memory of 1036	3020	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 3020 wrote to memory of 1036	3020	2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 1228 wrote to memory of 1244	1228	SearchIndexer.exe	137
PID 1228 wrote to memory of 728	1228	SearchIndexer.exe	138

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-29_3c2ad84678aebd8eedd57fffc2857a96_cobalt-strike_icedid_njrat_satacom_vidar.exe"
  2⤵
  PID:1036

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4816

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4496

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1100

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:308

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4400

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2288

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2356

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1148

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4184

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4424

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3044

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4532

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3896

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3188

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3092

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1244
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 058a9d655a04f816f98a0d0014d2682a5301f1155d0a75b2fdd86085ea25c58b
MD5 1702f34cc25fc4508e34eae530d8a433
SHA1 0b4fa2a9cd8d909831e4fcfc0e7fe2b36029d5b9
SHA512 bb27154ef7aa2c92fef3acda72e5b68241b4de4eed25f9b78617f866863309de21f7e52276cef6d6e7fc719292c17ccf10f42312cca5667935c3efd1ddd8352b
SSDEEP 49152:nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnUj4MYPVyGL6:V3q6sjBWV+
TLSH
T1CCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 386d3d7046367e91f887f476d025419a7bc19d50d19ba4497b78bc108142f3ba
MD5 378173dd99ea28bc73f8d08ae98b9a0f
SHA1 4ae0db74f42e39f595fffc7ef99617444473f64a
SHA512 567f040c037cf97b6d7a6ca86a19da6717cc3f7c0faf4a535c3bc88295749c9a0be9ca0e3f63ab1509cd8acfdde034eaa611edd536b5b66af084ac163aef666b
SSDEEP 12288:61XLsswWkxy2lRq2czAh34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9b:QXYfDtczAmSnnrFb4PM4MYgLxEVyGLZ
TLSH
T1EB85F12977E408FDDD6B8278C8A28545E633B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 e97c6d665c14219addb348333d6a312cf2fa7d672313cda2432ead65e5bdaff6
MD5 3243798af93af3118c9542c49871a0a0
SHA1 91fc3e7333b79152ee9df1c1d1e88e5022bbd7d7
SHA512 7ba67f169b02227fb89a92f571ff817511cf8f51895f205a3d3794cccdc5e6cfcedd2d0204e1096fe0e9abe5105f2469e1e5cb293792b95e0501c9743d2b922f
SSDEEP 24576:S0Le5ji0hmxirMTSnnrFb4PM4MYgLxEVyGLy:SPji0A0/j4MYPVyGLy
TLSH
T1D7A59E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 82d87654180bb95adb379926353cb856f0d64ae87b4b655a9239e847ac46a0c6
MD5 09d7c53549673837aa8a8eff44268f36
SHA1 62079f75b5e181881619106e8b79bb38e07d77d2
SHA512 8af38568cb658d681175127ff08efe11658f69264980b88880f7f00a32557a3b210ef04f562eafd7ea36bda116038d91bb0841a604ed9c929e1dc2b79afeb3b5
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWn6q8wyu1SnnrFb4PM4MYgLxEVyGLu:2/ezSC6vUzPveHjyjj4MYPVyGLu
TLSH
T195755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3ed85b9cb79b02cb66ae4ecce76587d280a015a5f52e44f29124aad6776a510c
MD5 90e11cb51f77078664e0682cd9bcb4c2
SHA1 cfbd4d552b9d8999f3cee9dc36a29de876aec555
SHA512 1107e62f5d7a9ca0fca90928d8fe2244707b53cef59e89a46c989e5978dc403b61a8935ac04becdc7fb8f7c6faeb0609f5f14e4dce6732c4613bf31b6300d197
SSDEEP 24576:aVbqPb88hv/l+YCSnnrFb4PM4MYgLxEVyGLe:aVO88hXl+Gj4MYPVyGLe
TLSH
T1C4559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 dcddc8968c496b2711dfc5272bb9e71414f84b30fd0ce02e12fb7d220b30c792
MD5 a28568244a8533a3bc5d028a039b5f85
SHA1 b7c4ba105bb77a8a428801c68bcfc942619b2789
SHA512 22bcbeb466a030d6b2a27a7026433e2cfc31c6b4189e3fc1a05078df389521a18e2e828c4cb56b6d4882efb99b2c25ba6794abe141be570509eaa0de8e86841b
SSDEEP 12288:0NE34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:0NPSnnrFb4PM4MYgLxEVyGLP
TLSH
T1316523A76BDC10EACFAE15B0D1B96AC8E2057C61F875B20B6741785B3A3F60DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 a895852153149ffbcb904b1e070f23aaa1686b7d730241f953609191ac9e7b9d
MD5 05b1f2cd87d7eb072b6240878622ca7d
SHA1 821babe7d71d0c744866d530382ecba734cddac6
SHA512 cba0de9ca5d24c019f139b0d0869ae643d0fe5efb84197845d9efdf493fda9d1ecc039e9c97c6957e7140cfd1496de0c005a9569f5b686e35094df29036faf5e
SSDEEP 12288:ceBNUbTVO86Ut34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:cJIUqSnnrFb4PM4MYgLxEVyGL8
TLSH
T1DC85D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a07fbca801ff08a13cda988dc92d5a674446331f57209b6885e9f191d03a91f1
MD5 6e6782466d932427b2717fae6db0a414
SHA1 f495607ad00a55b70fc47078a920ea185b938a04
SHA512 ca5a49fa908869eb5884b7f472a4af604dcc5ee099ae48c7bdff480e59ec7acb56ee7594237cdcd29842b19da5e952365c36a76ad0f57daa9875a138c1eb7402
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THz:VQvGAdlCEL8c/DRNw5CfVW
TLSH
T1C3267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 30ea66e2b37f960124923157a558de737cbe6bf8ec93c83e86b6d763dab2bdca
MD5 ce10c5de7483c4326026976c61853ef2
SHA1 606d399cdc6682ae64655ac62abb6a5e2a944487
SHA512 3c88e1a24eb6a400203a3276b593657030a7e861a592c38cf17172ad3011673c4ce9a54c6250777444cbc631230ac88ab0e1002bd5e76bf221b0b1e4ab9f4dc1
SSDEEP 12288:5AwSfxL/2Dc3oDLLmt0LDQewsAjD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeA+:qFewsAjcSnnrFb4PM4MYgLxEVyGLl
TLSH
T1FB95E031FE74E036C7BF0DB21B36D716542DB9204B612AC3E3A89D9E59342C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 19e0e43fe971bb4fcbe54e517d86763a0a5c146e5841bcac716e9639a2962e43
MD5 ba474709ba7c8bd510faf2db5da21ee6
SHA1 a3dd9d3853ae04aff8d387befb280b76dc63793f
SHA512 aecb68214aa5608be9e04dea25c6ee922c84e93aecbfaef749fb450b3a6f8970dc02a525876b454d95afe9fc20d97f2eb62824263eb205bcf506d0b93014080f
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH:MUEtQevvqc2W1cpV2tI32
TLSH
T131474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b1c392be6ce0919fd88a808257ab03fbae6db2393526e3271f62f44baf004f01
MD5 cba890ec0a6b58f432cc9cfeae416a93
SHA1 1a9b3449df6b0ca51879e1c6c42a583b4c29712e
SHA512 3635ea12c65f3550bb26e4730438a5a1124131cfdd098885c17f925ebe71aac1e5747f62e8ca9067863ee1bb2ae5c47297d90422bce3f7447fa1137b3f46d65e
SSDEEP 49152:tCbRquA/m2yL5zLfFiV+XenmE3/zvj4MYPVyGLu:Koq2VjnmjVK
TLSH
T1E7D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2c1e06df5b3400cf04a9518220bd7323d4b1be24715783813e50c863f5a1805b
MD5 7252f65045a330adff55d450de54aaf7
SHA1 0483eaafb0d98a239f28ac8a66778ec8fbd63c73
SHA512 043f3082b14861d5786e7fc9c38f56d07181bc8945f287ae468c7b6fa6558b5794c7c8a0ecd4d086e1c0b4652566ab17f556d79e426891f7d6ab91cfecf6c114
SSDEEP 24576:SAhGL3IFoiwtA5l7S535SnnrFb4PM4MYgLxEVyGL2:SAMUFoiq5ij4MYPVyGL2
TLSH
T1A835AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c526b3d52e3630653faf58017bc29a9ced7cab4d805662f185ed801a4565f3bb
MD5 35edb913438494c620d17095601edd56
SHA1 1405f8987dbbaeba0e37708e8c8fed3cfc8508b9
SHA512 29681aaeb36a8d4a2c538a001c512e54fe38e4ced7c1394e6e37e2541ed017eb4e6b0785801d18fd17924a4a5a069489d14d10b6964d19d9048bd60f3caefb74
SSDEEP 12288:ymw5HEjsChN/BFgl0WDm+Ce34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqB:rwuGOWwSnnrFb4PM4MYgLxEVyGLv
TLSH
T1FE85F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 6104c6258173d6219e40d80d61305be6579e45d9cc1898e7deaad072c8f26901
MD5 418c85b74cda6db50c965b4f142e1567
SHA1 c4a3f363547206a34f22510c8b541a9c348c41df
SHA512 dc12bc5c0fcefbe6790ec59d326e6c39ef25741a06d6277cd6fcf558bb5874221913c301b6a5508bf93b29dab5049adfa970dae7bb7412b7398f98092983e184
SSDEEP 12288:7kZ1IyT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ils:QZubSnnrFb4PM4MYgLxEVyGLu
TLSH
T1BA7512AA37E820FADAA74274C4F55688E3227862B73293CF1750555A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ed35e3e176610cf7e93ec319c6eea8edbdda98a2378f8c12e97076f772f4a9b5
MD5 eb955f6ec9769fa40afe63ac73482d11
SHA1 057255f2912434464b2a346cd7c391d1e9810906
SHA512 00f6e017d26d8c70844e9c647cad896bc0471fa666ca6901d750f8e5916bac8519f3513a118903408a2db55adc23f929825c7ed876bfb0dc0c15dcc10254d2a4
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uq:FQRQyi36YOcPbLvw2gAf+PN3SVr
TLSH
T113667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f7bcfda1ac30cfac0c15425991e6ee10f17096423983befc33aa316b87920572
MD5 4c3c4862068f07acf0ad07f989467f81
SHA1 911f6642ce02b4bee0d54b0260d5dadeeb377122
SHA512 abad3d70d1b7e6a967c85f483bfe23d18bc203416dfd65c1ab9edb39114733d94870eff4a0039d2e0f85ecd293f5214a4e7ed4802e3d7a25d64971439affe2d1
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U:sQRQyi36YOcPbLvw2gAf+PN3SVB
TLSH
T171667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 69b76d9223ecf813415f86d8aa3493a7ad03f14977a1ca4cb7e806b97b02a1bb
MD5 3ab86028031fe5affdd69d9821f2c8d9
SHA1 73517153ac494412ead7ca4b99cca67b072c571d
SHA512 3b6cca5d33a12e18773bc7d19e30657ec3ed6f5f87a88123a043d340e9cc9d3b8ce6c5cfc6a80931e48716825f3bb4e3d912d7dd61fdeb6aafe8fb5f47cb3d22
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0LSnnrFb4PM4MYgn:o68Qg55nhceWu7PNU3//j4MYPVyGL8
TLSH
T1E8B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 602cab73e2a7ad700b103ceca1cbbb099372b980c60fcc6913506f352945b0e4
MD5 d75cc9d849835a6a9a1c9dc6021ed5f9
SHA1 668a4aee52114697112fb06bbce5f7d37b7dc81d
SHA512 520c738ea93a033d67baddb3a6437ba8fcf07ac6e1676d0cf5d5fd252046b290afba5419b3c4eed73218e779f3d035f7feb139583d3623d592183418d16346eb
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99u:my5112gYy5azzVvt69nLKnhZVV1
TLSH
T1E9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 09b48052ee37ff2f6eb4fc442a75ab097bc2077e2376486a939bee16bccd7540
MD5 6466dcdcc9d35e61d4d51922c25a5526
SHA1 2e646c72368240d56aa9ba22da4fa2aec8a75184
SHA512 13228facb9a12f9e28e7064eca70b4dd1b15359a0f11a4463a06732911d97cc6371de96825adc553dad80b93f46bd6370eb2907863d4a434ee08dd657d893d96
SSDEEP 49152:rB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glxj4MYPVyGLo:9u6Jmdxd2dKVE
TLSH
T149D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 44f29ba972257b52a4203e31c3254c6f2c073699174402837be3c4b875232279
MD5 f162a4ffd6e389b95080c303b6567eed
SHA1 45f15c02c297cc53f331780ced191f74799fba88
SHA512 c50ef14627f21882f27f94bcd43fcd8a7149f14ff18fd04029483c15bb2362f16270b05f8836b0b45d08d4c4f31699875cd62e934526705bb38cc2c84ba52f28
SSDEEP 49152:M1hpsNoJpF1A63U44CwH7R4xFj4MYPVyGLM:MmifPWRjVI
TLSH
T10DB5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f8225bb19676147af3b16af224daf3a64f45bb84c59ce3c6bc32002b3501420e
MD5 6e0b1ace5e4846f941a4f1b24ae9bebd
SHA1 5802ffc1926b560eb911a15cb586a986de1aedda
SHA512 228729aa577f2c014c2b4a74da22835ab1a35b49539b1802ec4a4a2b4e18d3af0c4f793f7f7219c425250a7e2af08614c1cfeb22ffbecc7bd494bf6e0b27c900
SSDEEP 49152:gSuZQIY0Be2KcRVtOnks6NMHqkj4MYPVyGL1:65dKii61hVJ
TLSH
T1F0C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3a06f12cc51b5fa30ba4e99e61eda22a1e1ba1270aab4a09a16c86d586e5f06d
MD5 dfc42f2d190a02802c955b49659d399a
SHA1 055cdbe83bac9be8c8be540729bf1c120ee486bb
SHA512 7d49038945132ff36da859942d822aca8dd83ba90bed155d99e515c4b5b37233ff097931faa3b40994f24bfc92c879c0cc6e03950643816290ca6de3f689cc2e
SSDEEP 49152:ohtSn8EApI0fig3giDn0AP5wBj4MYPVyGLp:5X2imphnVV
TLSH
T15795BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 ab315f0ae47212fce7fce1dcd42d924c51b6822f394f44a1c3fc50346d25f4ef
MD5 49eaf37f5ca236e18e82272f2d0f8053
SHA1 eb150a26faa645a3403fe175d44488350d6b485f
SHA512 ee113ddddbd0ce73425790a98c698f27adb45d9edf20c8f9373300afe8750a91209d38be61f0f6633bd3951e52e8bfab4efa83856d4ba2ae8f7d7dad19d69b59
SSDEEP 12288:0s34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:03SnnrFb4PM4MYgLxEVyGLQ
TLSH
T1206523A62EDD10EFCF5D06F0C1A966C8E2097C62F976B20F774574173B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 00b033b64261b3711e91eb2f5c31bd8e2f8768ebfa82e45f2192643e6e54f868
MD5 0507ec0bc0d6487a4a123a5bc14bd0bd
SHA1 6cc0d703150dc9345aaf4f491b0eeb350f6946d0
SHA512 45258645292403abb687b3e9bc6a6f1788d9d7449c4c2b9df9364597c400f7c86e23d9f4a3bec45807c78a20a3fed6b9129a5a9514606ac0029f16ece12e96ff
SSDEEP 12288:jH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:jISnnrFb4PM4MYgLxEVyGLQ
TLSH
T1746523A62EDC10EFCF5D16B0C1A566C8E2097C63F976B20F7B4574173B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 f63f470eee6d6c2da04f05d23da6d1d6c4c72aed9732db0eb7b6d6ac47aae712
MD5 f3ee5ea924a0dbd1a711e92e3e4f9842
SHA1 e8c89401b55884a090fa1fd158a41b67a9360f82
SHA512 ca1525db2a49d704eba3687b11aeea2478056cdc39161b1a756088e4429a84a430534ab762259178cb438b1b36d29a88f213cec243174dab89afa53db47dd3fc
SSDEEP 12288:6134XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:6ySnnrFb4PM4MYgLxEVyGLZ
TLSH
T15A6523A62EDD10EFCF5D06F0C1A966C8E2097C63F976B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 06f408a78c353eea3d0c6650a3991cf38e2b2ad9432c49df900fea8ffa066d10
MD5 b926863bfa44bca1fc6e3b6d045bb317
SHA1 a23a08cccd02298181f0ba2300cacbc7da5d9dea
SHA512 91b439384fd872777a33c2d9e2580481d0655d3d3d7bffc5f95edbc802d6dd8715cc78b88b5549cf4cf00c48a3a652ee3bb6d4e6998042b7f74fb4afb10abc5e
SSDEEP 12288:LVq34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:LSnnrFb4PM4MYgLxEVyGLP
TLSH
T1297523662BDD10DACE6A96B0C1B556C8E225BC62FA72B35F6740381B3F37348AC71711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 ff3d433bbcab0a52b7a00f331f1b0c4a2fef8d9cc6cbcc9613c4d17520593966
MD5 5b8e2cf5c73af93c347bc89f5b1ba192
SHA1 eef8f633cf60173626a012a51a571b11b6bcb771
SHA512 6fc14acb3e394d44c99f5cb170f6f7273511f1e21f6881611e6f7836a67ffc00c9a81510ee9864b22165d68a725d3024f1368d29183750c3c3b310aea6bd71c3
SSDEEP 12288:li34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilO:lxSnnrFb4PM4MYgLxEVyGLc
TLSH
T1856523A62EDD10EFCF5D06F0C1A566C8E2097C63F976B20F7B4574163B3B20D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 f294eaa68d753cfb554674e4785bb7671a786807e0ace71beec1b581417dac32
MD5 257fddd3aece65e98f3578f2064e5b37
SHA1 aaa65db4ff55f28273f8b686d94aeb2d490e2e8a
SHA512 cd5c1c1fff0ea852b8064c92ab4f47811960e1ab35c54630b5e887029d92b94399a802728a8d15217c906f7d9dafb6aa38622ea94fdffec31e17b4f7b4981421
SSDEEP 12288:RL34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilO:RESnnrFb4PM4MYgLxEVyGLc
TLSH
T1CC6523A62EDC10EFCF5D16B0C1A566C8E2097C63F976B20F7B4574073B3B60D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 2f7dc27f49f31329bfc2387566b03c179abea5c6a707d98bf2e7ef019bf6b9e1
MD5 34234762b63f51df91f6fb2221296904
SHA1 a975287855959cf5b9c19b8964245fed793192c7
SHA512 38641b5ea986c0ac08866143730ec7198a0225ae637c591c2bfe9b1d271c615ef187885d281f5aed13438f716caf3ecdbd11e4f9798b9413686e5119a551b36d
SSDEEP 12288:Kf34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:KgSnnrFb4PM4MYgLxEVyGLJ
TLSH
T1C66523A62EDD10EFCF5D06F0C1A966C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 5da84f410ea2cf94557f52c100fc58dcba6cb2abbdfb0fcf6a0812d130cd5f3c
MD5 76816eb8bb24a42d28d447f913bc493e
SHA1 91f08072a842626ff5cd490dc30c91e365673a08
SHA512 4dbb140105921beede888c6690973c1751f17ab9ee9f87363a2346b4cfde218b1bcda6bf7145dcaab5d6786b0f3241c5ad13a7f1f0967b4765cf672510dda300
SSDEEP 12288:MiZwbQzzFEoS2cPvyn34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r29:vZM4zFVSOoSnnrFb4PM4MYgLxEVyGL8
TLSH
T1E28502A5739018F9DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 381959a445981e9cca0ddfac3da8b61a7adf7b8b9773f5140a85e69b56d4e0d1
MD5 47e0df18aca406e8a3edd272ea72f2fa
SHA1 1351c18829f91fb5609a447a2d13ed0b0d35164b
SHA512 f3aad3b6a48ec28b4ca4b1ea97a097a5140cc392fd80dc67b85bbcb78293004487d6296d66073d1037861477bb855068383cbcbe585fe60af311bcf30b3c3c28
SSDEEP 12288:lY34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilQ:lrSnnrFb4PM4MYgLxEVyGLe
TLSH
T1746523A62EDC10EFCF5D06F0C1A966C8E2097C63F976B20F7B4574163B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 4e3ddb6d9618820706084d49533590c7e462f2bc474548acc719bc58fa78fcb9
MD5 e0acd0ae6dae335fcc73cef7931fa954
SHA1 63881388fe03b762cc8f6634f0c38d9fc73dc8be
SHA512 50bb7ec478d673bcebe42498af46d374536e897d186b8a226d07c5fc6c3a08219f8b381b94a8e0183357894aeb7a9ecfe1424e3115d6ad863b1cb3122dad3f82
SSDEEP 12288:DU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilX:DfSnnrFb4PM4MYgLxEVyGLl
TLSH
T14C6523A62EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574173B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 76506523ca59834d14d719c9ddf329ce5d2896a417565fd003eee6bdf4d88dbc
MD5 4cec5d8077f99c9022681ee386523751
SHA1 404043478125f631f04b19c7ea7d65801b2f5705
SHA512 98e44e8d5aa1ea6724e4fc846b475ffd13b591003739b9eb51c9a5d9dbe6c55e14087b831b222e98f892677e45d11e073d96ba477b026fb0f97fcfd53e4fbc6b
SSDEEP 12288:CyPz5L8T34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilJ:fzysSnnrFb4PM4MYgLxEVyGL7
TLSH
T19675025737A530FDC67A8274C4A21A45F336B8329B309A9F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 7dc2016efc005727412b73454297d8ec0f13a5ad02e9fdf7891a5922477d97c4
MD5 7133ee1b1e362978a1de647a421585d2
SHA1 543928fe0be17da5da0428728b2486249de105b1
SHA512 f6117b055df2969c90923c586258871ca4dbf005921b6bcded17c11759f4a4899084f981ccc9e97af38a6f6a22edc1fc17d6746790e69595569843b0b7c221e9
SSDEEP 12288:hY34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:hrSnnrFb4PM4MYgLxEVyGLh
TLSH
T18E6523A62EDC10EFCF5D06F0C1A966C8E2097C63F976B20F7B4574163B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 e906ea5b519e9e67a1e6df42c3ab4d32ca2bb67e07e4649a394f9355d492d465
MD5 9db27033d2a0b65225cd7b25e2982ef5
SHA1 6dc8a832af3b40d9140f06ea82db4da33fb831bf
SHA512 e53b84f8bee3f5f349c0cedd8d1966982e9ca358671e61b53b925a6362f74e732251739e916f9d2ffabef04bea18ec44f448c57413991e5b313814c46ad01e3c
SSDEEP 12288:0Y34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:0rSnnrFb4PM4MYgLxEVyGLI
TLSH
T1A06523A63EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574163B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 b25d136d64c5c8234b3c6c2701a46738bc04c149e90b7088984828fcae466d40
MD5 3de0b5ee195214d69f09947121c79c01
SHA1 6b9ac0c5e9b5c47dac1618119e1ab454122d125a
SHA512 4e14bdd3cf55ebdb1a0e9fe72e7305ef11e617f778cfe005245d57f21434e5c24e271b2ba77bcf0c77e724990cbf0d898f9c4f9bc1c403d22b675c396e3f36e2
SSDEEP 12288:EyPz5L8T34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:dzysSnnrFb4PM4MYgLxEVyGL7
TLSH
T16D75025737A530FDC67A8274C4A21A45F336B8329B309A9F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 bfcf519783289fb49a3fa11e87f22c72a73802715a30cac26720087142b2e154
MD5 41e82585a090b3e3e17ae64216b8677d
SHA1 73171d5c5c7597913c77661de24cc62854050272
SHA512 43d5c830be32c7c07c7e9d797b2f155c1e76002a5e281325ffebbc0cfe019d7ad2178fc2ed1e21884afe2d4e2e4677be56733174409048f6310b59b5faddc20a
SSDEEP 24576:GT2aLl3z0zDiSnnrFb4PM4MYgLxEVyGLT:GTVLljOj4MYPVyGLT
TLSH
T1138502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 5a11a79a9e40d33e4cd251b54f2ff2e0e785db01e551c8efdf110a02f68bfadd
MD5 ec6258d99ddde03e5af5aa0edaed38f0
SHA1 08a413b56de2a2f0e3f5ec4e3561e9e6c1dc39b7
SHA512 0f956064dbe7b4249cba33dd750ec0334c57f3a0d85e0648794da5af6bc979332afaf1a27069f250c6b02bb9006a161ff7d9b8420f645b5b77da35dc3acd94d2
SSDEEP 24576:n3Jd9CHKy7GZOSnnrFb4PM4MYgLxEVyGLl:3Jd9CHKyaHj4MYPVyGLl
TLSH
T14A95DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 79e5312294c2dcc09255694a05fe30b8602a314d706c10af449b51708572e3ce
MD5 365150b8260d403e16c1fca205bc95e6
SHA1 850b838d928742ccffc3f113feda948dfe9efe6e
SHA512 77fc9a3f2b2b763c4baf35740b75a5b4d66359b38fc527672c2513d67f52e60d16a2767a89bb5cfea3270224b888cb5232721e146833b142a89d538bfb3c4d07
SSDEEP 12288:dV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:dSSnnrFb4PM4MYgLxEVyGLM
TLSH
T10E6523A62EDC10EFCF5D06F0C1A556C8E2097C63F976B20F7B4574163B3B60D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 74146d8574a718c8f2658d2a073c124f1dbc4296fbaf52323397515f58517e63
MD5 717b4f5faf431bea41269e77fa288162
SHA1 e68a26e74fc50cc8b6fff5b342a639d58132d078
SHA512 db6fc5af881b11fa660bf035aa140e2c92010495055c26cce9238209443d2b1c13607316cce99c544022be197976dcf8e1f424ff07c541c2b4db182d76276841
SSDEEP 12288:bz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:bMSnnrFb4PM4MYgLxEVyGLT
TLSH
T15D6523A62EDC10EFCF6D16F0C1A956C8E2097C62F976B20F7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 74754ddfedb248a21d0353588e608de75b4f6afc9946ca8c363c6d6e3d78e684
MD5 7aaa4a373e7b13dbb17724c57acc766b
SHA1 9174a2a80c0315d3a6092f96052d904274c79939
SHA512 27a89fc2514a21bb56c3dd483790e12886d19ec5d9480e13bd88e45b16ff55cd0f8fde38cdf3a885f5f5498471f955ad8890bd1f692b857036addca96aa3efbd
SSDEEP 12288:jW34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:jNSnnrFb4PM4MYgLxEVyGLf
TLSH
T1186523A62EDD10EFCF5D06F0C1A956C8E2097C63F9B6B20F7B4574063B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 0d3cbc61325a3eed5f9e03b997a39e063efa5f5ff36edb6c8c0c92a3e1985471
MD5 29ae166b919ded6d9e7b1f18d5c2ad81
SHA1 d338965da7de6a7ccb40fb12dd37530521739330
SHA512 96071dcaea169e0cdebc4fec76f3cb6c43c323350699ceb447e0e63c8c47ece9d101be385d81eac5dd76ae0e5199df8fcfd2fffe063626ed98b82f05ec8e6c45
SSDEEP 12288:DFsfI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:YbSnnrFb4PM4MYgLxEVyGLK
TLSH
T18475F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 7ae7b50c370e276f5c8d78f7b70e9c85eec74a906245795da1fc153dccc7005f
MD5 547e883acd93ddf09e94277d473beeb7
SHA1 dddeefbef9e39d10920968c97eefadc7bb69887b
SHA512 381cad2ff3fc306efd8680c183b69f3aed8c3284ad0f8b4a7162b3829bab6110967462827d4d7a2884a23bd469afe1b910db0fb58c894bb9775cdf56a842140b
SSDEEP 12288:BU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:BfSnnrFb4PM4MYgLxEVyGLs
TLSH
T1766523666BDC14EBCFBD16B081A996D8B20A7831FE71F10FB740741A3A3A6499C61713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c30c8baad421a5cdd6ec9b7747d431af904e6a96338a7e3b2face9a4efb7b9a6
MD5 d54ee8f11d38cc42da698850b59d5a77
SHA1 3f98b48f1264c924692a4204e55cb372aed1c118
SHA512 cf9675f4f861c429ee6f755833096b3e1f1256d660594135dfc4d1199490ae2018d5c6462fd35c6009a5fcc41c17bab77ca14d66cd4685f4814cc39bd9114e6d
SSDEEP 49152:1a0h2GEkuAe73q3pp46zwwQGj4MYPVyGLz:1a0hNYG4JwgVv
TLSH
T15485AF1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 73d0cda461be35cb8b82e2f348997c22e9ed02cd8eafab5658a7b170a3dce193
MD5 1c86bae07423bc414ed9e8d62976eaa8
SHA1 3628dffb29855a3240d551208810279016477b40
SHA512 3944ecaa14860536b04c40e5490f77ebe08c43c4f64e228b33dbb03c0975690ee715c1d89920250b03f97c53480419026a25304eaa4cdfd2e2becfa1b3850dea
SSDEEP 12288:EhbHjfX334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:EhbHjP4SnnrFb4PM4MYgLxEVyGLy
TLSH
T11875127E27EC20D9E675A1B8C1964649D331BC226721A3DF23C1917E2F3BAC85C35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0f1a37cc5d61700b19461f0c4763b19747401cdd19f0ccce75b3a122cd041d1a
MD5 ef457f9c021bc63b52fcc1005548b579
SHA1 9a15bceca8e4ddd6ed78214f3c89005900a19939
SHA512 0e2cde5317373b769865276e5530dfaf8b38d62fba1b60ea891e20df573a5c93044d5e84e34e87448e3dd4bc556bb2ce30ae6fe9554234c07d9be6d2f17b5ce8
SSDEEP 24576:S3YgnJcRTk4yti+R5dBR/gSnnrFb4PM4MYgLxEVyGL+:SIgnaTk46pBR/zj4MYPVyGL+
TLSH
T14B45BF2EF2B910F9D8AAD236850147B5FB71782D1F2096CB0170C538AF1AED85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 96d2bf2b170310e7835ad88097465e50e7d5e1efa929cf3e413421c7cba0c5da
MD5 82962f21e3c98cdd5d312f84c5e0697e
SHA1 d0826a871b16a175736a17a9d3aa6b8efefd7cea
SHA512 36961b2c75b4f077ecddc562cd9de0fb7438fef92ad472535d52d3196e599abc99291a9e585e7e19cdc5141dc5201d4e8c1fcba11f9a3583e80ebf20365041ff
SSDEEP 12288:3w34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:3DSnnrFb4PM4MYgLxEVyGLo
TLSH
T1A66523A62ADC10EECF6D56F0C1A656C8E2057D21FB72728B764174173B3B68D9CB1312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7ebc5690af8ab30ab60ee65f5c88bd0f1f20bccfe447d048e945d577573b9b35
MD5 7b6608fceda8d54d5609ebc379029a8f
SHA1 b94d0b7534991a091cc00239f7f9b862987ab00f
SHA512 affad7ab3808845d8083d8431a7438bb16847facea37770c2f3b0d0b860ab180fe6ae49ec98f3bc82b10c36b355e103e9e2fe3922bb549c34e2f62f17eb836eb
SSDEEP 12288:7ObWA4LWOsvAYFTt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:EmL3UTqSnnrFb4PM4MYgLxEVyGL4
TLSH
T19D950155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 bee0899f23e74528e549f525a0b6d4301a98791d985264a3083a4c2b500dd85b
MD5 328c9a6e24111f42ee5e3c19f0ee4acb
SHA1 cceb861be847dbc7a1dcef210cd41da29098d5cf
SHA512 01bce68b11f7fc85d2f7d43fd1d4f5e756bb92140ab3abbb7d9ade2315f79190cec3e54b4835ab2e8bf572b6759c6daf5e05449002a3b577e36e3b8344057888
SSDEEP 12288:ppFtTOZ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ill:TOeSnnrFb4PM4MYgLxEVyGL3
TLSH
T18B75026A37EC10E9D579A178C592434CD331B8625B2263DF07D0907E2F67BE86C36B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f2333cf5c78b0983ff862149da0a6426c4fd683b60a60f15b9f0efb68f0ba46e
MD5 c2d8e6627e7cd027b5880416b3ee9ca6
SHA1 4261a541b1768d0f4a365087566a9ebb4014bdf5
SHA512 5e3dbe6ba6e82a648c89bc78b2687a90a5316bba533ee5b9b2e883d321492597f15f6cee7a7fd8471fd23874ed9863ff47c50981e854afe3804393a8a2b2fcf0
SSDEEP 24576:b7NM9YqZqmWMUkPjZM48Mv6bEhsvSnnrFb4PM4MYgLxEVyGLu:b7cBWMpPjN8DbEhHj4MYPVyGLu
TLSH
T113659E2E6BEC81E5D576D13DC9A28245F2B2B4611B318ACF1252833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 c38b8b6fdcf3006d11791fcb8d24276f91cbbeb9d569232c3207809ab8824e9f
MD5 383220a2fc5827572971cacf8f025320
SHA1 0d2a28f1449ea6f392c82be2ea6deb4253f2e19e
SHA512 d0bca05823c0988e3a3815d49e51837a2e737c67150d4b540ba18f5952f218d0202dfaba516620d73f9c98404430e6062a8c94aa4a6c6f55ba662339519c98eb
SSDEEP 24576:JW6BApg2YuyuNDYTabvcdvNYf8km1pSnnrFb4PM4MYgLxEVyGLw:JF2YuHNETovAvNYf8kmoj4MYPVyGLw
TLSH
T1B3857E6927ED80E4E0BBD27D45B6D286FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8a7f1dc071deba1aba2a44398b6658299ef706ad16e729c97ea17ba3355f64b7
MD5 b6b91a84683383f35d5e4eff1af0048b
SHA1 d7c1ba7b86f7e9032820b5e287fc92c1424ff972
SHA512 611ae293a5651666e99da702c4f1bdd9ff3372b0fe4ca2b546516f7368a5b52ddba893e770e622a573c2783f0cf04d1c5d89abe99ec1e6400482b74ccbf7c141
SSDEEP 24576:zAFs06+OmlfkNXEbToySnnrFb4PM4MYgLxEVyGLs:8Fs060lwXumj4MYPVyGLs
TLSH
T1F865AF2F66EC00D5D07ED17D8997C91AF2B1746307256ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 cfd5a6aa73d72fe94feafa1357d47a82760d4a94070087f9d25f2240af539370
MD5 b72ff981e28c5ea175b04abb9e7d433e
SHA1 b7a8bbda14858e1cc11d695fb21eb9ded33b8ed8
SHA512 e6a5a8d2a211d37bc1272c33b90cf5e7da72ce925d1ee1b9fd60697886a20d7df55bf1d0860a9db5a6b21c5feb33747ac5524ca2ecdc823da89cfa14cc507663
SSDEEP 12288:fCJnJ5D3Vkr2zxE34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:aJnJ5D3WeNSnnrFb4PM4MYgLxEVyGLm
TLSH
T14A85D02DD2A810E9D4B7C2B4819A1785FF72383D2F226ACB28B4D5353F12ED09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 764eb6f289df460028ab22f8f1cd47d0fd2b9825ae070271bda95fc3f72b2455
MD5 8b3531430b186db3298f9cd18354816f
SHA1 6a8e61cd8dfdcfabf892712afd7cc03440a1376c
SHA512 32c7637ec53cf7591a7fa716f033938098572d2020ba3ba7615bacfb0f787b334a487a7e320e50da3c628a968087da42caa956c9bb362deeb8d79f6454d68f28
SSDEEP 24576:qEPghm6/7IIXdwcXrif7qQncjlP65i3VuMSnnrFb4PM4MYgLxEVyGLl:9g06DIKdwc+eQnSt65aVUj4MYPVyGLl
TLSH
T136956C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 bc1f36e3df6f45da855a8cb850618d1ea14a0fff5eca005a92ff3ca0af5a05a3
MD5 51957d2b5b860eabc375b82d53c8007f
SHA1 e583f094d4e6ceb9ab11428c373fe00c24eb8e38
SHA512 c8f995f0cbe46e7138f5b1f2f9050b9c2fd81d26d8c2215d2773ecd52eeb97a6993d3ef9b43c82efd51e2a1ae4ab90528a1c2ffbb263f609e27ea4142eac5ec0
SSDEEP 12288:WEP3R2K34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:V25SnnrFb4PM4MYgLxEVyGLt
TLSH
T1A275126E2BDC20E9C62A9178C1A18684D332F471BB6273EF1690D13E1F37AD95D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 b23da5dc391ad756af96fe3ce6e23296ea641d941de273bf95bdf679a38fcf58
MD5 a49cffe680b0dc62d91dc6f2d659f38a
SHA1 08664f085260cb15aa85aed6c406d6bfb195b88d
SHA512 7a35989439addca3856aba6a8f3e9866b6829e18c0f092f3153eddea58356dff2b9e918d6aed53257397ef2eb014d95c276fb072319f601938e496711fc08352
SSDEEP 12288:kjkyr34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:kIykSnnrFb4PM4MYgLxEVyGLs
TLSH
T17275125527D860D9DAB90674C5A682D49A35BC21AF21A3DF6280F53F3F377C8AC31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 86bb09ca9277c342bfbd87f035896525810676a8029d2d9d66bf487b3928fb19
MD5 5e48e0fbda640e37f27380020d99218b
SHA1 dcfdb2a2bfc21199c0cd7143e5f9242073f90ea9
SHA512 119e377a2a950bb57f840141947d06df74eab1f1901e7236ab586a8b1a8b2ee9fd1551e65637d982442b9d5be48f3cb86cc5c0b657f3b5e0dcd86b4ebbc28831
SSDEEP 12288:oAJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:fOSnnrFb4PM4MYgLxEVyGLV
TLSH
T14165236A2ADC20EECF6916B0C1755BC8E2157831FB71719F76C0B4363B3B68958B1A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 96628331ac2892578b49e5992014bf7e614657a852f607103fe9371f99d9e4d9
MD5 ee9b743cb45bacfaf4b6dd1be0ecb4ba
SHA1 b6d30e60ce36650fbca834e09845110dbd1a3ff3
SHA512 08ffe4cbb4229b68937a181f018b4865e7cea45c54c2e7645ea329033332e74a784204acb17827dc9e97b265e43b4254a45f29a65009108c665499a358fe9426
SSDEEP 24576:RQ9MxZKdcz9dw33SnnrFb4PM4MYgLxEVyGLO:RVKZwj4MYPVyGLO
TLSH
T1B1557B2DABE905DAE177D27594A250C3A633B4311B31D6CF2448D03D4E7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 13bf28ed32f472a5b6b62090e6d9794141f8367caad7f4d289a4bcea5664a720
MD5 f2eaebd06517d52612ba0667858c4034
SHA1 e1c7328272d5f48ecde8b3e9e5826c394586857f
SHA512 0c823ed23819928cea704e27a307e618a1441018e7360384dc6aef50a0e83ff40c040189f42e31880ff5aaa2ccf4e250cc2be5a322782b5295c40e4ca4f83b9e
SSDEEP 12288:3yoKo2YRple9pH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:3yoceApISnnrFb4PM4MYgLxEVyGL3
TLSH
T14885E01F7BAD40E2D176813889858785E773B0306B6263CB6691C33E5F27AE9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7711aa859c88c62bf37fb4cd11bf9532871417248bd73d8a573b707a847b5c47
MD5 84d3a67626abbadb1f9371302ea61a2e
SHA1 7994ed3ca1cd95a459569a3726e56ac7694932cf
SHA512 6a03be493f3b19fc9be6f7e3cd848e9f81fbca7da3247038ca510a06ebfab6a4924fd806b69aac4479f51b96c4c9d721d74c57c6aeb0bae1630fc46e91507326
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKbj4MYPVyGL8:40zuNI+VA
TLSH
T137A57B3DA2EC00A9D9AAC375C14513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fbcef4f44563d8152d5081a5224372793fe9b0ebf6b76b5c3c1bef4ebba92d6d
MD5 76725f336fb9b485396fa1c56cf03606
SHA1 b156cf53bba5a488149234c12c0634c459543cc4
SHA512 319b89e2c990ba16493f59becbe5fde3296af58405670ee186df5762b0e6d13a3cbd24b501819ec04671a9fa1622cfba1fbc829f4631d8b3822e30db3641637b
SSDEEP 24576:41QT7EcpfxR+N5AWAz3ooiYujMqb5SnnrFb4PM4MYgLxEVyGL9:FTDxR+N5YzT4jMhj4MYPVyGL9
TLSH
T1B055B02EA7F815E9D1BE85798A23C502FA727821133193CF42A0C17E1F6B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/308-243-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/308-75-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/308-81-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/308-85-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/728-431-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-433-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-452-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-453-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-454-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-455-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-456-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-457-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-458-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-459-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-460-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-461-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-462-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-463-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-447-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-450-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-451-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-435-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-432-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-437-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-438-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-436-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-434-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-430-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-429-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-427-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-428-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-426-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-425-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-424-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-423-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-449-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/728-448-0x000002D8A23E0000-0x000002D8A23F0000-memory.dmp

Download

memory/1036-17-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1036-16-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1036-15-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1036-19-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1100-69-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/1100-71-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/1100-63-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/1100-83-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/1100-86-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/1148-334-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/1148-280-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/1176-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1176-420-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1176-308-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1176-302-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1228-443-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1228-446-0x000000000D800000-0x000000000DC44000-memory.dmp

Download

memory/1228-416-0x000000000B3E0000-0x000000000B3E1000-memory.dmp

Download

memory/1228-335-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1228-406-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1228-359-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1228-343-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1228-415-0x000000000B3F0000-0x000000000B3F8000-memory.dmp

Download

memory/1228-418-0x000000000B3E0000-0x000000000B3E8000-memory.dmp

Download

memory/1564-314-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/1564-421-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/1976-320-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1976-422-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2288-263-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2288-257-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2288-256-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/2288-326-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/2356-275-0x0000000000870000-0x00000000008D7000-memory.dmp

Download

memory/2356-270-0x0000000000870000-0x00000000008D7000-memory.dmp

Download

memory/2356-277-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/3020-33-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/3020-2-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/3020-9-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/3020-36-0x0000000140000000-0x00000001401AC000-memory.dmp

Download

memory/3020-0-0x0000000140000000-0x00000001401AC000-memory.dmp

Download

memory/3036-49-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3036-93-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3044-414-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3044-293-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3044-297-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3044-290-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3092-442-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3092-330-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3188-327-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3188-441-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3852-321-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3852-439-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3896-324-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3896-440-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4112-28-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/4112-21-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4112-27-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/4112-29-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4112-238-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/4184-283-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4184-409-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4184-412-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4400-322-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/4400-252-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/4424-287-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4424-413-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4496-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4496-242-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4496-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4496-61-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4640-241-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4640-48-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4640-39-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4640-45-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4816-211-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4816-14-0x0000000140000000-0x0000000140191000-memory.dmp

Download