72058cfffa27e57ff6838839b0abaf02c0afab0f88741f8d1d2bad0ddaaa02a3

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 3.4MB
Sample261001-rwce7seb95
SHA256 72058cfffa27e57ff6838839b0abaf02c0afab0f88741f8d1d2bad0ddaaa02a3
MD5 5047c16782ce67f192f6ab35bef1fa8c
SHA1 d5814fdfe00e75004a8d44d781e2562dac1e14c0
SHA512 76674ad71b88338ba62b4784943badba67c4d75396dd4b3ebb4c53b70ee5b63c28371c57f2c862662ad026d6fb1286ccadf4059059b63a9d6ea42fb551cc666e
SSDEEP 49152:TjymKaGkZRfISK0j7QNRWIWj3SCYhxSMmT8oWgBCaXH7Zt5TkFyAnh1EVRkhxSMG:XpG2X3/Y+M4FHXHn5Tk0AnMA+M4FHX
TLSH
T1FBF5DF13F29900E8D05ED278C7569632EAA27C450B31B6EF0690B7952F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1704	alg.exe
3672	DiagnosticsHub.StandardCollector.Service.exe
680	fxssvc.exe
6072	elevation_service.exe
2476	elevation_service.exe
4324	maintenanceservice.exe
2684	msdtc.exe
6080	OSE.EXE
6100	PerceptionSimulationService.exe
3596	perfhost.exe
6064	locator.exe
368	SensorDataService.exe
2072	snmptrap.exe
4916	spectrum.exe
2532	ssh-agent.exe
5180	TieringEngineService.exe
344	AgentService.exe
1764	vds.exe
1360	vssvc.exe
2340	wbengine.exe
5136	WmiApSrv.exe
5132	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
\??\F:\	alg.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\aac366c7227ba850.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac91a21cb251dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e41d21cb251dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c69d91cb251dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b63b4e1db251dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000df3e21cb251dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2a2f31cb251dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac05d71cb251dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b94e01cb251dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000084f611db251dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3672	DiagnosticsHub.StandardCollector.Service.exe
3672	DiagnosticsHub.StandardCollector.Service.exe
3672	DiagnosticsHub.StandardCollector.Service.exe
3672	DiagnosticsHub.StandardCollector.Service.exe
3672	DiagnosticsHub.StandardCollector.Service.exe
3672	DiagnosticsHub.StandardCollector.Service.exe
3672	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4132	2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	680	fxssvc.exe
Token: SeRestorePrivilege	5180	TieringEngineService.exe
Token: SeManageVolumePrivilege	5180	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	344	AgentService.exe
Token: SeBackupPrivilege	1360	vssvc.exe
Token: SeRestorePrivilege	1360	vssvc.exe
Token: SeAuditPrivilege	1360	vssvc.exe
Token: SeBackupPrivilege	2340	wbengine.exe
Token: SeRestorePrivilege	2340	wbengine.exe
Token: SeSecurityPrivilege	2340	wbengine.exe
Token: 33	5132	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5132	SearchIndexer.exe
Token: SeDebugPrivilege	1704	alg.exe
Token: SeDebugPrivilege	1704	alg.exe
Token: SeDebugPrivilege	1704	alg.exe
Token: SeDebugPrivilege	3672	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 5108	5132	SearchIndexer.exe	112
PID 5132 wrote to memory of 3164	5132	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_5047c16782ce67f192f6ab35bef1fa8c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1240

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2476

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6080

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3596

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6064

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:368

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2072

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4916

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2152

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:344

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5108
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c7bf979378c62c971fd1fba5ce4bead267ce34bded3f4e3118b4e1410c833f8d
MD5 c394c0f7f0d227f52667041cfc307f75
SHA1 828ffbfff41a4dc8172d80da559d3e21a88a0a2f
SHA512 1f0cde5af22f53c2ec03da33ac8e37993e8cab0d9f4aac072e52e4cdb3538bf8e863d1f3f8c114ccb3dacf884096afdd9172f6bdf8da27a9f4b35331cecd2486
SSDEEP 49152:zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnnhxSMmT8oWgBCaX:R3q6HjB2+M4FHX
TLSH
T103D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3d9eef81d22a8682f3fd04fc1afbe899c904b0ead3f44e44ce65c235ed3c24cf
MD5 3edbfca862873a1143b385becdfa46b2
SHA1 58ad9de811c729acb9c0dfcd218cb65a8fa7abe2
SHA512 2a4beef2a33b3b8925bdfcab0dea20deed3752d465339dc98e8ca0110c627785b970cd9c465faddc65a123da9a8f4d52ee659617d118e551c9a4d8cb3610e726
SSDEEP 24576:TXYfDtczA7rKhxr+EHNmT8oW4ll1JCrLKXI:2tcJhxSMmT8oWgBCaX
TLSH
T1BB85012877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 31fa051b963b560671fa2962de76b5904407d9d7cb2a58bae00e27ef1c1b7898
MD5 209a75d14160dc466901c3f34f520ee2
SHA1 c45bbfaac82e57ccaa83d5e5ad3aa1293fc4eb8d
SHA512 2fb16564eb8d264d6e7f7bdd855f79d7c5138a3e65c7dbcd8dd39f71913cad69ddbdacdc98cd49a1223004725b9705bda1e7be2b9af1d19634f1d5f5df1ec34a
SSDEEP 24576:V0Le5ji0hmxYrMMrKhxr+EHNmT8oW4ll1JCrLKXI:VPji0A24hxSMmT8oWgBCaX
TLSH
T14E95AE26F6748335D073C0B9C5D2A68AED71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 abf87e3a8246e75d304b10d57fe2776021d74ab00b22a586b6898f8542d4a5f3
MD5 5761550c8885188abe4ecef45368dbe7
SHA1 b8c0a1aeeb5be2d95c70a76504182ea6d8ac25b4
SHA512 b028950570470e070e9cf8a32da86927f8694849660abb4dc0ddddd4a5e1e1899991b5b8eca5d07859d7ad7ef1b9f94e10dcba496a666b0d76df683d5f5aedd3
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWE6q8wyuWrKhxr+EHNmT8oW4ll1JCrLKXI:s/ezSC6vUzPvxHjyshxSMmT8oWgBCaX
TLSH
T1D4756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 59b18bbed5f2ed15c9004dd30092de9d763c05b22619d5d178e76ee132395b0d
MD5 e7cf713b7a1a864bac4c2498a35a4f82
SHA1 554545ed0173985a114915bb4b5ac981fb2c3218
SHA512 e56d5387edc2109273fd9946e791ff1c1df053a24336456ed4163df66f8b321b0a63be4b9e6725b427439f3b70de33567e999a5af41715164823390b3a3ceff6
SSDEEP 24576:hVbqPb88hv/l+6HrKhxr+EHNmT8oW4ll1JCrLKXI:hVO88hXl+DhxSMmT8oWgBCaX
TLSH
T1EA559E66F6748331D073C07AC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 2e448498972b99efc0205fe8bf88bcc37f9d112d1ac2712f6be8f3d922e5b2a0
MD5 96853f7c7796e027df35a2b9e9a84620
SHA1 10b502d4094715786d94df46e98cdb5f09c69e8f
SHA512 0437eace7bd6ce50d06dbb585be7ac1aa54cf674b12b3799600b3e2403fb4a99dfbb18b858123fad7d0affa27b38a0885de64f1649839b6a78b1e67cf1f24d38
SSDEEP 12288:kHsJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:kH4rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C76523759F0D64ABEE3B8335F87257129A990DDCD1412E3B8F3A3FAC3934C1A9552212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 49fc1475fa5bbfad4e693850fb21e16fc56f9fbbfa8ae596cb7112bed5f59b1c
MD5 d6ba9470512f7a7ec69060b97e600d22
SHA1 9bb1efde8e78927a92905955b9388b8e209e7d22
SHA512 cc6bdfa140c6ec52c8cd6e94f6736baa104753a2fbcbd1149e778eade66632991eb5e79ebc2c583f65c893e3aaed276d25091f97fb00cb88190c132de8eddb7f
SSDEEP 12288:LeBNUbTVO86UJJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:LJIUfrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DF85CF3BEE28FCD2C67A8D785A918700D77278704B52A3CBD175830D9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a8579faa0c956b438fd1bf9b398792d577d3abe7df511eb6a67a860a221b2df4
MD5 a6f8e15ff10967836bfddd6844128d67
SHA1 418a6dddd9feca8c491c22e497c5afdc1568c36b
SHA512 3070a82551dc241fef44a4f1d85c9cf9894442b37991590e9da3b06fa532a1a57e6da5911ff74e64a0eb6f0f63ca52e974e6855eea5713793c6bc763dcf8df61
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THT:ZQvGAdlCEL8c/yRNw5Cp+M4FHX
TLSH
T178266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 5f3055da1567321d32598d318752b7eb450d62a14cc8ea6d88c0fb5115c34a92
MD5 fbc37df16a066c0740325c93faf303d2
SHA1 aad4ee2a2a017ac1915fc53837031042fd18e427
SHA512 026d1ea345863094066b32565b832ec902017a0397297a1e6c0fec6de71b38ea112100220a291c319c3beea46c592a18eaafb03ebad8624e9a7a8bf808c3b55c
SSDEEP 24576:S7ewsAjhrKhxr+EHNmT8oW4ll1JCrLKXI:AljohxSMmT8oWgBCaX
TLSH
T1B885E031FF74E036C67F0D766B36C716586C6A604B522AC3E3B88E9D59302D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 10b4a46c5990d4f4a8756bb48dabe0d9e3d864471bb35a00a342952be67c7645
MD5 5950f1681094cf8babb5eadf2e62e12c
SHA1 d828082d6ec52e4970bda50f52f9b10b363d71b0
SHA512 ea1c255bac3743457588477b275ff98d7773cfd4c1c4b22baf36dc43f5bc72e16d6578b8e948c46e75889284aaa5c03f41969759f7ceda9e02e6bbe35892de4c
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHs4:JUEtQevvqc2W1cpV2EI32s4
TLSH
T1CA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 99d644909ce4dce7ea2dc073aadd04778cfb44fa9c749a1b8710f2c1215915c6
MD5 2f14e4ed9b3df12d44cbb0a77bbf288b
SHA1 9a04abd11dfbb83a913f09d0a0426e352547fe5f
SHA512 218ba15cc22b63b846d79b0c972b91be1983ef53067c5697847199221cc04e5af9bf4abda73771dd7d37758ce0ba607583f11e243ee04b429b5dbbd66e5f3056
SSDEEP 49152:JCbRquA/m2yL5zTfFiV+XenmE3/zIhxSMmT8oWgBCaX:GoquVjnmN+M4FHX
TLSH
T1B1D58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5a820223a2720df0ce252a594674a50384bc6dd2688646d7b0990cf1649904e0
MD5 1a488248f82d11cc61fbf75b92842c59
SHA1 8c78e6eefb6037b3ac90900505ac0168fa37c9ad
SHA512 c8d5b572ddf90231a5dd7e5dac522db088ef92db932bd5bef50419a83a1079b460ce19f371e27a28b367fc51fee8b5660775a0a54b403e47eb9d11a934bce5bf
SSDEEP 24576:MAhGLJIFoiwtA5l7S536rKhxr+EHNmT8oW4ll1JCrLKXI:MAMyFoiq59hxSMmT8oWgBCaX
TLSH
T1CF35AE80EBF955D4F5B3AA7899B68171EA76BCA95E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 154a09f8433c9df0d96b875917089ad84cbe3f07547fce1ea4e310544143e1a6
MD5 962c9eeac94badc346d07452ef1dbe9e
SHA1 fff4f91962807edb2c56352b2d4f142c3267b3cb
SHA512 bce1f0b824aabb67d05e644b96cb3369a60c5506bfdcfe46f8efa613c3775a8f8b1bc0c667a8c1323f5d807772a7398fd89724dc87b6bceda65b8de7b7eaeb6f
SSDEEP 24576:VwuSOWFrKhxr+EHNmT8oW4ll1JCrLKXI:Vw9OxhxSMmT8oWgBCaX
TLSH
T18585F14677A91CF9E9678238C557C136F7F2BC052621DB2F0770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 461d399cb01beea85a9e52522c9b378f11707805b2fa84ba33dc7c2456ada4c8
MD5 e2f49664a2f0db83f718cacd23381cfa
SHA1 8dfc306f9d44ea5f56ec8052d8f56df41bc4958e
SHA512 9299c7165beea47b0ad18c297204dafa08f023aabad0c46b8f76cd7ceebd7e266e6f8e37f1e4a8a0736ad8299016effd1670247a231015f58bb589d84a551739
SSDEEP 12288:FjZ1IyPJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CXD:xZukrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T14D75126A279860FAE967823CDCF14605D7B23899633143DF1A3547A92F33EC65D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 932fb682e2629c1aea3a63f220a7816a8030e4365c76f0d41fe20bd3e45eaf6a
MD5 f035456f4a652d9745fad4b4fb7841d9
SHA1 ac56df84d10c99e36e099b120aea210d261703c2
SHA512 ded3953fac53fc05577786ee57d9838125090f21c9def24e9f6bb548d3871ad91e92ad3346cc48e856f7c8bde48a7ba708c511e018f3be9863279afb7d6b04c5
SSDEEP 98304:XQRQyi36YOcPQLvw2gAf+PN3C+M4FHXX:GQyiKayX+PNi4
TLSH
T104667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a381ca0662ada971648e2e81634e29c26a80e429480c88a2615ec862f3148c66
MD5 1aaf175f0ab10b7fa6fd37895155bad2
SHA1 f484b127dee45779a0b2d300937fd57da44ea1ad
SHA512 abc4d5f27f5411303fed5dc54f868785c79b8ffe6ccdd12ee0b5c8117ce995d26fc3511fa1af4823baab233fe3a4914f99bdcb2f73f282e036b8dd1a0abf5e26
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:+QRQyi36YOcPQLvw2gAf+PN3C+M4FHX
TLSH
T12E667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b8456f0f5cd4920cce9b9b3aca6b467573b4f0363624a4cf96f439a4b988ec9d
MD5 ba5984a11582cd1c3f513d8a35b765bc
SHA1 781a28e988333e72a5dffdea2db491302805f6f3
SHA512 8c102bb26ae564b1820ae92013239bcebcf1c06eded86304c0522f97e1ae1bce5ed8046750c83b9ddf8542beddb7adacf0e93bd7ca5ab2f89b1d3efc4f2d425f
SSDEEP 49152:168Qg55nhheWu7PNU3/4hxSMmT8oWgBCaX:DthWRc/4+M4FHX
TLSH
T191B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0247db0447d0f135688b6c9e0b48f72f6115263bc34e217d73bf52406d2b71c1
MD5 e6b2ae88208ec1e3b8b38f3464872a69
SHA1 9d939b19ffe3b4145ff9ad2e7494436fc5c4aaff
SHA512 88da940a85a2c2002004d38d292e9cc4ffcb39c6058115236e4c8dc7531eecfc1255501a66b24b5f02833b95863dd8cfc71e65bfe4b7f0a8080265bab035dbc6
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99N:Ay5112gYy5azzVvL69nLKnhZL+M4FHX
TLSH
T14F167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5173808a3bfc23e986fdfc4e34a14e60f3107aa720ed5c9c5ae923ea3c0189fc
MD5 52bde55b2f37c5dfd6bde45fe3ae3e0b
SHA1 a3c636bf575f3c68694306ea5256d75486cef434
SHA512 061442195d50cf677c2578d0c04eb1a28dd6cc469ba1e91129c18ee1b18dc82c8d12d6507d6c3a005fa7cc29b98796afed8be4ca957dcbe6c1fbeac302e8dedd
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6hxSMmT8oWgBCaX:gu6JmVxd2d6+M4FHX
TLSH
T1A1D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8df86ad581cd1247ff1757ca22ff9546569d0796eb6d97d1d9174028cbb1a8ab
MD5 0448592045c4a5ba7e21350d1e777636
SHA1 0181859096815c6b50cb181a2faa63bcbb8457c9
SHA512 d9cefe48bb84fb6cc466057c5b95cfb05ae01b8f525b560f29e1cc655985b1cc22c53f18eb51cd2d68477114e339ac0579c1d1438f8f62f3d7a620e91acba48b
SSDEEP 49152:z1hpsNoJpF1A6UU44CwH7R4x+hxSMmT8oWgBCaX:zmifPbRN+M4FHX
TLSH
T111B5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bf5ea50d4f779459a08fea4f6c553baea41de4bf5a296b823396b322c59d8eb5
MD5 0fcdd4b9f36c4051d41565bb27ba701d
SHA1 0ff9defb944f9ef6f95fb35c369d712c4fc22284
SHA512 94361f85b5098f309fa41c7049382879faac4ec5876aa1076c72cd7495a301557d0ee6e46c096c9713c1439f0e7d43dcb75b60bb540d127afa07ad5c84d5e4f2
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqXhxSMmT8oWgBCaX:w5dKTi61X+M4FHX
TLSH
T118C5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d4f6ae0ca9c51e322643b2e8665b15004f4761b02d785cdae8b058a526757c3c
MD5 e5fcd9bf47759d6bb07c155d241d7567
SHA1 77a949816c14d1689b7298fa40a30c631765d380
SHA512 859d75dbdbdba24479e5fde432d1aee6bf9ba0347ce50ce94a5a53c57d96d9453afeb9e075775683a59c6e67ec7797e9789036606eb40b27637904a6b5b919cc
SSDEEP 49152:zhtSn8EApI0figngiDn0AP5wqhxSMmT8oWgBCaX:yX2iyphR+M4FHX
TLSH
T1A095BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 429bee81bf1db4eb63fea93c8ccb02002e46c4fc4acba38337888d00fc1d7bfb
MD5 c2f2ef3b82393b40e01883aeb868ab72
SHA1 9950a5b819195bbb39cdebaf8bacda0ba1f8f821
SHA512 c495bfcc00f2959eaa866653d5babdfdf2da030d540dfb6a8787569090eb129fb51c111fc2e613de01379b47dc80e3b5521628d7ae91c51b726c97b6d1b1e6a4
SSDEEP 12288:6EJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:6wrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CF652375AF0F94EBED2AC335E8624716D9DC0DDDF202163BAF3E2E683A31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b694670cd2f6d8bc48e9c14ae75172709fdfb86c1e565ec6fa99bb9150ced1ca
MD5 a4a023a8e57bedb14e886d934002b6dc
SHA1 39261efff0d4383b939a6f0732dcf0dc08514b8e
SHA512 c46bcd9f408ffdf9a32528e344fa332378d226ff23b436dea0428f94a21b04e8a197eb1f49b6c04188beb093159abcd62f40069d7bd2e39c65ccdde2999d9b70
SSDEEP 12288:qLJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CXD:qtrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DD652375AF0F54EBED2AC335E8620716D99C0DDDF202163FAF3E2E683A31C5A1552621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 73d47906e93f9b2883a14d82ff15ecdfe5ebcc58a14ee7c1765ef70a4e1d1608
MD5 8ad2d30b5b73c958c68a1285c0871a6f
SHA1 783b3b8765005947ee44978ca1e569ecf86a5802
SHA512 11cdfc493c2f02f2edf4422b9e9eec442c820bcc684014ee8040ec58f276b420051817f547247443c24eb1c7c8a7d8ef1ac6445dde3161803d4f6029619a85a7
SSDEEP 12288:nBJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CXD:n3rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1BC652375AF0F94DBED2AC335E8620716D99C0DDDF242263BAF3E2E683A31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 bd89aae644ec9d540244d4c91b34091fd1d30f77f5d68498764538e13ecb556e
MD5 51c6b70e51ba8c7e7eaa9ff91176d78b
SHA1 194e817c1ee076d4e7d50751e6075c8da49a6f0a
SHA512 10c2f88023863792f7f7c82ab00ff75aa8ab8d4d0edaf6be7827e1873de7b0b941b84a82b87802656328b6f249b09399911be9bb7f1aac4e6c47098fda55ea4f
SSDEEP 12288:pVqJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:urKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1086523656B0E50DBEC36C338D8724612D6F93CDCE322277F9F251E682E31A996931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 a50c62b5d88e5cea357a793f132c87be37b54a549e996cd6773277f6f04e1010
MD5 a49bf437d6a0335798e21dc604cc9fd4
SHA1 73e9e3b26723a5718a5cf7a3b1ad022f88991b28
SHA512 e00960aa18eaef95a58e597ace891555a7c3cd43a7d5ccee91de6d687d92c77bee3a30be5a6381ca0638a8be98983662f38594e6919b2ddd6818588255942fc5
SSDEEP 12288:XSJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:XCrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T109652375AF0F94DBED2AC335E8620716D99C0DDDF202263FAF3E2E683A31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 b7d86b7ac5ce061d12bc1a85cd3ace47b41f0e2a0fe3e62f5447c097f47a9242
MD5 c9c526b21ea449cc03b4dedde7198e60
SHA1 9e23cde0ad13a1662a6f8f3722347acc83114feb
SHA512 be830dcc8b26ace5a09322b3d6bc9027dbbe2aa131b8b6683ee0fd7e6d9152533540b1612f69b928ea3a6a71027bdbfcd4ea24a57a0847098c9f390c2e3b1c38
SSDEEP 12288:JXJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:JZrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1BD652375AF0F54EBED2AC335E8620716D99C0DDDF201163FAF3E2E683A31C5A1552621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 54534f2b13fc48b9df30b964266d56f40904a2d01b695da65ef2c1f70685f764
MD5 f8ec213e7954004d2190d3561852fe5b
SHA1 047bbd24a4b8c5c9ab64c23ba6779d9584cac4f3
SHA512 d96e669ec8a2df120fa7420d164ca414b17182b269fb76b29efb14653d95f061f0393f93fb54cd8eb6b02770b328fd408a1ad1ceaa1179f96406383a28e7e1fb
SSDEEP 12288:TTJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:T1rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T124652375AF0F54ABED2AC335E9624715999C0DDDF202263FAF3E2E683B31C1A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 ed18bbca46b0a4e64c37d000494da279dc560ec8d44e521def91679a08460c74
MD5 1858328a97de1f08a46ae50e752ca488
SHA1 aefc63f17d8adb3b1b5c4411cc27a095ccdef823
SHA512 6582dedaa22ab6df3c9867a1ec86aa2d7a4f07020aed5a23347b44c3af5833c9535ee76a158450da97e857a808d03eb3383e75be2d82bc2b923ae6e1f73e51ea
SSDEEP 24576:oZMEzFVSONrKhxr+EHNmT8oW4ll1JCrLKXI:oZMEzfQhxSMmT8oWgBCaX
TLSH
T1B38502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 178e997071a042d537c871ec01ca1509d1aa022b13fd17bff7762755884b61ce
MD5 26ccf591c8e8d2a98dafa898c5002f9f
SHA1 c3ff3ac538bff11a95ec4af02b072c88a38b82a4
SHA512 f4c62453e3437ffe781db10f2b35b7860829ad52defd67e556611b0770af133a7daae61a76a7d9e9aba8f0764e0c450f0eaf473d8d3a3ad70bcc7994e5203d51
SSDEEP 12288:XYJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:X0rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1EA652375AF0F54DBED2A8339E9620716D99C0DDDF242263BAF3E2E683A31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 0324e22a8c1996bed6c07bb5b79f5369eb1df2334500c610d35eb84aa062528a
MD5 4e9db0d5f18809ff7d818e284464f3ca
SHA1 116bc00c051bdcf39b87cc8a0f42efc51001ce93
SHA512 fbdab14581e1c67dc912931b6f2db5c68e6a266f478d2e055ef1a9f5c1921b27a338b205b19bf88d35fdf24f7a26ec510b7962cf8edfac3f9013b25785ccda9c
SSDEEP 12288:ecJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:eIrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1FA652375AF0F54DBED2AC335E9624716D99C0DDDF202263BAF3E2E683B31C1A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 d3f548f5a0ec7c5a2440fe5cc414bb831273b15f17c9afa409e358e1f0b84b26
MD5 a0a4b65a1b2855d3c643a6c4bc7dadbe
SHA1 2896b44908ff5b9a6aae2406fff08ba40005b731
SHA512 964409b42c5f50e6e8b7fec441cf8129ba7c717c153b5e1954608f6afa7a9f6748efc3cd30345b053401d4b0f57e9111b86c9c2f649ed46501ebe1f96d2b3e6a
SSDEEP 12288:eyPz5L8PJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:DzyxrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T117751217779630F9D5378238C8621A02F7B57C7953209BAF5B640B7A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 29a0346d090171bb2dd117853117c25f486e6e718e11227bd61f204552419b3e
MD5 3be625e8e3899c123623969133ecc624
SHA1 1dd9cc1b06bb185fea9968ff3e060d6ee7e3ae40
SHA512 7129ef1337c1fd127517d5b6741918a4fc9a4ca4a2aae19648bfe43b536178c5a5a28290c1c47ca9b492d031329880752de82047ede42304ac4b1b90b404577d
SSDEEP 12288:nYJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:n0rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T176652375AF0F54DBED2A8339E9620716D9DC0DDDF202263BEF3E2E683A31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 b49727439e789d4011c00c5d4f101496c55786079e6eec270ca1ee1f7c48ca5b
MD5 9ed0ea4704051eb31bf0db43a444a36c
SHA1 b8d18f5da5b0eb9e3af1e7460ce261fbadb00d7b
SHA512 f86508ef35bbe2572b8be7d5ad15f113afb2978791dd01e40531d599310e7032aff8a4823f2be6dd9ccda707500b89081e3e1a1a272f045d40579c3639d1d27d
SSDEEP 12288:4YJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:40rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1FF652375AF0F54DBED2A8339E9620716D99C0DDDF242263BEF3E2E683B31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 98991b23379cda3b156a27f834644c3529895facaa2217cab7a34a6d0398bade
MD5 6bfc92f804a56bbff5d69d7adff52155
SHA1 727c0ad216dbbf805ddac293460c4ef095f2780f
SHA512 9965134907993c1901edc1c67d9ce0aecd5b12e26e45387d09994f67c14ee56bce9a45f32ab80d0d9e17cb9f7a01c047dbe41843b54fc712d115acb6f7febfe1
SSDEEP 12288:0yPz5L8PJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:tzyxrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T15C751217779630F9D5378238C8621A02F7B57C7953209BAF5B640B7A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 d63e54720de7da743a229d15f61bcf0463a8495cd5978e6709d43f3aacd71d5b
MD5 72ccb44f598b83cc6033d00d425c7a92
SHA1 9871b6ec00307e033df643f6e5f1c9bfd0dd3d5f
SHA512 fa951a8b66850c0ef37657a17593cef4494a2ca62de6ac86b249acb5a28c2e48d6c3691f491abad5c9cec59a7528214ff4081829d15d115ae91c39670a06ff37
SSDEEP 24576:vTdaLl3z0zDnrKhxr+EHNmT8oW4ll1JCrLKXI:vTwLlj5hxSMmT8oWgBCaX
TLSH
T1978502A5B35018F9EC67823ECC628916D6F27C5A4760C61F07B8366A5F333A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 0611f36ca719a2b263d567401e1483ae9b044f52784de36627615b0d1ba7a86d
MD5 a8d0e89a6e44fe9e222d56733e0fdcf6
SHA1 10177ad133334d2ea54fdafd6f786148985e3a07
SHA512 d9a4430d1ecc89d56acdceb7ebcb10ff353dfef064ae9ea5a8f5da9c11aec419d8087fb51805dfd88978a4551f61b5b3758b9f8a5704ff4a157e9e2f5326170c
SSDEEP 24576:FcP4mcvIjkGOxhKP2l71SNKbrh/8KB8rKhxr+EHNmT8oW4ll1JCrLKXI:KP4m4IpOO67N8KphxSMmT8oWgBCaX
TLSH
T11565AE2DABDC0096D0BA913885658A4AFAB1742E1F3286CB1160937C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 8c0d8560ffb098c0985a8e0eb078cc1fa8e13fb56d3f7fe0d9dbb0a09341f116
MD5 0a6b0cf189fb46643c22db8b1aab2d66
SHA1 783601d78a356edc511e6b7c8337f703bac78852
SHA512 d78869470a3f7dba65b8c85b36af32da40a02fac551615aa2dafa31d93574c5acd7a9e72ee7f3ba00f6cd13b16bc02c0f9eb778b1991e63bda9a2ac3d2642a83
SSDEEP 12288:2zsfoJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:hkrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T11B75F11AD24801E9C46E9239CB524A01F7773C6993E193CB5BE0FA3D1F36A945DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ac6ea0a40f0f02866a71e844f6b542995abf7022c1b65191acc8ae2dd504a3d9
MD5 596b78ca8746e0eb90df63b9866b8023
SHA1 1e2c12bafcc211a467aa90fe59802b9b3b58f120
SHA512 881b252f69ad01d23156b63b03db0161e6c3b51dea7180be2db07a31915cbd0056871c4615b3b902014a869904b5968b3ea883de011550e558d9055e85a598dc
SSDEEP 12288:NIJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:NErKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T12A6523769B0E949BFD3A8334E8228335695D2DACE301556FFF2E2B6C3930C565D62312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 57b9d70acd8f4e40820e86ba5814fd68c0e20004c502d0af7bb78496b6294944
MD5 17f49392e82fee77e0895237e2014200
SHA1 0287bbc6f3021ac05553a22f392e2f48fc7423fa
SHA512 de7b8bebb4e9024754513edea3907e45af0449436bcee3df016fd5f36332fd44f3cbd5129f952ffcb4e5de29112beb2d04d8ced4c5817fcafc11c81d05bd55a1
SSDEEP 49152:Pa0h2GEkuAe73q3pp46zwwQ1hxSMmT8oWgBCaX:Pa0hNYG4Jww+M4FHX
TLSH
T16485AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 8eb82adca16960203927a36dff548fa4428e642d6f5c9ec52a8db1b9248fb812
MD5 c9c954d8121e1a4bcf06af79d2bbc038
SHA1 fc69659850b8405912bb59ac5c252878c4f1e9af
SHA512 cd135cba4152c2cb4b51eeb1a1a2ca6ea6124fa3ecb34e635d982b31384861cecba0e8c5e9dc5844946222dd4951973eaa405b938628a012aa153ec3e73d3065
SSDEEP 24576:0hbHjPdrKhxr+EHNmT8oW4ll1JCrLKXI:0hbHjchxSMmT8oWgBCaX
TLSH
T1C475017E2B9D20DAE932D23CD9528606C771BC69131163EF27A682791F37DE81C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 93697fafb322cf890d8f129cc50d8641594c64b321e4e2b82d24ec679b7b7b11
MD5 f4797e2096a5561a04be1becf1b1b2a7
SHA1 58edfe4718485d25bfaa9a92886f914dd12883d0
SHA512 7a7e59714f2ff961e2fde9a02b2ca112b6985266d85173fe68d604bcebf8942b07154292438f14fcb304cadbf7d4fdf69f9daddb84f4ffda2c9ffece2ac2d519
SSDEEP 24576:a3YgnJcRTk4yti+R5dpR/FrKhxr+EHNmT8oW4ll1JCrLKXI:aIgnaTk46ppR/MhxSMmT8oWgBCaX
TLSH
T14945BF2DF3B910B9D8AAD236850147B5FB71782D1F209ACB0170C538AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 76eeb3d5e1b2f2f0b221dcba634be73895a24aaea933fbdf247d8668dc4a04fd
MD5 7271e524a47526e5bbf405962905a563
SHA1 1559e37f6c6c35d95e67033583b86d2616709b02
SHA512 43607637496769410c9d4dd5ee9f786d0c8c0d4f874c9e79e34b504db515deb6e58897299364a6dcdd8cae5b3c2ec034f156d35e9f62f371514f5b71507479d9
SSDEEP 12288:WMJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:WYrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DB6523759B0E649BDD3AC339E863471599880D9CE30217FBAE3E2E683B35CDB1572211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e2b21091833051c529552208bed2d4b71b23b463c5bc133018b94dcf16e8c484
MD5 b42e1282dc0ccc8cb9027863c2fb9345
SHA1 11fb9bfb3a4eca17f20a82796612b95f6fd9d5d9
SHA512 a8eebfd81d42e17988bb97bf7424b71467a7081f9e4229a54411eb96ffc5032f90f7cd1780281607f9bc2a512e60dd3c85984d577ea9688e059a5cf59ab7ae1b
SSDEEP 24576:IfL3UT7rKhxr+EHNmT8oW4ll1JCrLKXI:IfL3UehxSMmT8oWgBCaX
TLSH
T17495F155E79500F9ED7BC23CC9628A16E6B2789D0360E7EF07684B651F236E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b801583b50b01eaad2dacfd8f46202e813064454a13cc34330cd875b6f2ed1d8
MD5 624255bc5e3e8cad02f3de4d5d5ff364
SHA1 de31b1f67b724ee2116f14988f6e404b37def096
SHA512 aec3c53de810c6d0e215162edbe29cc615a59cb0fb308c5128b2de8f0d6778395eb7fa21b07b2808738f8ade002e651ebdf4e3370d290554344f5b315cedda83
SSDEEP 12288:upFtfOpJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:+O/rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T123750229379D10E9E93A923CC9934309D7B17CA9531217EF46A085BD1F73EE86C3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d0f8425efb4f775c4f7954a500f8f65a8d8c668435cf8fec2c1e85902e68651c
MD5 097dbf14f24c914db86064dc98679c8e
SHA1 7e2cf48fea6bdf9501fbe76d8fe2e84436d23c1b
SHA512 0fd7b41aad35b2eeb0e0d7fe876b372cee95ab4fd662d69497a0b75b065818b34022001274df084eeee127cdceb80eb102649dc0a019160706ee53fc234f6680
SSDEEP 24576:L7NM9YmZqmWMUkPjZM48Mv6bEhs0rKhxr+EHNmT8oW4ll1JCrLKXI:L7cBWMpPjN8DbEhEhxSMmT8oWgBCaX
TLSH
T1BE659E2E6BAC81E5D477D13DC9A28206F6B1B4651B318ACF1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 eed1853f3ba8f9fcd35f821e5316bcd9bd1b48c3e0d6c55bea703a3819367815
MD5 a454cabbec088efd7a18d3be2cb3777d
SHA1 6af12f3dbfb492282a4ed84340e4cd980c1b0c39
SHA512 74e91f41c42d6a6fea14eeb76b3a8f50d41f962a131c24b5518d5280392805d96f5af8bf14d455d9dc6c92d8a4ab06a1a42ad1f5ac5284918f3b527c4e132d5b
SSDEEP 49152:7F2YuHNETovcvNYf8kmnhxSMmT8oWgBCaX:a6tCf8k++M4FHX
TLSH
T106858E2927ED80A4E0BBD27D85B7D246FAB2B8551B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b217bfc4bcf1a16dfe1c9b9031c31da09645b7a833c04eb3022bdb45d53c81e4
MD5 e92c84b201dcc69d1f66d82d2d5497fd
SHA1 961db0335db7a12ff877ab6b918e52c774cf72c3
SHA512 a38aeee3ed2d121f03556e730f6c4141694b37b47f167bc283a8480cc863e417b979412761689b80388c8f5e9e111267b918aada9a806852c5dd66a920a708b5
SSDEEP 24576:AAFs06+Omlf3NXEbToTrKhxr+EHNmT8oW4ll1JCrLKXI:VFs060lVXuVhxSMmT8oWgBCaX
TLSH
T15765AF3F66AC00D5D07ED17D8997C91AF6B1746703216ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 643f6f6edc88813943a54d23d4ee90d559469e203984914142567f232114f93e
MD5 cc65e65b8a3666a6cdb73e318d7311b7
SHA1 653b8c9c13a878a053670c2abbf0c2bf79affc51
SHA512 d3f5e57f4e9f66d0c17ad5baba582e5b74d1a20f44219b1501f9805074e78fec86edd7beb3c4f933dc593ca1c68e93c7566b9b9a41eb784d2abff92de2179c3d
SSDEEP 24576:2JnJ5D3WLirKhxr+EHNmT8oW4ll1JCrLKXI:2JnJ5DGLVhxSMmT8oWgBCaX
TLSH
T16385D03DD2A810E8D4B7C374815A1B56FE72387D2B226ACB28B4D5353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2e0b1a79a08738cef85de9ad10105d690db7aea9ec2ad391a735c920f9cd6463
MD5 797f8a9ac1c816c2eb47e25c8b08600f
SHA1 ed95e07ea1a5af60d3eecacda02a0b7561697048
SHA512 332c7cf496825fa0ed8c8c80bdb569133e8ba7dd926018f97967f6ed04d39a9465cb23ea6aa74609658389898fc11b0fc542278c7f967a3db019ed60598d7c67
SSDEEP 49152:bo06DIKdwc+eQnSt65aVDhxSMmT8oWgBCaX:0B+M4FHX
TLSH
T165956C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 d486fc161988b23a2f225d7b1ff1e5f9a96463e3a97b9765576474d455034b8e
MD5 2b49114aa710e0294481c94e9d315264
SHA1 04145eb0e6268e66cd65b4bae7341a5e95a84f0e
SHA512 d808371d9eb437d183a096f5ea8bed2cbf6a32c0251500e39ac06895f312a8edc8f25213fb963a6e84985fac69b01eb8e7d4b56253c99bbb67677ffe863aba12
SSDEEP 12288:tEP3RB2JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:OB2rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T18B75126D2B5D70EAD92A913CD4A18205D3B2F4B8631227FF5AA5823D4F33DE91D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 762f20620cc53513c31a79a55968bb0d7fd620232e7121ac166d30ad653602df
MD5 46b015a1d4b2e5b5993e29620077f15c
SHA1 70415a5dc53a57b0c6373bfe6cee2cc9e8d34059
SHA512 b62f7a547a1df8f47c637ebdaa9147a6e79df14745b78ca2ffd85964c50a5f16a23dcb97b26724c57895d07b3d32e3bf32f6cf759fa9941275cf914d9a1112b5
SSDEEP 12288:mjkyLJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:mIytrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T16C751214638860D9ED7A4238D97342619E747C24AB1157EFA9A0FB3D6F32ED46C31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 b606db94391732817748fd90b02a56778c6fec1e5057d2726394a559c19cc359
MD5 f0b5439e8208e08525fae99607bf8d72
SHA1 7739e81f0ec90be5be9fdd3fccc6f7ee60c88ba7
SHA512 203fda45ba90bbe0a7ba594e45020fc2234c7593082c43ba3d9871d49f95ab1fa03b063ef2ff17f4192a29892c7ba6e36bb0b29fbb6b6435f182199223f2a271
SSDEEP 12288:LrZJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:nPrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19265237C5B0E74DFED268338D932471195A82DBCA30129FF5EB9AA786F31CD61172A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2eacaa0986978dc945298143b1ccf3a027c53b5e99a1b80d6d8adb2e1a0018c9
MD5 0509dd8f3c42085f050756c0a9cdbf68
SHA1 e86e0e78dd2b954cf5d9df71741034176fe89a38
SHA512 0e8e28fd5347671862a98183bd35898f9b65e8e4cc5997f29ff40f3280ab261a592e6c3cf4998e3ef264c43c9f74ef2f57fde2abdb7ae6a15b33f52d1e896006
SSDEEP 24576:LQ9MxZKdcz97w3srKhxr+EHNmT8oW4ll1JCrLKXI:LVKXfhxSMmT8oWgBCaX
TLSH
T129558C2DABE9059AE177D239D5A250C3A673B4301B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 206411ec52f406d375fa2aa2ab259ed13042b5f12c9916a29e9caa24991ff4f2
MD5 e741e0e4cd627ee5557a938b168df3ea
SHA1 9f3255ca0734c59e65c7497dfa7558c1ca8401c4
SHA512 e35b3fb1b2cd91467afd04e04d5604a1b75129a6848b2b857161526527350103f875006e253d07941227934f578d7687915c676f1fd9baa268af8335a867f95a
SSDEEP 24576:/yocbAphrKhxr+EHNmT8oW4ll1JCrLKXI:6ocbApohxSMmT8oWgBCaX
TLSH
T19285EF1FBB6E40A2E136823CC9818305E7B3B4745B6267DB6691C73D4E239E9BD34B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e8631c8ce6347fb1438009f56accee85a9c65f67ecbaff9d93b333abc829b995
MD5 4b9e435c5ac5a054b66d1abc67052172
SHA1 90cd968719d8cb4ec6ffc73a74fb66c1da5b0f8d
SHA512 70574b0dd0e74144d17b98bc3ec235d8bd25e8a29e00dc74826d3db17501ea787715eacaf25b74c9b44e8f859a2ff97980bae72b72d0983918491ab80cdb8705
SSDEEP 49152:IWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKohxSMmT8oWgBCaX:q0zuNI8+M4FHX
TLSH
T1AFA57B3DA2BC00A9D8AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9d37b90805032aa92b15315ccf2c7b421f263ced58af26e794db3f697862b142
MD5 017346ed7fbd7987d8605f486c960192
SHA1 2aafbbe6215f0eebb81822f2898cee33d15d97fa
SHA512 41c73f416b0d11b3e9644bacf41f20899d86c2df74f7dec882d1638019753d4ce8d741b2cbb93cd3933e637aa2fb8888eeb9a0c019f015aeb2ee963061e2eb87
SSDEEP 24576:C1QT7EcpfxR+N5AWAz3ooiYtjMqb2rKhxr+EHNmT8oW4ll1JCrLKXI:fTDxR+N5YzTfjMehxSMmT8oWgBCaX
TLSH
T18A55B02EA7F915E9D17EC5789A23C512FA727821033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 dde2a9f5064d19aea61109bcf447a38feaaba3a3bacf35064a0c07d766d769a0
MD5 8e6f1f1416ee1e60886e5d309ffa7d7a
SHA1 cb5bdac25d38a52bbed9ef177c8b666bca31aa4b
SHA512 b7df754e74cb07e1c69c3f1ef02ce6cf2e3177584d9d6bdbc4243da3f081a8a2cea2090e9ea66eecc4427e4949185c760c728a70e1f80ed9352eacf2c5213637
SSDEEP 24576:nTMdOz0FFS+kmSLarKhxr+EHNmT8oW4ll1JCrLKXI:V0K+kmSLNhxSMmT8oWgBCaX
TLSH
T13D85F17EA76D14E5E47BC23CDA538906E6723865032276DB06A0C17D3F67EE4393AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 34217907ecf3c7536a00e4e410a40d1516581c01147834144c46205630d655f6
MD5 ad5e12d6411181abdb575af5cd96641c
SHA1 ba98d32fa1acc8fbbdb7a5cc5f1034ea32e1c599
SHA512 99e266e773dc22ff5ab77d39f006f6d610db2df403478ba53020450e2feee36c0ff7f60e620030328d2c6ce01da164aeefd4903f55c0b2b2fea6629e0f22c64f
SSDEEP 12288:J4plJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:O7rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T18375122D67DC30D9F8368238DA32021686707C7963112AFF3AE5CA7D5F329D99935B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/344-190-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/344-196-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/344-199-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/344-201-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/368-518-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/368-402-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/368-138-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/368-520-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/368-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/680-45-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/680-90-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/680-88-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/680-51-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1360-213-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1360-219-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1360-412-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1704-29-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1704-363-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/1704-23-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1704-521-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/1764-203-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1764-209-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1764-411-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2072-149-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2072-155-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2072-403-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2340-223-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/2340-229-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/2340-422-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2476-71-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2476-376-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2476-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2532-409-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/2532-170-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/2532-176-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/2684-364-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2684-92-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2684-98-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3164-536-0x0000017F3A670000-0x0000017F3A680000-memory.dmp

Download

memory/3164-529-0x0000017F3A670000-0x0000017F3A680000-memory.dmp

Download

memory/3164-528-0x0000017F3A670000-0x0000017F3A680000-memory.dmp

Download

memory/3164-534-0x0000017F3A670000-0x0000017F3A680000-memory.dmp

Download

memory/3164-533-0x0000017F3A670000-0x0000017F3A680000-memory.dmp

Download

memory/3164-527-0x0000017F3A670000-0x0000017F3A680000-memory.dmp

Download

memory/3164-530-0x0000017F3A670000-0x0000017F3A680000-memory.dmp

Download

memory/3164-532-0x0000017F3A670000-0x0000017F3A680000-memory.dmp

Download

memory/3164-531-0x0000017F3A670000-0x0000017F3A680000-memory.dmp

Download

memory/3164-535-0x0000017F3A670000-0x0000017F3A680000-memory.dmp

Download

memory/3596-378-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3672-41-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3672-35-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3672-432-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4132-9-0x0000000140000000-0x0000000140389000-memory.dmp

Download

memory/4132-365-0x00000000028D0000-0x0000000002930000-memory.dmp

Download

memory/4132-10-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/4132-13-0x0000000002BA0000-0x0000000002C23000-memory.dmp

Download

memory/4132-384-0x00000000028D0000-0x0000000002930000-memory.dmp

Download

memory/4132-392-0x00000000028D0000-0x0000000002930000-memory.dmp

Download

memory/4132-399-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/4132-400-0x0000000002BA0000-0x0000000002C23000-memory.dmp

Download

memory/4132-401-0x0000000140000000-0x0000000140389000-memory.dmp

Download

memory/4132-20-0x0000000002BA0000-0x0000000002C23000-memory.dmp

Download

memory/4132-8-0x0000000002610000-0x000000000276C000-memory.dmp

Download

memory/4132-0-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/4324-81-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4324-87-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4324-85-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4324-75-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4916-159-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4916-408-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4916-165-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5132-424-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5132-258-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/5132-250-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5132-293-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/5132-274-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/5132-525-0x000000000D730000-0x000000000D738000-memory.dmp

Download

memory/5132-522-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5136-423-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/5136-239-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/5136-233-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/5180-410-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/5180-186-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6064-134-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/6064-128-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/6064-379-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/6072-55-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6072-61-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6072-375-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6080-103-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/6080-109-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/6080-374-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/6100-119-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/6100-113-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/6100-377-0x0000000140000000-0x000000014018B000-memory.dmp

Download