ae731ca383823c596641c1263a000ad23541b636ae2e1d3612999ddbfa9fbf02

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 19:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_648f29ad0fed30045e92b3cab7669166_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 2.9MB
Sample261012-yqs94aew21
SHA256 ae731ca383823c596641c1263a000ad23541b636ae2e1d3612999ddbfa9fbf02
MD5 648f29ad0fed30045e92b3cab7669166
SHA1 080d2485d4b405db8c243491bae0e63916bac792
SHA512 aefceb58423aca0b26659dc650118e03726a19853fae2deed7bdf48fa746a0e33f3a2c52d0a3f3c2ca03b435db255a13de737c55bf3fd47987d6506fb4800188
SSDEEP 49152:SVaYNZm7Z8wDFfaa2KyS9Gl0mbPdZoh0qnB7g7Deldn5icp6PvCe30jaNf1TWbdz:tN/faaNCpqB7vlBkejU023W
TLSH
T1C7D5DF43F69505D8E0ABC174874A9532EAA2BC496F24BADF0790B21D2E77EE05F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
904	alg.exe
1388	DiagnosticsHub.StandardCollector.Service.exe
2128	fxssvc.exe
2552	elevation_service.exe
2276	elevation_service.exe
3408	maintenanceservice.exe
1648	msdtc.exe
1824	OSE.EXE
3484	PerceptionSimulationService.exe
5092	perfhost.exe
1072	locator.exe
4004	SensorDataService.exe
4612	snmptrap.exe
5004	spectrum.exe
1464	ssh-agent.exe
4260	TieringEngineService.exe
1952	AgentService.exe
4212	vds.exe
4584	vssvc.exe
3896	wbengine.exe
3344	WmiApSrv.exe
3116	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-11_648f29ad0fed30045e92b3cab7669166_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-11_648f29ad0fed30045e92b3cab7669166_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-11_648f29ad0fed30045e92b3cab7669166_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-11_648f29ad0fed30045e92b3cab7669166_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-11_648f29ad0fed30045e92b3cab7669166_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ec4ea086288da564.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-11_648f29ad0fed30045e92b3cab7669166_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-11_648f29ad0fed30045e92b3cab7669166_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-11_648f29ad0fed30045e92b3cab7669166_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007187017c845add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091bf597c845add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac96717c845add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003c13a7c845add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db0e497c845add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f18e0c7d845add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e215c7c845add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000740c687c845add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055706a7c845add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2ae087c845add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1388	DiagnosticsHub.StandardCollector.Service.exe
1388	DiagnosticsHub.StandardCollector.Service.exe
1388	DiagnosticsHub.StandardCollector.Service.exe
1388	DiagnosticsHub.StandardCollector.Service.exe
1388	DiagnosticsHub.StandardCollector.Service.exe
1388	DiagnosticsHub.StandardCollector.Service.exe
1388	DiagnosticsHub.StandardCollector.Service.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4620	2026-10-11_648f29ad0fed30045e92b3cab7669166_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeAuditPrivilege	2128	fxssvc.exe
Token: SeDebugPrivilege	1388	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2552	elevation_service.exe
Token: SeRestorePrivilege	4260	TieringEngineService.exe
Token: SeManageVolumePrivilege	4260	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1952	AgentService.exe
Token: SeBackupPrivilege	4584	vssvc.exe
Token: SeRestorePrivilege	4584	vssvc.exe
Token: SeAuditPrivilege	4584	vssvc.exe
Token: SeBackupPrivilege	3896	wbengine.exe
Token: SeRestorePrivilege	3896	wbengine.exe
Token: SeSecurityPrivilege	3896	wbengine.exe
Token: 33	3116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeDebugPrivilege	2552	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4956	3116	SearchIndexer.exe	129
PID 3116 wrote to memory of 1492	3116	SearchIndexer.exe	130

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-11_648f29ad0fed30045e92b3cab7669166_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_648f29ad0fed30045e92b3cab7669166_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:904

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4540

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2276

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3408

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1648

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1824

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3484

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5092

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1072

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4004

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4612

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5004

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3576

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4212

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3344

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4956
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e10ef0e78a7ea876a3c3ba75534fffbb0e052790122e181c6fde36f82f85e4f0
MD5 38e4d6debe57a9373935e8be57163ebc
SHA1 d75f243a27f42e34efc8890ccb5d695065e4d1b1
SHA512 ee501e9795566c917f33fbdd20f989e984deca6c63cae9efa640553e4792c6a78a2d699ec50797587ebd0c7612b7f247ba21ad42b85e03bc900ecc20d88ba9d0
SSDEEP 49152:Gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnAe30jaNf1TWbdz:43q6HjBJU023W
TLSH
T10FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 1d53c714d655b165fbeceebca8d6ed2f93161a97adf9462918379c7c0108b496
MD5 25e0b915acb6f24ac705527f889f7540
SHA1 5fa63811e3ced3a89294cb674818a49ab84bc9bc
SHA512 c0820a053d36c6954db7ed4ba2a83ddb5554268a721011abe26dda5cae7fa3df9e1a6578ea4ad6a67930bb2b49104db6c6ba37ebd390a22bf266954d4015433c
SSDEEP 24576:pXYfDtczACgXe4i7ojhsP5Lgrk1TWb4AN5:Mtcue30jaNf1TWbdz
TLSH
T1CB05F12877D409F9ED678278C8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 86f6365ad46228cf530fc010b629f0c34d78cee7e4afe3331023c9d5d275b835
MD5 716bde2cd392cfa4e471e7bfc3bf417f
SHA1 0a46e5f8d4089913d81addef28d4175f6c05882e
SHA512 b4f64ee55d0e694f89278739051a109e80559725cf825c0794b334110fb4b6394ea37d88db08372b44538c4605eca54d3fa35da9635ff7f6a94f5ad347fca64a
SSDEEP 24576:50Le5ji0hmxirM0gXe4i7ojhsP5Lgrk1TWb4AN5:5Pji0AcUe30jaNf1TWbdz
TLSH
T14735AE16F6748735D073C0B9C5D2A69AED72308217308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b8a2534a07654f72f7df49b9b5370d5b4d8ef6d1317bbb24280f586ede3d9636
MD5 e65c6a816819021f8984d4489a7838f9
SHA1 0a1bedc3cc68d8b1f37236645f321f8183f158a2
SHA512 932ab767b337e047a5bb447c0b36ad05cd8d4957e04da33a8ac7df049af084878c3395446e8c6f3c7fc457ab0b2bd1ad4da0ee0dd7dad3b0e7adfc45be5b83ab
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyuqgXe4i7ojhsP5Lgrk1TWb4AN5:M/ezSC6vUzPvxHjyoe30jaNf1TWbdz
TLSH
T18D756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 04394650ee22c6ae9d4d83187ae5f27cdb6794b8311985d58ac6f43e2cf4158f
MD5 a9452bef47c761947175b3fde3a4069a
SHA1 684f544893c2ba15709306cfaf112c70931f4199
SHA512 98468066e629583f80813b391ad5f5ac991ccfe2799a255077c05819e414bb5de3ae342156d0cda78f7be6c6b7d800c6d1a53cfd281728ab3f26978400775e6e
SSDEEP 24576:bVbqPb88hv/l+6rgXe4i7ojhsP5Lgrk1TWb4AN5:bVO88hXl+ve30jaNf1TWbdz
TLSH
T163559E66F5748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 6993cc946ed91539e3c7318b66d033ed74aa587be9d95a2f63ceee76324aaa3c
MD5 7d5dab7c308a48a21c757236180445a1
SHA1 72125afe9a3f79cdad7ba8d4f04e6c0e56558f47
SHA512 99cd7514ba6dda23e0c6046f2adabe62050c63d8b8217d9c6ff5f86501f43ac080b1e60fdb8d6f68a814ea7e6328d564abb1d45d9992fd77958d6b90b5ef6697
SSDEEP 12288:xRj0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xRAgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19EC423929F5409C6E38BC3F0A0F7CB91E5A11EC171444E6B47E0FA931DFC8A9DAD8069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 f74ad4162d5d0bf26061118983da53d2bb186568bf91797de4be452fd15cce6c
MD5 c806841f1634783cfda9dbd4f3bb8375
SHA1 8d6947642cfc6181b708097243cbf4d6f56cb0a6
SHA512 8873987374aac03eea9d5e1ca9f3510757d88310fb9d2b7d55d6afea06760106c55f6b2d1dc761bc83110166b227235140a0fe1c07059d6cea66aac6ef5a5491
SSDEEP 12288:reBNUbTVO86UK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rJIUDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FE05CF3BEE28ECD2C27E8DB85691C740E7B278704B5293CBD164C20E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 93b8ce80d7a801d3733e11ae55d4280e34a36e4ed440e33f0b9b1a3fe63599db
MD5 9ee8ce8dff3277c409384da417d2e667
SHA1 82c815c977c4097bd419173373f20cb2a7c915f5
SHA512 243963ef932f6673a8739b320bf8b6a6bdd1c4814e3d03c5157089c5b4927c3d1043bf5a7d3124e526451e9e34071b96f482ea3626ae366ee493e5d8d0d63edc
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:6QvGAdlCEL8c/yRNw5CdU023W
TLSH
T1F1267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 b89451c97cf3acd13f34b964b1e776231e41a9e07a9da26ce54601934e3b7324
MD5 169ff159a283fb9d52eb6a89543f2013
SHA1 3b2afedaec09265ef86bfa4aed87f7a593b46655
SHA512 9aa914741366ebe776cbc278c48385543a7e40762ce6014556acd3cca2057a3c5e07f31a1373bd4f301c5c04fec06b8bae6f9eb120cd65bdb0f37e2267794082
SSDEEP 24576:7dewsAjZgXe4i7ojhsP5Lgrk1TWb4AN5:pljke30jaNf1TWbdz
TLSH
T1EA15E031FE74E032C3BB0DB21B76C712586C7A604B511AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b4b494cc9e6cdfdd180561b16f04983fac220ec918b6394bb5b5869d6e393d14
MD5 826d3c67e976933c0b88da203353d930
SHA1 e87eb8db1fbbb379b6de715ecd7ca46446b418b2
SHA512 280e1a7d9d9446490def9537ab328a465235522653e80cdafe9292c7150eaeca068f141ff677a43a04ddb239850afbf29e03813dd0bcb0ca41e9736d2326c711
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH8p4W:6UEtQevvqc2W1cpV2EI32c4W
TLSH
T1A3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cda12afba7964d8227a49ed9550907520dfa2e8836178e5d693473dae215f20c
MD5 5630c17454e23c967a4b62f6d8969e1e
SHA1 4546ad4e221063952a395e252e24896410fb3d76
SHA512 08bb4feea506da98f2c6d1eafb7dff8b3c0909434f5ddcac05388ac3704121691fefe54a194ff906b9c7a997db6c7a6e92663925380484c6b46051c8d277f4e0
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zEe30jaNf1TWbdz:KoqtVjnmxU023W
TLSH
T1FAD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4445d5ec7c53f4a35137750e899a7fdbbab80b30ea4aa77f653b92d359e083a8
MD5 618567532d4f283e620a48bec150ee45
SHA1 f07ca84d6c3a0a56baf2156c7ddf8157f5f0be0a
SHA512 13f11110fff3bf3b215a94bc803e872c1dd5eae773a0928c69e8d1cf31c4ab264cb069cfa8a8a2ffa214d2284d00452fb2a4187424f90442b3b7abb47b76ebfd
SSDEEP 24576:TAhGLJIFoiwtA5l7S53+gXe4i7ojhsP5Lgrk1TWb4AN5:TAMyFoiq5Be30jaNf1TWbdz
TLSH
T1B4359D81EBF945D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7d71643d0ecad6cf3f3d652f1888b5213f827784e647d93015e74df2a3ea2009
MD5 84171f7221a0c961005b3396d122ae76
SHA1 6b4d79a0937fcdb5a89e1a0ca0f0c3989f216f9a
SHA512 bdafde33b02d0ee84c809d5c718bb5d519d78b4120fca81429204f4ebda36be95e9a0a15034012a474cad2de2ecc517aa02eafa9f09463f4735e93e1c0227100
SSDEEP 12288:amw5HEjsChNVBFgl0WDm+Cd0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:zwuoOWNgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BF05F14676A40CF9E5A78278C597C632F7F2BC412A21CB1F07A0C65B5F77261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 46245cb2eb30aa960a915b2d62acf4882aeb05e855c0d00f1bd1cf02c9117752
MD5 93292e4b93358c76457b7788d6f18af3
SHA1 1b017f0b56c428b45c8f5adb2f9d8495c0f6ea05
SHA512 63a7c9bab1a0b867b45ce6c7ca7e07b7321a8419d2d0849bfe23e06e3dbb20e02503cc15dbc1aa4d9715826ddfb40b5217accca65b9fa528b11ba804c573655e
SSDEEP 12288:tBZ1Iyo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LZuMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T110E4129637A421F9E2978278D4F28B41E7B23892333147CF02A096A71F76DD65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ad3d9e56d1f1670b8a65127dcf985f17b0000039c73cf487e898a6d69e35e037
MD5 00b045758253f65c14922dc67512b1ac
SHA1 29cab83a48e53f2da58a659f15caa79a97fee806
SHA512 ec0a676e0e993a4bf72bd47608c146aebf6385dd6976665aa96488ea17d0915d34568844ff547c5f4b17e799054422f2b74728005c9989712aa589a04be028ec
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:CQRQyi36YOcPQLvw2gAf+PN3OU023W
TLSH
T176667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 15e4cc91e37f893700554692f4efc55dd6a73e6729663ffe69b1c2f49ed3e4b7
MD5 a1e98336823b2d7f24a78bfaa2817934
SHA1 d71c1d494152081b8d1b9db88ccab50f850a49d1
SHA512 897daeec351cda9d1a61dce650ed5e0be96254df93532192be8e42743d874d7f5a1d77ac449d8009b9e865d99ae8e112a9cb2ec50f528a1de9f5c4f30072e23e
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:LQRQyi36YOcPQLvw2gAf+PN3OU023W
TLSH
T14A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 be012986e2ce00999b937f3696529a9a43f28eb0777d63d16853bf38c05c1d04
MD5 87f844b7651b975e6e05979bfcfe45d1
SHA1 d20450e7973776da71d7ea80680ff482ffb38bbd
SHA512 c225a949f3f15819265ac83dd2de4a461d2e491081e20aa1bb814850296bcbc098a624979926093dddb25b0a71c539a8a3458a3e14a224690365803513629cf0
SSDEEP 49152:l68Qg55nhheWu7PNU3/Ue30jaNf1TWbdz:zthWRc/UU023W
TLSH
T1BAB54933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cf4c2858eee24966e8820fe7bdee9af33c60e22c628f6567516868d45ea85ad5
MD5 2769f5b5f74105ed3043d5516539fc5c
SHA1 29db1c05b18c6c2d10e0034135970caf93fcaf0e
SHA512 f6e40238f1ec7e5cc33a7cc481810cfb7488a00123789f51b90168a6537ce5532dfbe44ffb7c65027d1e64be8d85516213fd7cbae2fa9e4a18f43f60454e1560
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99I:gy5112gYy5azzVvL69nLKnhZHU023W
TLSH
T17C168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d5df3ace24fe36ff17bcc86a69e8d9154b5aac2eba43b184fc46625c3cd3a687
MD5 d474ecf774ac134e1f63fd9e3661e977
SHA1 1f1f97b92c16ff0725034a6c99ad5d76894ba9fc
SHA512 2b185deef943a07209b3f100af65dc5daeb359d61c9b5dd036a1844813ddaac457c5c8fff7fa83d7c21fbbb962357af8c8f5d5ec444ad6be7a9b8596ab8dde0e
SSDEEP 49152:WB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glle30jaNf1TWbdz:ku6JmVxd2dlU023W
TLSH
T1FBD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 da61cfdaff48d84124f1ea92f4013170bcc07016b05bcfd4f777f443df69a43c
MD5 f127b154df2f751910b748bdf8df29ab
SHA1 08d13007bd2f6040aaf4fa539f5c3b60f16497d9
SHA512 18ce6fd1b9097dd96fc172fc445d1fe5bcb7942f667b6e8181c2d1447efef7cc8d3df9197c26429341de5c6be5d9fa202064562c916d6f636406efc6c396a94b
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4xae30jaNf1TWbdz:pmifPbRxU023W
TLSH
T17EB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9e8bc4e8963b59f314b627080579afdc901cedb8df0345a9d8e0e913336759b6
MD5 fa0075fbd1ad6ec120a4097abd16b257
SHA1 85b75903f0f7eff3187b86c70ae7b85ca41805b8
SHA512 6aade1f4c23327892255771f8d1d62a39ecaafc93838e0cb8412a506960a5123cba14691e1ae66be54bf22554bd18e75f524943e0d69e54c90e0100d18e54e2b
SSDEEP 49152:LSuZQIY0Be2KRRVtOnks6NMHqDe30jaNf1TWbdz:Z5dKTi61DU023W
TLSH
T194C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5143117cbe5102c29ddc4165e8ffb5aa9f4c81e23bd6dd0ba58a0d016b6b50e4
MD5 4748d82e0bc3d160d2b6855c7b229556
SHA1 53e35277112f484beda9fd69cee89ae07f8d6e11
SHA512 afee440a5f0f83fe8f87b2e3d03774e000f4c3aa90751dc3dea8703f5fd99b6dc6bdd8d2aec228fc9700b320e10e90d468ab5bbd61c3f34791e8ddc0c57dc0d7
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5wme30jaNf1TWbdz:zX2iyphVU023W
TLSH
T18295BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ca41781ad96946ab9f0db532bbb33e920e2418700206fb5b0b8bb6bf43ee8e67
MD5 1091f3a64cc49674f08e97f4f3e2af86
SHA1 be1a2a5e176f306de7d19d80a132adeeb007e468
SHA512 581f276691442025af638c866ae7db9a0072302224ccfe093b9722094fa118d08b0e84f2061d324061208c783483679f0882fb1e2c4ae4dec905a8df99faf4d7
SSDEEP 12288:Mb0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MYgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FEC42391AE550AC6E34BC3F0D0F7CBD1E9E11EC272414E6B53E0B5531EFCCA96A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 00d4d7d1f7150be1de53e2a2b81e9173295e3a06ea1540745a412e50499eab41
MD5 2b64028f3df5f6f2602b52c07cfe875b
SHA1 9e366b89646c3d136c47e827f80101e20204b800
SHA512 4a62f09a39713ede561e24bd7c75c056c1a5334d02125ded6eaa5a3663a37a1997ebfeaf27ef218f901d616d319fb7627ea922d5a4f2fe44b4e9009a33ae00ce
SSDEEP 12288:L00DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LVgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16AC423A1AD5509C6E34BC3F0D0E7CBD1E9A11FC272404E6B57E0F9531EFCCA96A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0d969592158323ead9c574f3fe2dd69033d9eb340b8936dee17882620e7b0f44
MD5 0af3140dc3f94f91f39f0dc7510078f1
SHA1 68b979a465880b100a252ee3136c6dcac65e14cd
SHA512 c8641c93a4239bfef460b0a74e76c3c2b18986b798c9ba4e18cac23ba6228f04707cd62733ed65d4720eaf7540880c0d3b458049940c5c421a0de9dc413d68da
SSDEEP 12288:li0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:l7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13DC423919D5509C6E34BC3F0D0E7CBD1E8E11EC272414E6B57E0F9531EFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 fdb6f0a17c6695e6701fd97da23c42900b3df48e38b7c6f50999c8beeb58a3e1
MD5 91c1306ac5651574a2b603e1166a606d
SHA1 f96120ac475f55e48f4fe7b6612c6fb03480276f
SHA512 c951cfb0d7f23b6a52572ce8e04f5a2e9744cf77b40fccff991dd2aebe83d15e0f95ee2ee854a7e700c1aa7377060aeb2613903c8dbf60516f93d306958cd2a5
SSDEEP 12288:yVR0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A6D423926F6505C6E287C3B4D0F3C791E6F13DC173114BAF47D069530EB4AE8AEA8A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 86445dd2957f76c6851648087ee668d5422501ad7758631b06e844b9b637519b
MD5 75f6afa1f3ba67fe2c757f862a2cbbe3
SHA1 a1b294facb8ea9229c4c0b275a2591cf87c8118d
SHA512 abc5622cfbbd0f036e7dfb17aba442714719302393a9c4501c61f3729270042411f0bd796c5ad571596654ae360bf3c520ceafabe4b044ae45bb48c068592315
SSDEEP 12288:W50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WmgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16DC42391AE5509C6E34BC3F0D0E7CBD1E9E11EC272404E6B57E0F5531EFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 fd0efddcc1ab134ea7ed9889f74b2d80e27eabf9cfd7f700e9e58d312a98e22a
MD5 721668070689cb1bf6ff0798653f0952
SHA1 f0478de1598628a22a5a26e36427f5211cf55330
SHA512 926a7065cf420b90477095cd44091a9c61e8d0902cd1af759dfc231958d596e629650ce2ff4005671f456b35f2b2fbf12374b486d38b0e8dbefa75f8bf3f191c
SSDEEP 12288:7Q0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7xgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C1C42391AE550AC6E34BC3F0D0E7CBD1E9A11FC272404E6B17E0F5531EFCCA96A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3f60a626b03ea135a9bc956679a9939d1df4156d7ee06a7fff320bed150b3674
MD5 bbdad30f3dbdd04a3046f57a20fc76fb
SHA1 c3447f158bbcc9d014d8bf487339e31bcd967a28
SHA512 55a5e292147aa2c232e7b32d8ecb98b1f5697f71a6509a276003649f5889ad9be51480e58791a338b04bacfab0b6fb15f21dc52604f134a59e594f862f1a5b9a
SSDEEP 12288:Dc0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DdgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B9C423A59D550AC6E34BC3F0D0E7CBD1E9A11FC272404E6B57E0F5531EFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 cc9d1597c32fbd563cc51718007b0f7b223ba8ca2f14a1138067e8dcbbcda70e
MD5 03a7a916ee4c6b0884b636656e14105e
SHA1 6a9e13c40207fd8f445039b1fae19b66fc99a9b6
SHA512 969d257bad995e768920738d7355a76b4af964708e81f1faa5ed87f8fc5caae20fcf341170feed01447c729ea489a8ff4cc11931490f6de9276fdf67ae78ab2c
SSDEEP 24576:1ZMSzFVSO1gXe4i7ojhsP5Lgrk1TWb4AN5:1ZMSzfce30jaNf1TWbdz
TLSH
T1AB050195B3500CF8ED67827EC8A68A02D6B27C561760CA1F03F436675F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 bf1dce802234746e79d6e763e710b04eaa5d729957665b33f35037f162e24a05
MD5 33149a816c85b6271153e74091702650
SHA1 41b6bac2672801bcc92e9e81cff4795001b7211f
SHA512 bd8fb8db3deec194ac37ed5f6d59e504d44bda106c5d4df15b0e9483fd1f4805d054cad242d2083041aa3207eaffad18328c9f0418675a03571c15e500e83344
SSDEEP 12288:/v0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BFC42396AD5509C6E34BC3F0D0E7CBD1E8A11FC272404E6B57E0F9531EFCCA96A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 451205652adb88b93287ffada085815d1053745cb2a912b32e9faee43490ccca
MD5 30dac0ba38b5943bdbbbb515818daf24
SHA1 c79b137e0e23fdefc1ec9a9d09c13eb7d2d69be3
SHA512 e31a6cfcee30cfca32a2db2d37c2dfcb40e95e3a107db872303e37175adbeafe03443b93a763a26cfca319ec7054c603ca1c2bfba7e156736ca959bc9b5dba33
SSDEEP 12288:nz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:nwgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14BC42396AD5509C6E34BC3F0D0E7CBD1E9A11FC272404E6B57E0F9531EFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e5e3dcdfa05b785770372c723b488ad98dd1e8d2a2ab4a5d49b34453284d7d9b
MD5 f9f16afe969669c5d29d371196116b3c
SHA1 40d995c0433a1f8fc49413508cbdfd3a2de7f276
SHA512 b7d27b0ebd599134b552f46aea69c224431273dc96be62a288a195bd11b9febaa45d4642881efb89ef016e2060f81ca9f93c0c08c6078180d07a97dcd0d74644
SSDEEP 12288:kyPz5L8o0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9zyJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T180F4025777A120E9D1678274C4E24B42F7B27C7217208EAF03A056732E776E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 f952bf5a9179faa0cbe4d94ad3cccdb72b594d77bfa2a426bf5456079d6ea8ce
MD5 c58db7f01e2d86126e8b1335db302945
SHA1 1ce28d96c4a0c30c015b4249402630756cce7719
SHA512 10e6f975eb22cdbdaefe40afe6b2a86abd2e3cdd51f47915f083a9d8ef121eadc5552d6776c6585632341f75de7752a5e982ce88339638c308305b8fb1ff6d1a
SSDEEP 12288:Jv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:J8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T179C42396AD5509C6E34BC3F0D0E7CBD1E8A11FC272404E6B57E0F9531EFCCA96A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 1f97aa0aaf448f9746a65af4d1ce2b2f1fd06914005f48df12dc01d186a6c2f1
MD5 c326f2c68f028a2c8b0d8bc51ef21384
SHA1 70376cf0dec27323826589d56ef48514bcb54e01
SHA512 0edec13272827b82d9bd6d7854fbd5421a9607e9f2f1703fc1dde42a7df3ea8241065dcbf4161b98b47ded0b3eed3eb0cf398ca76382a45045dcdd29ad8e6e84
SSDEEP 12288:Iv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:I8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CCC42396AD5509C6E34BC3F0D0E7CBD1E8A11FC272404E6B57E0F9531EFCCA96A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 5af20e4f4ceeaa9c831f9dffd49619c5089aedf3ca11b57675b65ac41234165b
MD5 7f11cdd8fa1612d34a30620e76f7d6c3
SHA1 910a9d5f8a4257b30db90201772418fd736a1e9c
SHA512 8dbeca269b3d8253ae5bb108d7a9cfd7f06152403ded0b88f35a46746bbc90c8e80e8dc8cdef37eb63e4ce8fb895ca11ec22a1e55dd639f2a4b2481dbf13605e
SSDEEP 12288:ZyPz5L8o0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YzyJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16AF4025777A120E9D1678274C4E24B42F7B27C7217208EAF03A056732E776E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 db511f6a38c6649374496e2f8f57e3ef1b1ee55bff8e4e23f555fff8daadd4e7
MD5 31b9c4ea27fe7023412b97a885af36f0
SHA1 f9e1440bbff95e2b46e25b1af53a29b6f305ad0a
SHA512 fb174e5e33f9b2c9dff8f9e81392b9394b69644838e480ebc669d9e1a7ef62eaff088bff471c483a67a1f9ad4c9fd240a8cba3a28e7bb2901337ebd5326ee875
SSDEEP 24576:xTHaLl3z0zDLgXe4i7ojhsP5Lgrk1TWb4AN5:xT6LljNe30jaNf1TWbdz
TLSH
T14B0502A5B3500CF8ED67827EC8A68A02D6B27C561760CA1F03F436675F733A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 e175652101ba70b7edac1e177c10b55a8dd695d8d8e071f62a6159451e7ae69f
MD5 44f4f58e104213488e2db218822690c0
SHA1 8296524c722e629305af177da0d10840aa2573c9
SHA512 946913c838d9b37c125b8fe9e53f2c466a73e67bf402ed7dfb979d549a3adf67c16b223f26e5ae1780c143609933fc7824e22f96030e1e91eb400ec4dd473162
SSDEEP 24576:V37d9CHKy7GZHgXe4i7ojhsP5Lgrk1TWb4AN5:17d9CHKyace30jaNf1TWbdz
TLSH
T1E425CF90F3E414E8F1B7CA75C9764511DAB67C9A1B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 54aebb16448941f9fdcd16aecb089b53bb5b1068bb66a7f71239a6b975b65606
MD5 095967650ab884e964b6cc4f864e9d3f
SHA1 d0fd9fb69572b6d5367f8d4e3499ec0f97c97771
SHA512 5fe019a39b40faa615cad5918c4302346a2ef74c17b8395dacd0bbeea873eced529397704d8b49de3b6c0f415c6ac97ea7503cb0b1a37d82608a5797f8b7b586
SSDEEP 12288:+C0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+bgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A6C42391AE5509C6E34BC3F0D0E7CBD1E8E11EC272404E6B57E0F5535EFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 9d62101dab1f8abc9f39fd81f6c0df471ce4f1a0b0688c7b79c87f628c7b1eca
MD5 dafe681324c2dc077183ccb5d87551e4
SHA1 5cad28907cc2723016328a5d7763ef13af0e2fe4
SHA512 e0173d8162d3b3b207dd6d42d123ce6bbd9198ac0c2b8c4efc05a0de165c3df6f7b0629915681d07a3d1e9d7228507774e5c5be501dbf3b2817219c7d2b6c250
SSDEEP 12288:+I0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+pgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10DC423A19E5509C6E34BC3F0D0F7CB91E9A11FC272404E6B57E0F9531EFCCA96A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 02e9d4a206a4db32804e872fde5fe134e6c1ffef1f3a59798f2826f77c42b570
MD5 301e2a05dde841742c53b6c57eb75245
SHA1 811c23505543dd1d6c823c21881d66ef963c6dfc
SHA512 55a7d53c392725f6e0f11717158d39f5650e12b75e76403a18e8edfbf9a800cc44d14a52d7be1f039e6e7f2d7f0e46b55704a86002f47bb287fe0ec15b8b6ef2
SSDEEP 12288:EF0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T165C423A1AD5509C6E34BC3F0D0E7CBD1E8A11FC272414E6B57E0F9531EFCCA96A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c7f52fd6cd61e60aca061e345302a1e0ee80ff25b6363662690b01022218ad38
MD5 59a07465f3ffdf8233fb636094f6c48e
SHA1 4936d1e59abcef4343f30346746d1f440696f9a6
SHA512 88cee6d6f50fe1511bd949499c4bc4ccaca53657cbf09ac4a83e56a16fb385f0f149730a62e6ae05b4ecc84158925d82aa53803bdec2e83950fe479f61e9eb22
SSDEEP 12288:JNsff0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C3E4F15AD29802D8D16E92B5C3968A41F3733C5193E1C7CB13D0F53E1F79A909EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f3ff2c622b71e9288e833c2237e298a2e63010614e853afdf20f7966b504acd8
MD5 0f74de8972dc6966ccc53f930a5abde2
SHA1 067b1b71117b9f787ef1d94617e058dbc20b07cb
SHA512 80057cfc7a24fbe5f354aa766d81024c55c23aba16e915222b2c29bce39c34fd6ddd1f0bd65d3280198c86c1d742eec88c7743a132b98dd0d6ac8e76f4d38ab7
SSDEEP 12288:db0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:dYgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10AD42362DB5809C6F29BC3F090F7C760F5663FC07B008D9B56D0B65319B8CE5AEA8529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ac1c2c65b070562c0929e00f72cf7b214a306f0074d8c2391138ed4be3b0d50f
MD5 7bb3360ad6a1f0ce3476340e0afc49b3
SHA1 9d0aff575ca7380c16c9600ff1542ef070fdaa2f
SHA512 3526f9b35dcc9670a7429d09ab051e61ec8afb1cd162eae5badef01c23fad0a943465f890aaa0b827d70f6cdf92fac2f20bc98773b697eec730f7215850ef169
SSDEEP 49152:xa0h2GEkuAe73q3pp46zwwQVe30jaNf1TWbdz:xa0hNYG4Jw8U023W
TLSH
T1CC85AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 8614e95d51dfb7afa399068a32a356567ba51935f63f69805bcfd338bc8e691c
MD5 d345be491d94685f60255ba7b48ee059
SHA1 96c5e7e2515a0885f83675774baab97b2e2ed466
SHA512 32ed0284eab1a7111d59bca57ad7024d55e30bd12530311b95084c94352a9329512428a38e324eedea870fcfd11a8a8dde7982e2265784b00bcd65f70aca9ae5
SSDEEP 12288:nhbHjfXv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:nhbHjP8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F2E412BE2AAC10C9F276D2BC91E28642D371BC51271187EF13D1927A0F3BDE85D38A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 45558f2a2e4375d944af86fef1b6b87131bc786dd5d64d278cf7c89a3c6f9159
MD5 d31d830c2b486406a43738f186b95347
SHA1 84558be237ebc1ce1e1129e08e220b4fec1b9c8d
SHA512 1aa1b32ccc25177c9331ae9c093a3f05a5266734e6104fbcb00030419a3f71b235826b9ecf9cf1fbbf857e5265169f045194546d1775fe902e0aa3f4a86f149d
SSDEEP 24576:Q3YgnJcRTk4yti+R5dBR/kgXe4i7ojhsP5Lgrk1TWb4AN5:QIgnaTk46pBR/Le30jaNf1TWbdz
TLSH
T12745BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 48b8f906e9ae45d4eee1871ac4e6a88e268b8685f322341064481e60b6f1e84d
MD5 556d58f4a4a0e6dd5286bb697a2bdfc2
SHA1 a9c2cd284e78d3a06449bb6b6a34a9f8c88b2d38
SHA512 2d35076e65b878bd69331aad6fc49d3c46ef46aaccd4a5b7723f42ecd419c425b357dd2fe50e1d7d018dd4ac2e801813601f875dedaad56f92bf118f63f061dd
SSDEEP 12288:x30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L1:xkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T100C423959E5509C6E34BC3F490E7CB91E5A12FC133014EEB16E0F5531EB8CEAAEB8458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 17216bf6373cd1d843c6025adb77b881603ca57016558d1aedbb8eb10fbc8f5b
MD5 5de5697cc9099de37dbae81ade6f29b9
SHA1 450165f70747932a05970060ada5cf9c2d4c0f4d
SHA512 87f4857c306620705432648980c02d2e454c960e166c761936cdca9d4158655216009a099720b0ebf14bbd560a926d7c2fb21299bffd26d22951300fc17dc135
SSDEEP 12288:KOb9A4LWOsvAYFTW0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:7pL3UTPgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19925F155F79400F9E96BC17CC4A28A12E2B2789D1364E7DF03A88B661F637E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 d11c08b2ff269efdbb8efde8ce8e59f7f57d3ca3b72a5a9d50d7596c79126a5a
MD5 04fa50171f52f980327025456c6bf95d
SHA1 cd7082f964193a2f6dfacb53e02642636d4e2af0
SHA512 24a5dcf91ed829098baec35672ec5a8414cd480d979e09ddad3462e7f14b12c26647b18273fffbb761da352f3d34076570bda114cbc187b8323479687b44609f
SSDEEP 12288:ApFtpOi0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CO7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1ADE4026A37EC10D5E16AD27C85D38349E3B27892171147EF02D091BA1FB7EF86C39A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 39d2f97709620f6e099ca4386dfa40d3d4c04fdfbb128cbabea772147f840092
MD5 c459b4aa37d964735847605017356343
SHA1 1232dce1f1141d8cba7fec6e307011446c08abd1
SHA512 b432df7964c898467a55ed122a4d3695d767e90bcce723b678db72bbae059913122aa444e6a66aa8c89453a0b9d575cd02610099e15f87edb2cea20da4d9e2b5
SSDEEP 24576:Q7NM9YqZqmWMUkPjZM48Mv6bEhsogXe4i7ojhsP5Lgrk1TWb4AN5:Q7cBWMpPjN8DbEh4e30jaNf1TWbdz
TLSH
T127659E2E6BAC81D5D577D13DC9E28205F6B2B4611B318ACF1262833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f2f0bad8c2878d96aa1477a044456eb434fb8c4e2b36c16f0883ffc9977cd9db
MD5 e405e90ee1348956029e4a4bc1a7e71a
SHA1 8c3f91fc04ded7be73cd64ec76ffdb58d5375526
SHA512 3897855b4cad7850ae0b6eddee7f3dd51bcdfdc8170323c23815a9d219c3fbfe3672610f4fd3d7282a2d593ceefbc26a328c9457446c5bd720eb97c317485adc
SSDEEP 49152:5F2YuHNETovAvNYf8km/e30jaNf1TWbdz:s6BCf8kiU023W
TLSH
T1E9857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e439b977fd2e121b916d55f5fa75f4f34e6bb95d9b016019ed3c66f7e6ead31d
MD5 b74b5d100c424da75737ec033c90707d
SHA1 ac6b1c7b1c0d0cb969915a0d701e3fa7066f5e86
SHA512 4fb1f878934941609ee7993158d6d71c2514ffb28191504e2842f50beb9b7a693757d515d7c647ff448e25de3f977d1a3c464918dcf1939886fc3ab53ac681e5
SSDEEP 24576:VAFs06+Omlf3NXEbToXgXe4i7ojhsP5Lgrk1TWb4AN5:aFs060lVXu1e30jaNf1TWbdz
TLSH
T1CD65BF2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 f0ba75a5c290f656248c0daf807f85bb267cc61a81daa3cab538e9c64149e21c
MD5 1d39da4693fb20a4e898ab213b735953
SHA1 3541804b62f620c5158c0da2ea9da16dfc555964
SHA512 7a5ee1545cb41a3c625b86b3461887bbec9cf2ec2806dc9181a53a7b1b987184c33cc909b1d1625d972c785e29d6bcc0615786a2ea432ed4edef82cfab21c9ac
SSDEEP 24576:rJnJ5D3WXigXe4i7ojhsP5Lgrk1TWb4AN5:rJnJ5DGX1e30jaNf1TWbdz
TLSH
T13B15D02DD2A810E8D0B7C3B4819A5B96FE72386D2F226EC714B4D5353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 49098f2f0aa63dab9264b65139c28c1f53b0c94de9823bd9e4bbeb2409c2f0a4
MD5 be5f354def2a724f7c6ec102ff34665d
SHA1 20459d2e5075676362a235351ea47920e70b01c5
SHA512 b8e6d7d27c4b95b8f13788b9560c8aaf1f40f333634a5ca41071b3fe47ca70ac004da215aaba63b546ee63418f1f3137c51234daeaa5824744e0d81ae2508ddd
SSDEEP 49152:og06DIKdwc+eQnSt65aVDe30jaNf1TWbdz:pJU023W
TLSH
T1FD955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 1893cdaddd539473025b0cc098e0750b6584eaef4f2593892fd8e17043dda236
MD5 7029b106cb63b2a5714b6196168740ba
SHA1 1347dc36763e101a819fa6597a3b9e1cf0540f08
SHA512 4c50679fd8640c4049057ff051793dc25735826fcb9440fbe688b87dd9bfe1cc7fc808a97120cc3b1c15bd7a1f7d98da4a118be8a36800182f63ef0b14c97208
SSDEEP 12288:uEP3Rn+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Nn3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D8E4126D6B9C60D9D16BD17C90E28741D3B2F4A127021BEF02E0D27E4E779E96E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 f23fbe38e04e6edc7b61959101f7b2725081cef92c30ffaad23628b3a766b637
MD5 56b570f219ed14c7a0f1f12cc545c3b4
SHA1 90d32dc819fde9d25d4afeabb2ee9a18f93950a2
SHA512 a12b1c59a6d775d781e26096a87e37d1cb4a47502135a2d7037d82e99e165e7211069901253a059aa34cea86d79657357ab5dd6aba6cf11573dd001e0a2b61a0
SSDEEP 12288:3jkyf0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3IyMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16DF41244679814C5E2AB8278D1F38390DA717C602B104BEF52D0FA3F6F7AAE4AD34B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 38f1deb463249ffc30b7c61e03a4b29169b15985f1afd704f565af9a755f903e
MD5 0c5226819bfbf5de526ecf3f6bf96c3e
SHA1 23a6deb710d2f771da282f8d44ea0fd71d6aa410
SHA512 8413cc0ceced59a5c15cf5dfda9af99add25d11ca321d4a4a1c20280c53aee226ee2298053914e090ad3bfbef342f4681c69066fdc05674c143871bf5dc741bc
SSDEEP 12288:hyy0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:QrgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T142D423996A5519CAE24BC3F490F78B91E5B13ED133000DFF12E0F5735EB88DA6AB4858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7587df79366147d6b2b86baa504f4d7bc0029003f5682a5c7c54fa5588d50f6a
MD5 c0ef9ec6667fac02af4a3508e1758fde
SHA1 4c454666cca595640d1b1b798763907c56b15a6f
SHA512 5d6e427e42dac66215d24cdae67d446575aff80db40a9ee53cea33bb0af48fa2832f0d780642b710e46ca6127de0750bc3e5ffe5b40e37c6ff51e353df156e68
SSDEEP 24576:LQ9MxZKdcz9dw3wgXe4i7ojhsP5Lgrk1TWb4AN5:LVKZXe30jaNf1TWbdz
TLSH
T1B2557C2DABE9098AE177D275D5A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 fb398bd6f4061c3cc39e3eda1b23088b59774e0f68eabe55ab9a6fc449b482bd
MD5 bce4ce4b21e9c334573dcbfeb91e3607
SHA1 ef5dbcd2dada4dc2bb9d6e2e0da9fa7976f79a3b
SHA512 0aef18635881b016055dba45c9b0aeefc5ae2baca98d7527722e9e53a9b50abdad8dc1a8fd6eeec180fd007c04e0667e1c259a64fda9b62c8febff19a002e5ab
SSDEEP 24576:JyocDApJgXe4i7ojhsP5Lgrk1TWb4AN5:kocDAp0e30jaNf1TWbdz
TLSH
T1CAF4E01FBB6900E2E166823C88868741E7B3B4702B5257DB52D1C33E4E779E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7614890e47701242e81592b6a21c9ec66fb175290fc700e683ea7f41f4a5a44c
MD5 ec01b2b3ed75c79a991b73383e03e45c
SHA1 a220490488e4b88825030d53fc7ca1188682d006
SHA512 4a61190c2ffa41d4e50d3411ab53ba7722a6cac246d80e3ac3b751560bdd27ed3790dd20b07aebae47698793514cfd9c34b1e2ad1806eaa95e504ee754e2ece1
SSDEEP 49152:jWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK0e30jaNf1TWbdz:j0zuNIGU023W
TLSH
T162A57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d29edae87b2b4ee130ce76c8effa2f9d51012aa38967947500f2545819b59341
MD5 f502d37c4c4e08e0a1b202a7f97f10e9
SHA1 35e190fc05ad22ab7f4310422e3f4030e3a0aeb0
SHA512 1c9d9e8325a24b568bb51d5b6cdf17ca7ef7c002dd3766ef68c9cdf57c152748850b6580f80b477420b6b58c8e4056a3aeba17729496b8640010a55d1604b157
SSDEEP 24576:21QT7EcpfxR+N5AWAz3ooiYtjMqb3gXe4i7ojhsP5Lgrk1TWb4AN5:bTDxR+N5YzTfjMBe30jaNf1TWbdz
TLSH
T11055B02EA7F805E9D1BEC5799A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/904-23-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/904-130-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1072-349-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1072-298-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1388-34-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1388-205-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1388-33-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1388-35-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1388-27-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1464-320-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1464-321-0x0000000000ED0000-0x0000000000F30000-memory.dmp

Download

memory/1464-432-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1464-327-0x0000000000ED0000-0x0000000000F30000-memory.dmp

Download

memory/1492-476-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-466-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-451-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-454-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-448-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-455-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-452-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-453-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-441-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-447-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-457-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-458-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-462-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-461-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-450-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-446-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-443-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-460-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-464-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-469-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-470-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-472-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-444-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-445-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-442-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-480-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-479-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-478-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-449-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-474-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-471-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-440-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-468-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-467-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-475-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-477-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-459-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-463-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1492-465-0x00000154EC0C0000-0x00000154EC0D0000-memory.dmp

Download

memory/1648-89-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1648-267-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1824-268-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1824-109-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1824-111-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1824-103-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1952-335-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1952-334-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2128-40-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2128-62-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2276-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2276-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2276-266-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2276-63-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2552-51-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2552-43-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2552-265-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2552-49-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3116-381-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3116-436-0x000000000CDE0000-0x000000000CDE8000-memory.dmp

Download

memory/3116-510-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3116-355-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3116-365-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3116-397-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3344-509-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3344-350-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3408-77-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3408-72-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3408-79-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3408-75-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3408-66-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/3484-277-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3484-341-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3484-278-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3484-284-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3896-506-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3896-347-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4004-301-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4004-354-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4004-439-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4212-456-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4212-338-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4260-331-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4260-438-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4584-473-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4584-342-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4612-305-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4612-405-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4620-74-0x0000000140000000-0x00000001402EF000-memory.dmp

Download

memory/4620-17-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4620-100-0x0000000140000000-0x00000001402EF000-memory.dmp

Download

memory/4620-98-0x00000000028E0000-0x0000000002963000-memory.dmp

Download

memory/4620-9-0x0000000140000000-0x00000001402EF000-memory.dmp

Download

memory/4620-101-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4620-18-0x00000000028E0000-0x0000000002963000-memory.dmp

Download

memory/4620-10-0x00000000028E0000-0x0000000002963000-memory.dmp

Download

memory/4620-8-0x0000000002600000-0x000000000276D000-memory.dmp

Download

memory/4620-0-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5004-316-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5004-314-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5004-431-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5092-294-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/5092-289-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/5092-345-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5092-288-0x0000000000400000-0x0000000000497000-memory.dmp

Download