793578a974edcadf24c73761876ef9724f5f4921e70123229c792a51a7e4cfe5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 2.2MB
Sample261018-2d43lsbt71
SHA256 793578a974edcadf24c73761876ef9724f5f4921e70123229c792a51a7e4cfe5
MD5 a42b48d0c3f6e53f10410667245a2b66
SHA1 43de86a401fc7e69229bbaeaa8dcd09fb9b04c9f
SHA512 86b73039c4b063964b0a1ebf9f256ce55a5d1f3cc32bdea2a7bbd2c00d554c7a62c941007e01659dda7ec0c7cddb58a779e8c94ea75afc56c988c31afbe30742
SSDEEP 49152:ZWz/clX4N/j2U4FHpThHTKmyBQN/j2U4FH:fXkj2jFz+ZBMj2jF
TLSH
T1E4A51255F3E514F9E9B7823C8A558A02EA31BC659760968B13D0479A3F37BE08C3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2288	alg.exe
1668	DiagnosticsHub.StandardCollector.Service.exe
3668	fxssvc.exe
1112	elevation_service.exe
3188	elevation_service.exe
4644	maintenanceservice.exe
3760	msdtc.exe
4484	OSE.EXE
8	PerceptionSimulationService.exe
216	perfhost.exe
4308	locator.exe
2852	SensorDataService.exe
4556	snmptrap.exe
2280	spectrum.exe
3980	ssh-agent.exe
4252	TieringEngineService.exe
4032	AgentService.exe
1272	vds.exe
3388	vssvc.exe
1740	wbengine.exe
2240	WmiApSrv.exe
3844	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f8e60f48250d612b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1816-321-0x0000000140000000-0x0000000140230000-memory.dmp	upx
behavioral1/memory/1816-8-0x0000000140000000-0x0000000140230000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106062\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025622620505fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003da60d21505fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f422a21505fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a73c0020505fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3254a20505fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061eb4e20505fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c44a7020505fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ead7220505fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1668	DiagnosticsHub.StandardCollector.Service.exe
1668	DiagnosticsHub.StandardCollector.Service.exe
1668	DiagnosticsHub.StandardCollector.Service.exe
1668	DiagnosticsHub.StandardCollector.Service.exe
1668	DiagnosticsHub.StandardCollector.Service.exe
1668	DiagnosticsHub.StandardCollector.Service.exe
1668	DiagnosticsHub.StandardCollector.Service.exe
1112	elevation_service.exe
1112	elevation_service.exe
1112	elevation_service.exe
1112	elevation_service.exe
1112	elevation_service.exe
1112	elevation_service.exe
1112	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1816	2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	3668	fxssvc.exe
Token: SeRestorePrivilege	4252	TieringEngineService.exe
Token: SeManageVolumePrivilege	4252	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4032	AgentService.exe
Token: SeBackupPrivilege	3388	vssvc.exe
Token: SeRestorePrivilege	3388	vssvc.exe
Token: SeAuditPrivilege	3388	vssvc.exe
Token: SeBackupPrivilege	1740	wbengine.exe
Token: SeRestorePrivilege	1740	wbengine.exe
Token: SeSecurityPrivilege	1740	wbengine.exe
Token: 33	3844	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3844	SearchIndexer.exe
Token: SeDebugPrivilege	1668	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1112	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 1780	3844	SearchIndexer.exe	110
PID 3844 wrote to memory of 3308	3844	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_a42b48d0c3f6e53f10410667245a2b66_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2288

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3220

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3188

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3760

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:8

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:216

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4308

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2852

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4556

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2280

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:624

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1272

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1780
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3d45ab360fddb141c805d4fa93649b19793012418e7adce64c6bef099b42ea72
MD5 48163e44a3bc181a25892bc5f0f932cc
SHA1 e91a3bfdf304a1200948873944e498d68ca5f551
SHA512 b852584c688664762b6be8b13818e949275047f0f95a75cf47aff7ab6257e70d9356788b25c2f477357a9d41f761b05c38e2ade0ce83fb38e2f13d2c473a1b4f
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn0N/j2U4FH:k3q6HjBRj2jF
TLSH
T1BED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ad982381bb7525fd7f482841cbf80d0f1281297aaf40769a2d359c29e5aa895b
MD5 1cdbd68596bfe0412a21fdc50ebe0f37
SHA1 3c12b210468e15fd6af291f6f08b7a9c7cad29b8
SHA512 9250f3ae8f0a73a3700dccc56b64c7087ca6c7cc8609bdb9b2690ddcee66d4f1ed9e72bd5d9b099004e454b37ae1ea819ce9fe559cd51a2720c337bfdd45ece0
SSDEEP 12288:K1XLsswWkxy2lRq2czAoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:AXYfDtczAIdCN/j2GLl3iFSE33b9
TLSH
T16905F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7eca6993a957c066c41ae6c0923cfe21a56f07412d618aa4b4e5b46e49e95796
MD5 9009acb602239c6546ad2813d9df1e90
SHA1 8d18dd6d6ce30ede7a37b6fb22667d437128d65d
SHA512 5ed7da289fa35adc8fcefb977384d92d70e37709c6cb1d70d2361b55d1a3d01f26a6ef0f7fa7578bd8ea404f277a6c56f178d369bbc2fb64df5693c2bcc7576e
SSDEEP 24576:W0Le5ji0hmxirMfdCN/j2GLl3iFSE33b9:WPji0Ac9N/j2U4FH
TLSH
T14235AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e08145e5c70cb721edacef26e2978713d6cbb0d9cd82b987207b9488d42cbd11
MD5 587e1c31d563f3666783783756168824
SHA1 35c5944256adc382ceb1618c3f5363174d19bf12
SHA512 8cb89f54d6fc8df920436bb7f74c235d26c591f2f9f8a2aea174c543417bad3b60aa4ef777d109e1837573338ac0761570086ff3fa3ef10015631f3f42de2170
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWE6q8wyuVdCN/j2GLl3iFSE33b9:K/ezSC6vUzPvxHjyBN/j2U4FH
TLSH
T1DF755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6d85f406172555b5ab9bf4d201c9fa48a01405fcee112e5889333dc6bfc9c942
MD5 303939410edb0797731f0b1685985417
SHA1 7836400b1b9d6cbf6b268bed62dba40f9d13287c
SHA512 52bde79cfb1682852517bc5045f540090b0c574ad174bc48ddf7211234906b7654bb63bd6bb23f9b5846e50c67c9c2701ffc49c901be6d2f6438968ef3514f3e
SSDEEP 24576:GVbqPb88hv/l+6UdCN/j2GLl3iFSE33b9:GVO88hXl+AN/j2U4FH
TLSH
T140559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1b382238aeb8d61c2ff00cce7671e3c6b6b4aa273098c86f62fb3898ee21d5a8
MD5 74812bef4558b73cafb92e99607311f3
SHA1 15973f7397f276243d3e5abe98222b0c1e5f00e6
SHA512 91c5c11ed7aa232cb77e39164ed94bdbd61c96d94238e2fd66af6e15324e2fbbc3f043fba065006033ef7e9e7c8eb098fe305cd6b0dd4a3fa85fdc7119ff3f42
SSDEEP 12288:PRTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHP:PRrdCN/j2GLl3iFSE33b9
TLSH
T1B0C42360DAA5B565F66F837903ADDE615200FEE8E525884781917BEF127CFE8D033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 c546f212caea3d0266737fc001b501efe1266889010527f4d64bc9bf259aeefd
MD5 e11c10e2f17d143221b9a6f196380e4b
SHA1 39c9645d9cc4e473569aa6a479814ac05a6609d9
SHA512 8b91a566bb1680973c9448f2d12f5ac91b81f73553c8627a5487755f97bee67050b90b81b14d9ac3c17d47f67dd472c0ee28e3af3df6602666e1e0b584a92f00
SSDEEP 12288:WeBNUbTVO86UEJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WJIUsdCN/j2GLl3iFSE33b9
TLSH
T1AC05CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f5ae73bf812b4c0bc6bc123ff114afae5a5a9e921c466f65d749a6c9e6081951
MD5 0c5f6da24e73e36c64c37b5e4312360a
SHA1 4e432c9b69a4e83640ed4d53613b8408a1fa3b44
SHA512 13982cfd6dc4227fe927db9d5eca6491c80852890af166caf5b1f7f779e7b18e36d1634e321c398ff6bca72f9556580b9f5b046cc92c67ae140574c9fa5ae670
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:hQvGAdlCEL8c/yRNw5Caj2jF
TLSH
T1E4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0ddbaac8fa879127e22e2bae23f0f73d5a5c034ee827830164fa46822d9319c8
MD5 6a133169093678ec33ede05c73ad671d
SHA1 d5e94db537389fc6615ca5f647178706cf1a5a32
SHA512 b763f745558bf0e62bb070f8a7c25f0047cdbcbd098cc6cd85c45e3002d5d3768eaadc16730a7b6d2d80a053b3b8cbf3390a0cf46ead1832b1194b5e2a01177b
SSDEEP 12288:4AwSfxL/2Dc34DLLmt0LDQewsAjmJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9d:ddewsAjKdCN/j2GLl3iFSE33b9
TLSH
T10D15E031FE74E036C27F0DB61B36C716142CBA608B6119C3E3E85E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 84032004e7968aa3939bffe52bbfe5125066dc75ea6ba0ed6668e9a9e4c3ce21
MD5 15f71ef2ee65d4bb61971ead13b82056
SHA1 09591ea62d37c85820564b9078464446f30a0d82
SHA512 487d4ad2c63e2657be37ff52ac165ff292fd3ab1a8faecb4880948a634587fc40191278a025642d107e2b23c52aad60a8c61b268d283f804d7a974c9c96964ae
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH78F:/UEtQevvqc2W1cpV2EI327
TLSH
T154474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f049a2cc3083e64773070d4e6d2cf781a28300552721542f7423529dd89bfae7
MD5 7a16f16ccc4f7abbf018ca77a51c7499
SHA1 cb59df4b14668028d19b409e5b75038948d3003a
SHA512 facc25142c85b63eacf433ce158e809bc48175a0709198b0df7ad5d758d45583b7a3779eb0c15dd01c26e09f74fe59e6dc4abeae144a3ec7fd15057568ae2cbe
SSDEEP 49152:lCbRquA/m2yL5zQfFiV+XenmE3/zNN/j2U4FH:yoqtVjnmmj2jF
TLSH
T18ED58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 649414d288104686a355da4bc21bdb7886de39b913807808a37953d7569a170c
MD5 ca8a1ce11784afb656274c0a1ad5552c
SHA1 3b93bbb5c9a742170bfc02b3f67d5d856c4833f2
SHA512 2f811fb4b5c6e3c0f00143ce317bbf11ecc57fd420cfedab1d1ae4debf0918d8bad42d3b4de006a56ebc332b713a2bd555945e54e5c0c85d301e3441968f528d
SSDEEP 24576:EAhGLJIFoiwtA5l7S53JdCN/j2GLl3iFSE33b9:EAMyFoiq5uN/j2U4FH
TLSH
T19F35AD80E7F955D4F5B3AAB899B69570EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4fe0f644c10ed17a002f8d0bafd832dcdb53702f51c1bf5c9ff289cb82c8e6fe
MD5 9c2641208c4b16be9e661a382ffd062b
SHA1 e01033cacb5fdd19341602e015fa78f8721bf148
SHA512 789b070d7ccb8e89a14f44776f52a2e2bcca95f0f7c7eb40dfaa360224273d485fc4d4c8b9033af8ead0c99e496e4b430413e976a50d7e872a077b91faea445a
SSDEEP 12288:3mw5HEjsChNVBFgl0WDm+CBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WwuoOWedCN/j2GLl3iFSE33b9
TLSH
T12D05F14576E41CF9E96782398697C536F7B2BC512A21CB0F0360C79B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 58305139432a47a970228d7473f0294d245d64d2651a752d55f0b7c255550920
MD5 649dd832c22a9d2a5801ce2ce11e45b0
SHA1 56c6c3e3e0138cd17b87159300e5fb1f03095b94
SHA512 5f956f54c35003b69beabccbd66df3b2bd411b56bfbf86b42ccdac24cc5203bea5e6c9eeb7277c575158780c91e48d79dc5e913fce5e0e791cfdbcab135df23e
SSDEEP 12288:RBZ1Iy2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/Zu3dCN/j2GLl3iFSE33b9
TLSH
T114E4125933E471F9E1A7827C8AE59A05D321B8A5A73243CF026047EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b4e861219c1df291f70535b8e6ae176405e28a848b512f15200ad3597f14bbcf
MD5 2280e49dab0b8c3d90777ca9b42eb93d
SHA1 064a985ca30ca6a433493acb9b5b2714746cc84d
SHA512 68038b5c87a47397dd4a11b37a2d9cb07fbc2c6e0855ea30f0bda2983ae6268c177e4788c015fb68ccc652a9e9c5c0a2ae0806d99af46e79673a39b0ddb7aad6
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:eQRQyi36YOcPQLvw2gAf+PN3Fj2jF
TLSH
T144667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4851b3264976f7fd4605876b079003c24b11af1bcbde3e2d6808300e03acb8e5
MD5 aa70f7a214ec43627f785000b50ad45f
SHA1 a12cca6e5a53f3d98bc908e602de509782b6008a
SHA512 83aa341f8aeb2b17a590403d046d1d9e6f0c661b85cba4b630b6cbebb92a7912967b139fcdbbab0c151558dc42f6a2e9a422b8d5e643b7f0f324c0c4aecf1bae
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:kQRQyi36YOcPQLvw2gAf+PN3Fj2jF
TLSH
T18F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b9b0553f9b7c5ab3b037b7cffb801207d3027ec957e65537b0e0ded37fcc144d
MD5 87706eec7fe318b3a632ba9724f00ca6
SHA1 dc69c967b7349926dfff841a86d8d7351d8ceb4a
SHA512 d8e804c8a0092a047ea597efe5e6a900d2665a07777a366375a284498f57d5760fe8ae02cdb2268a56b95394ec4b8f1e322e34b720dd381bed356f8f3f885350
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0HdCN/j2GLl3iFS+:v68Qg55nhheWu7PNU3/9N/j2U4FH
TLSH
T101B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 06a1b63990a14e6f98250a44194694a9fafa9bac7e732db003c3ad4d1225a3af
MD5 03f3f62425b56c39fc7831cc30171bcd
SHA1 d7640eaaf04e255c852fd58d93e21ce08401d358
SHA512 76f32d109e1a19d8a922554625dc551c112dabfcd6e5b6c5887ecf7189a46db346921b3802477bd7f6458fb908ead9ecfd1f973cd9050d493681ea7e20945c41
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99k:Dy5112gYy5azzVvL69nLKnhZ0j2jF
TLSH
T1FF168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4454562f255903ade24e31a970fd11014080119680fe978e6e304ac0af3e4b14
MD5 626731d1fbf160bcbb63885d2704dc4b
SHA1 e4c0a4ecc8d0d9f44d2997b6546cfb96bb6bca51
SHA512 0874451433ac9b4963d124927ff1ad75d5516986f9facf45925ea05c5a9247123e3024e5f0b3ad96617d4d676f3a60dc5ff0640afe4d32c93dd641bd1f41e2bc
SSDEEP 49152:RB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glDN/j2U4FH:Hu6JmVxd2dNj2jF
TLSH
T1D1D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0dc4bc4b6739d058ba3125559122a0644cad6118bec45c722382682e4b90b3f2
MD5 0c534cbf37ef190097248cf3cbab7e39
SHA1 a88a5cb9ec8a70e0a19fdb6261a1ed1a7415e020
SHA512 fce415601ffd405ca32fff16ade2894170415b21de5f33f6e7632f9c333620055d7fa1ddb8b51f0f3209a64f4c97925bc4c99a56013b9700f19e0068877efdb2
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4x3N/j2U4FH:FmifPbRmj2jF
TLSH
T18FB5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 813da9a229d51af086ed91073e0b1905438aba3d52987aec9ce7a78bc8b1717e
MD5 88964fab5485b1df5e2c3e2dd3453b17
SHA1 792c26e5826fac0b240abe9d50c38457bec6da78
SHA512 d46563172cb793be33ae7cc4ab4356518dba6babe198f35350a79cb9a2fefe73984514ea9d904a910ec03de9e6a17ca5240f200603ab916ee7a0332501947b45
SSDEEP 49152:kSuZQIY0Be2KRRVtOnks6NMHqkN/j2U4FH:25dKTi61Ij2jF
TLSH
T174C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 22e69c757823938209437054b8907f2834fb09690a6883089ad4a1cb71b60cee
MD5 fa3b0b2e3db3cf1b636ecb1e78d3e0aa
SHA1 684f7805a6dcde332c6a295ac4aebe389a34b987
SHA512 3f6b9a366d471d03a22ece5ea6f3955254ffeb2d549be52c3bab7f439673776dca29c8eed69365114ef5477ab99faa98be5799d6a526ad0a85b3e5844168c0eb
SSDEEP 49152:ihtSn8EApI0figngiDn0AP5wzN/j2U4FH:DX2iyphSj2jF
TLSH
T12695BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 16ef36e5110876896962e80544a2b8704780eae26f7716f2c3145be701d2fb92
MD5 cef0ca6ff4eaf9ca01e000a7fc8b0154
SHA1 dfe6beff1ec552dba1d29a273614cd22b69a5b6f
SHA512 7db401fffcb4b3c3ebc281d718264c2555aa8f09f8facddf5d84cd66452920e818ff856469f4cabc5a5ac9bda8215cd32d2b83e5eb619f661b150a78b67c3c45
SSDEEP 12288:ObJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ODdCN/j2GLl3iFSE33b9
TLSH
T1AEC42364E9F6B669F15BC37943A8DF519100FEECF6264487828556EB237DFE88033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 dda25b99f82c35ca8c2553f6bb863a97925b7ed6831ec595aa6ac12ecaafe7f8
MD5 44e6f4b0cfdfef1f5c7e39853b1cfdd1
SHA1 2ae9c4a33f8dcc07e35d86e01ba266f78eeaf42c
SHA512 c880e866a5cf53206bd3220d3b5af3284edb0bdcf370225c2ad67413652e82f3b993916441d2bac16d11abff6471c3b5c01cee489745ad2d5f73005a0041dbfd
SSDEEP 12288:u6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:uGdCN/j2GLl3iFSE33b9
TLSH
T1D1C42364E9F6B669F11AC37943A8DF519100FEE8F6264487868556EB637CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 8e276e18dad95959227cbbfff424a103c35daa5ee5d922652e64bcf36e28a867
MD5 c7bc5914991612e9966256c94c02f0b4
SHA1 f4152ee61f853bc16eb708e6957add8426e99f13
SHA512 63a2d65912bcb829568145984055771b33f2fcab84afe52408615dded8524f1008635e8cdee13e98c7e39d4a0c1f28fd34ecf3d5f9eb2ca639d677d0117b0aa0
SSDEEP 12288:lMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lkdCN/j2GLl3iFSE33b9
TLSH
T1F5C42364E9F6B669F15AC37943A8DF519100FEECF6224487868556EB237CFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 43855671d4dfcfe31f75d700ece0eb780ab8ec3703e4452cbd7abdbb46d5c6c9
MD5 2d09aa1fb8ec8be26adc590667e0e6c9
SHA1 9aeceb7382646203c5110d0d7a03612a791a3d4f
SHA512 85845535397d0a811d8066cbdca9ce46a5a352f4ed9b509b23a2e4a1158636e7a19cf3c95bbdb481bd95f59542d2f3db29c12515053790913c5dce22f7b54db1
SSDEEP 12288:pV9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tdCN/j2GLl3iFSE33b9
TLSH
T14ED42360A7F561D5E46BC37C83B9DA11E220FDE8F732458F87400AEB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 46f72670d51f39f2b62c3c7465c0f814a7b19d73624fc57cf635cd44e1ec1fa9
MD5 2368bc83ff0b7fe0cf444276cfda5194
SHA1 a02d07557dd3d92ec808fdd3f679d2cacb357df5
SHA512 6e92a003e1a7ccf25ebde1f32a05861280e0e15974551ed92c70120bf770d41339c15a5176857567c8d62b14f1b63f06147769406481d98f468148ef84a785f8
SSDEEP 12288:UVJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UxdCN/j2GLl3iFSE33b9
TLSH
T162C42364E9F6B669F15AC37943A9DF519100FEECF6254487828556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ff6c35b9faa84f7b131606761ae64b217a406236ff39e584219e30fdf63275ea
MD5 510c09ede8caed5d4b971b8238796658
SHA1 babedeeae032310f5e1fa7744379d5f4b78b4dcb
SHA512 a33c643f83d55532c5a2ba8ac712d11d61b372a168a5d51a4a1e4bd13947a11f02f5e51da2ba603951d436587e4271641524f88fd5cfbd4998ab5a70de5829cf
SSDEEP 12288:GuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GCdCN/j2GLl3iFSE33b9
TLSH
T1FDC42364E9F6B669F15BC37943A8DF519100FEE8F6264487868556EB237CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 9d44114ad134a2338ef47ed2bb4b7097879ea34ddee0a04a7737ab5f7cc3b570
MD5 3ed225e26ec30839b40d94c56403bc30
SHA1 7101a4450f4629578e8de241def0598106caf9f5
SHA512 0e2ded28f5542826e5017c0c0a5e9d28f9ee2435584a2df1dd4ecf69215ffd694fa0a071da92e599b8f37b268db70639f4df834490f81e61a6ec63f53c2c9e8e
SSDEEP 12288:7yJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7udCN/j2GLl3iFSE33b9
TLSH
T163C42364E9E6B669F11BC37943A8DF619100FEECF6254487868156EB237CFE89033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 aec4c868dbccbc24331c2860a574fa55a38e069cd55fc3cba3bad2302e6448dd
MD5 91d162d7fb052f9cd10503311e9f0bd2
SHA1 6858aea3aadd718ac87d4072f1ace6d046184976
SHA512 544c7cdefcb546a91e3be92df16b55d79c8280d2440342c80bf83908c023b3a7324a0c217c22d2b62e3521e744a1421d3a139d0b3e9e7447941a3e5166228565
SSDEEP 12288:7iZwb6zzFEoS2cPvyaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mZMSzFVSOmdCN/j2GLl3iFSE33b9
TLSH
T1F30502A4B3A018F8EC67823EC9658915D271BC595770C60F03E4366B1F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 2dd9453213015299752d131eab212ed2eb96821219dba16d71cf58ce128af8f0
MD5 0b901e91695969fde23126be3d4d81fe
SHA1 58fe1b3d873edf22e0f600bae39659972f55adab
SHA512 96f2c9d36f8d15cb04b8e6003506519bb862bdc370c97798a4c61775ad35b3437fc68bcba4fa70dc8a4be3c615891db68a925175c0cc69cc5d28ed2a8fbf7627
SSDEEP 12288:LnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LndCN/j2GLl3iFSE33b9
TLSH
T1FCC42364E9F6B669F15AC37943A8DF519100FEECF6264487868556EB237CFE88033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3b3a6c297ccae1eeb23bf843317d5c2ba6b9caae403d336682e75989e0c136f5
MD5 d5c5726be2f2c1dc3f923924641b212e
SHA1 66d616b308732482e5b67c6547eb14d36f135a46
SHA512 ae799d17fadae26cfe99b0839034f917e56cf22cb2db23e5a501be54e810b67354082e4f20db7bf511cc11e5fdcab35fa8d44b119b04babf7723c3ca910a4fc0
SSDEEP 12288:mjJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mbdCN/j2GLl3iFSE33b9
TLSH
T1D1C42364E9E5B669F15BC37943A8DF619100FEECF6264487868556EB237CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a43bcca8c1614391a8730c64f22541773fd965e47885dd03fb5518e0663fa6be
MD5 4263d05d56845e8a9553995ddef18ae7
SHA1 30a1ccb0d4d97ea05b9259915403a7cec3d4a78b
SHA512 742b6d34cee7ab626ad9c6b0f1eaee8461b6f067d27420ea440c25da02b1b244ed82615c583376aed3ebbe3a29ebeb1f8626362b269ffbc0c0480900f26003b1
SSDEEP 12288:myPz5L82JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:bzy6dCN/j2GLl3iFSE33b9
TLSH
T1A1F40257B3A131F9E177823889A55A11F331B87597208A9F43A007BB2F377E09D3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 3042fe0ee5b7c8c8a93ab234f4e6205add3b6a5c66d9e4ef6bfd9c220b72f869
MD5 c668e5a06ec63441a40a04b732f695ca
SHA1 b22801120050e930f44205b72e57d8f783b6eea7
SHA512 ac99982525664959e54ff623d7b4d7c8c13973631911219cf20b24f09284fb87ac982ed07a702003e6ee1121679c860934e4a815c4b3129241fc62b583b6c8eb
SSDEEP 12288:GnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GndCN/j2GLl3iFSE33b9
TLSH
T131C42364E9F6B669F15AC37D43A8DF519100FEECF6264487868556EB237CFE88033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 bb71f62c152d311ae98fde926016bba50aea5cd3ebb37e04a4b6e028deb6046c
MD5 cbe7b94d7228fe86a10a125a14457d9f
SHA1 94ad106e0b1364eff6c9b511e5e88e46c5fb4ca6
SHA512 86c5920ec2645e6ff050e6eef43aeb41725f56885f0e96448ae6e89da4fb025ff34675255bd0f3ab811a0a75c90603cc0f193da26143acbee4826b8094e39401
SSDEEP 12288:cnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:cndCN/j2GLl3iFSE33b9
TLSH
T1FFC42364E9F5B669F15AC37943A8DF519100FEECF6264487868556EB237CFE88033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 15a5a038ca65813e9ab6b1c9ca4d9c215fbe94970baf12fc09d305e85a1c6ed9
MD5 ed8af8b9b67aee2c7b61e66888743a6d
SHA1 2e24e8ff2836ec2ea632fc726da3d215f7a6666c
SHA512 fbcd28d12ff7c95901eb365b5a7259211a3b6be8fff129f9710c82864cb9d80a8f08d3447cb46aa0a8aa11c7d3d5370d0d3b4d9cf8a58558b2614afc56401df7
SSDEEP 12288:cyPz5L82JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Fzy6dCN/j2GLl3iFSE33b9
TLSH
T184F40257B3A131F9E177823889A55A11F331B87597208A9F43A007BB2F377E09D3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 280cb16e3e567f70e4b2ca01ae567979cd1500c1f47fce0db3fcd2b982696958
MD5 74f15f2c84e69d2411e7b087dfa7d7a3
SHA1 dc5f1645c5b20fa15af01203c3b3f130247a2d68
SHA512 de8059398510fc97cb03c1a811f7b412b8bde29ab8fe7343364505e5d00bf3b69fc95124f586dfc1d0f57002d94318f7be6a8312e5e3b13af19c87b1af1a2aa9
SSDEEP 12288:/Cd9eWYoaLHF3z0z04PDvh8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qTHaLl3z0zD0dCN/j2GLl3iFSE33b9
TLSH
T1BB0502A4B39018F8EC67823EC9658916D271BC694770C64F03E4366B5F377A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b996156f58f071cd40da46c39e636a1bc9b225ffde09cfab3f416418f1f4f257
MD5 4e7650136fd4c4de6fd1f0cd147f61fb
SHA1 ce4c4a33bbf7defb9e51acdbe9bb217fa1dba356
SHA512 94f2745353fee2fc2dbcce8fa8770222aeaa1db804fafebb3549857c937105acd965d19433ce616df839bf827735f4b44e39a93467e5738eaa7a2bde4ff2150f
SSDEEP 24576:tcP4mcvIjkGOxhKP2l71nNKbrh/8KBvdCN/j2GLl3iFSE33b9:SP4m4IpOO67W8K6N/j2U4FH
TLSH
T1E965BE2DABDC0096D0BB817886658A49FAB1742E1F3286CB1160937D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 030208486354798fc1d673a901a431caf1fab5c28b2f3938d5f8c37a4dfa4b5a
MD5 9e856e83af0f73d2822760ba1582c4fe
SHA1 f5518cc637fc32ad278caa82a80294a26fb4072f
SHA512 b64986429776e61bb63ae1073b7c477b414114bd41f91878fb4bc54b2469173f366a92f07f46f044d04d4f48f6c842e8bb87c554408bf7f3f6e8ab116bf1cbe4
SSDEEP 12288:gNsfXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:B3dCN/j2GLl3iFSE33b9
TLSH
T101E40119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 845a911d639d73c0e49538385b19a46f126d154826f072bab961603930efff18
MD5 9391f80fe9d2f8600119da4f2732bd1d
SHA1 605a73e066765318e88974bf0b5f44ec1dd16a5c
SHA512 65773154f14993ef7ca8412cde1d30c7955ada46002b174ba011efecf2cc29a4f49fce9038e108d5bab03279783a62305bf5489515edcf4416d17a3bdc19ffc5
SSDEEP 12288:a3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHk:aXdCN/j2GLl3iFSE33b9
TLSH
T1CDD42364D7E9B656F17F83790369DA216200FEF8EB258487C54157EB2278FE8D832023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0778e3f56181ed5ff37f1d68eb62e16484a053a50855e867e2cb56d61eb91c30
MD5 b75954544e9938f5a4cfcf8da767a6aa
SHA1 30ff848d0aa38b212380a8fc46539eaba416e32b
SHA512 acc456d66b475a9e172d61c7ea45718cd852c7f0498580658e2a5c35d02a55084485512c31bfbf63007813dfe6a220e5f3e9fae4feac2dbbc92b69538f3f0eef
SSDEEP 49152:Za0h2GEkuAe73q3pp46zwwQGN/j2U4FH:Za0hNYG4Jw7j2jF
TLSH
T15885AF1D67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 775829d99ae40cf932a07ee2b1a979894553dd07e48bb19bb7e58c1631d03e8b
MD5 f60a802b7ff5517608fac6b75051ddb6
SHA1 c7c9ad47a58fcc6c40ab87fa705751a28f37551b
SHA512 7feca0ac27167cd0f57c9440e17700d2a36669a6623fa4981b2df6cd6c7ad76e879f6469ad5f1d9ab20ec06ae7a25b1e90740e913fd001a9ab9d59505c0ef2ab
SSDEEP 12288:ZhbHjfXqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZhbHjPWdCN/j2GLl3iFSE33b9
TLSH
T155E4027D66AC21D9F176D27D86958A06D330FCA4572183DF42C182BE1F3BEE84C36A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 43e1504a3bf94abb5e72103ab3d331ad66f1381366d2aed8c6cc3e1b95014fa9
MD5 65aa3cf6a9a73d4e97707d785b91ba84
SHA1 8abbd840bb23de948790d2374b5da07513154983
SHA512 328eb10ff1a81f1a6827b60c76f17f515f92206c91f180e0656c2ff3a54030acae8730b45ab6aff749f21ecf5ad7e9ccef355cc45842cc30bb2c84b57d8755fd
SSDEEP 24576:g3YgnJcRTk4yti+R5dBR/edCN/j2GLl3iFSE33b9:gIgnaTk46pBR/hN/j2U4FH
TLSH
T10145B02DF3B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 cdb96b32fa0c98bae25842cdd0af68623da3129cca4786eb54942ac8eca637a5
MD5 9377f53cb7d3f4a2f91df9815c0fe236
SHA1 f320c616941ef0b46bde01214820a89be73191a9
SHA512 e255e32b9085b07caec0ac2904c0f5ae036fc8a4d7b21ebaa92a1fc0577baa6a9e5828d2b219ffe54f5ee1af4044cb24f2e5cfc7919adc92f99c8044b0b50011
SSDEEP 12288:xzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xLdCN/j2GLl3iFSE33b9
TLSH
T1B7C42364E6A5B659E16BC3BD03A9DF215100FFE8E73245C7819166EB237CFED8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 7dc20fa54c6236d7721f18592823ea68a313872a11aa12d92848f2912f980c5a
MD5 6121a24ff956576bb819ab22cc7d38e6
SHA1 d290747e1236e12e290602cef1242f334c1929dc
SHA512 ff0616e1dc9e881a6e0d78faa6f526d331eea8152f573651e3bbccb51313297072f0a3bde76fc4071e73c02aeefd77a227d535b95a1995bc9e28adc72e3f114b
SSDEEP 12288:LOb9A4LWOsvAYFToJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UpL3UTIdCN/j2GLl3iFSE33b9
TLSH
T12525F154F7A410F9E86BC23CC5A68A16E271B89C1724D7DF03A84BA61F237E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 8a2936e28fd01ce9597b1fddb1c40729f96d3d46e0f2ce80bdc25e8d4e55e0be
MD5 f76a056f6bc86dd1b22821e35c3b1076
SHA1 456e1f6776f717b19b81358a6d5daed1ba146fe2
SHA512 9e3c688337148e9de69a96800d88556e525b96ed3cb78064982eff0ac560da5e2238e19763c873e03f82482cf392c87486ddf345b34d7488d45b81d954f4f9d4
SSDEEP 12288:cpFtpOkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WOMdCN/j2GLl3iFSE33b9
TLSH
T1B8E4022936ED20E5E17A923C86968709D331B8A5572247CF42D081FE1F77FF89C36A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 04e4607a1b440d8a139d5b81552b28009d997b49fd647bd68a1d09a86254249f
MD5 a2ace26de27563f8320cf0c08c4a25ec
SHA1 53b760747c4be4d572fbe2f06675582b388a322c
SHA512 571a15ec8c9f9cd141ed12d9826fb3c81833df6ec225453f26df7c269b1351dea8cc24b45455f208f2808310096c306b13a586c23b8122c6051d614de729c338
SSDEEP 24576:V7NM9YqZqmWMUkPjZM48Mv6bEhsndCN/j2GLl3iFSE33b9:V7cBWMpPjN8DbEh5N/j2U4FH
TLSH
T1AC65AE2E6BEC81E5D477D13DC9E28605F2B1B4611B318ACB5162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 eb46bbaf2ddf7fd264419721c850850c2cd2c920eb6ed794d3585ab349b2e82e
MD5 b5f741aa9d168e0ca8670e81f06720aa
SHA1 8c26ddfd4fa62da253eacbf8f49a6ef4cd0465c7
SHA512 6f978635b528a819a301964fd819e7dfb703c664c68ab2d03c9faf7706bc41620db6b62c4b0eb6333c4136bedab3b5e29c98a7cc58a21a885ff3996183684462
SSDEEP 24576:NW6BApg2YuyuNDYTabvcdvNYf8km19dCN/j2GLl3iFSE33b9:NF2YuHNETovAvNYf8km0N/j2U4FH
TLSH
T1FF858E2927ED80A4E0BBD27D45B6D246FAB2B8551B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 d75a946cfd89f4b05047c442d1d5753f3aab4a7078cf30ad44b3c5dc1eb0316e
MD5 e47f585916c8106ce5f58d7602d0fbab
SHA1 969676b6d6d01bfbf3ec6400d5b21e33c685e39e
SHA512 6e18e0007ae5bc7adb8d7fd245437c5c23570d52d2178dee04be9752a47066e89bdfc94ff6b7d30577f57f1fe7d467440a0b26c9a957f09cb209603dff9e0de3
SSDEEP 24576:zAFs06+Omlf3NXEbTogdCN/j2GLl3iFSE33b9:8Fs060lVXumN/j2U4FH
TLSH
T12D65BF2F62EC00D5D07ED17D8A97C91AF2B1746307255ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 c416294afc79a2259cc5ade10110822b3f6edf447f8a8882f558db93847df677
MD5 9e6d2a4187993d676cd305508de3497b
SHA1 0133610418d612ad013fc41ae4680238a43b83c5
SHA512 5e002fd32536ec380d437f4a3a5bdff5aee74f854b1e6c795035044d012ac91d821b6ef9866c40ac657256471c2e9f81484a1dcf56df5413d9cfec09e86ae59e
SSDEEP 12288:xCJnJ5D3VkrDzxHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IJnJ5D3WXRdCN/j2GLl3iFSE33b9
TLSH
T1D315D02CD2A810E8E4B7C2B4829A5B56FE71387D2F2269C718B4D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 73685841fa6bf9815100a420bd87dcea6ffaa0a835a88c1a6e323e5f4e16f0f8
MD5 09f6a1f9275034d18f47ff5f10d4f68f
SHA1 b6e1f42cd20b9cd7ff4d9ce81129607e48fb8fc0
SHA512 01ffb0d9a8628515b6f787f79359706303e84c8154a973aeff6e4ee13393f7f6540435f89ca2be7e5d7bdafb45c179dc7f809e8a5c5565e652da2e51125b0e2c
SSDEEP 24576:5EPghm6/7IIXdwcXrif7qQncjlP65i3VuedCN/j2GLl3iFSE33b9:+g06DIKdwc+eQnSt65aVAN/j2U4FH
TLSH
T147956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 30eee4311a1de5952856ca6c04fa1e2db919fafb51840f93dfd0aeb136df3a67
MD5 b27b2813f7d734658d14d97e086e483d
SHA1 00bd9ad22f199aa44fb6fffa0c50bd518a6edb21
SHA512 d4e7466577799d408015615ef64e383d1cb6d7bd53c0d47bd267f5c836b8a6b482ebfbc0ba952789f2bcd098a7118909af3d4826e61547123ec8bfcd98245ef5
SSDEEP 12288:HEP3RnBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Mn1dCN/j2GLl3iFSE33b9
TLSH
T1ECE4126D67AC70E9E02AC17D82A18605D331F4B4AB2217DF42D1C2BE4F77EE85D39A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 2b52060b547e1c69592db592dd4eff232d04c3f54a393a458a7e285b3cbcbb56
MD5 cde3c59738d4b84e3a0f486311a72eec
SHA1 84941853b58b7e0be877274b4a076d31bd98b4a0
SHA512 fb346ff598b85b74c61dc5c2401c1b71ffa1477fecd6e394a23e550acadafe81526217943e247c2f5d0fc2209e4b73f1253c075c0c98ba0800f15dd2fc2bce1c
SSDEEP 12288:8jky6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:8IyGdCN/j2GLl3iFSE33b9
TLSH
T1F0F41214A3E4A195E57A427C86B686619A30FC70EF2146CF41C0E77F6F7AFE49831B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 2411c384f83ab93e4923fc1bcffaded163d3b1cde8c78cb623464993b268c4f9
MD5 0daaba5728f66a6e88048138d8a96c91
SHA1 363978f9038a5e48453b6281f01efc2e2c464da4
SHA512 f3b6180054d5080f886ba3e8c5909c3434aacd3433c4815f1300d2cb749abc638edd43747df3d6809d595a2adc219eccaa3510a2c6aa96fa76be4b931a05077e
SSDEEP 12288:Cy0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:L8dCN/j2GLl3iFSE33b9
TLSH
T115D42368A6B5B669F52B837C03789F115210FEF8EB2144CB41D1A6FB5379FE89033452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b7b4a6649fa1b01486496bb031cdf058aa814f3cbeff4b678a9f1f8211e94bc7
MD5 d69bfbece034583a6bf3846cc9a355c3
SHA1 b309eb877d6cbd7a22b339dff9729e1b2bf707f2
SHA512 cbb54c3c048ef47c31ede104117b795f51ed4d0bcc67986212cc6c321de25f9e3facb9d928d09bf20373c21c48ed812563143608c8ee1b3669c5cf7029890d3f
SSDEEP 24576:IQ9MxZKdcz9dw3/dCN/j2GLl3iFSE33b9:IVKZMN/j2U4FH
TLSH
T196558C2DABE9159AE177D27995A250C3A633B4301B31C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 2132998e07c0cb7bf573d8fac81ee1cd9e7573a6cf7236ecf31db6c349489479
MD5 0ace7e7ec31df8bdfef1ab5691b65ec0
SHA1 d1143c5ac77f895cd16608c2ef2522036af24d01
SHA512 61dbb0d995a5e6da05a07542927692dd3d420937afdf68b56f395f043d914e20edd78e2e7829ee3eb2c2cf37093c92b2ffc858c7de268b2ae4ce123a01a2c5cd
SSDEEP 12288:7yoKo2JRple9pmJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7yocDApKdCN/j2GLl3iFSE33b9
TLSH
T1BCF4E01FBBA940A2E076823C89858745E773B0705B2253CB5691C37E4F27AECBD35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 154b798ddfeb0a478e0d9f0e6cfff433dfdf3d53b894883d71085abc9e347406
MD5 13291fd32edd5ae606a1388b04b6b9ba
SHA1 58cba1bffc762558a3d257fd05148bfd49b8991b
SHA512 24c6bb48f1daa296e70ea5ba3766bd4896f4c0bbf4b6da40f02618b790119dc39800b7992f765f8d454e4d9b3abfcf7336c5404683816fe15cfa9501dbe3247f
SSDEEP 49152:6WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKtN/j2U4FH:80zuNI9j2jF
TLSH
T12AA57B3DA2F800A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5bbc4e2b3f179b2be65b9e518c7156662409b40788a8d37b396f44715f148c49
MD5 26abd8a6e04fb8f0011537643d701ba9
SHA1 c1252bd59fe8b5a36085452a57c2425ccdb70bb2
SHA512 ecc0634ddfe6fa04b713729343a9b122a36bcfda5eb6a8d2556424066d280962952af879c4c566522c294526780ed4416f46d91351f3844d039c9a0f946a314e
SSDEEP 24576:s1QT7EcpfxR+N5AWAz3ooiYtjMqb1dCN/j2GLl3iFSE33b9:xTDxR+N5YzTfjMXN/j2U4FH
TLSH
T1C355B02EA7F815E9D17EC5798B23C512FA727861033193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 107672e76b045608948e78aa26f15f406416b24547c3f520b406a8213aa3d0d9
MD5 f2c58eeb40a2c6dc192e16d0aebf2212
SHA1 701cc865095dc97b5dfacb9ace4de2d39f0d7571
SHA512 16e597f618aca9fb1ed0ea659c48045ad6071f76e80aa311880a553272fd55a105ccf4d6089bb4fc3d5bc37162d6bb46593e92c825556c61d24be0810617d0f2
SSDEEP 24576:PTMdOz0FFS+imSLpdCN/j2GLl3iFSE33b9:N0K+imSL+N/j2U4FH
TLSH
T15E15F13EA3AD14E5E47BC27C8653C906E67274A5032166CB06D0C1BA3F5BFE4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 8d6431dd618b5db125d0d3e008abeca0c2e88aa04ef002dcaf5d39785c25b7ea
MD5 7b91baa584a737e64a60afc102f24c96
SHA1 c245b7bf76a744954f1ca1585082661a5ad25b20
SHA512 d0d804fd0c2885d706ee1ae79fe3fc9f06bebc45f95a388d7c1a11a6b13167d7523238f21bef5c19b8bbfc11bf2e814706ac4acb0fe316a1fea99dc7539e1cd1
SSDEEP 12288:c4KoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:aIdCN/j2GLl3iFSE33b9
TLSH
T1CDD4121C63E870E4F4768279877A86159220FCB4A72146EF15D0CAFF5B3ABE8D435B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-290-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/8-97-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/8-91-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/216-293-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/216-104-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/216-109-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/1112-48-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1112-417-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1112-42-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1112-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1272-307-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1668-34-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1668-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1668-35-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1740-312-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1816-11-0x0000000002790000-0x0000000002813000-memory.dmp

Download

memory/1816-8-0x0000000140000000-0x0000000140230000-memory.dmp

Download

memory/1816-9-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1816-19-0x0000000002790000-0x0000000002813000-memory.dmp

Download

memory/1816-284-0x0000000002CE0000-0x0000000002D40000-memory.dmp

Download

memory/1816-291-0x0000000002CE0000-0x0000000002D40000-memory.dmp

Download

memory/1816-300-0x0000000002790000-0x0000000002813000-memory.dmp

Download

memory/1816-310-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1816-321-0x0000000140000000-0x0000000140230000-memory.dmp

Download

memory/1816-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2240-313-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2280-126-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2280-120-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2280-304-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2288-416-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2288-22-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2852-415-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2852-302-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3188-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3188-316-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3188-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3308-451-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-448-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-483-0x0000026237850000-0x0000026237A69000-memory.dmp

Download

memory/3308-459-0x0000026237850000-0x0000026237A69000-memory.dmp

Download

memory/3308-437-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-438-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-439-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-440-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-441-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-442-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-443-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-444-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-445-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-446-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-447-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-449-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-450-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-452-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-427-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-428-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-429-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-430-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-431-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-421-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-422-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-423-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-426-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-425-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-424-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-436-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-435-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-434-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-433-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3308-432-0x00000262357E0000-0x00000262357F0000-memory.dmp

Download

memory/3388-308-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3668-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3668-77-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3760-282-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3844-179-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3844-458-0x000000000D040000-0x000000000D484000-memory.dmp

Download

memory/3844-163-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3844-418-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3844-456-0x000000000F8C0000-0x000000000F8C8000-memory.dmp

Download

memory/3844-314-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3844-196-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3980-131-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3980-305-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3980-137-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4032-144-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4252-306-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4308-296-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4484-315-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4484-81-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4484-87-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4556-303-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4644-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4644-75-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4644-69-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4644-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download