xmrig | e728c58a181dc7171065ff1cc6037b0818c31ade3fe82f3cd746044bb9f38589

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 4.1MB
Sample261024-bswfxaea32
SHA256 e728c58a181dc7171065ff1cc6037b0818c31ade3fe82f3cd746044bb9f38589
MD5 a8d41a377701b6922eb3f13db6ffb6de
SHA1 bb3cb8f1bf7596654a60097133bae619fc8b50aa
SHA512 599461e02f827755753dca7f40f4eaf7726786311edf5078187b347344315f8a00f8bd8170738fe44ce4e352687402cc05858331d517beaaec131f1eb93e2a4d
SSDEEP 98304:mxmysJpbfAcpyFnStKQIcB/ceQgEOmYognlmH6OF+O4pHiigaPJ:OmhprAcikK32EeQvOnlmH6OF+O4xiRax
TLSH
T1CD163348F68AA1E4EE638639DBE08743F3B67C501748D6DA63CA43441FA7BE04D76325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery xmrig miner persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 2860 created 3316	2860	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	56
PID 2200 created 3316	2200	svchost.exe	56
PID 1684 created 3316	1684	svchost.exe	56

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2200-14-0x0000023E24ED0000-0x0000023E252E1000-memory.dmp	xmrig
behavioral1/memory/2200-24-0x0000023E24ED0000-0x0000023E252E1000-memory.dmp	xmrig
behavioral1/memory/2200-25-0x0000023E247E0000-0x0000023E24B37000-memory.dmp	xmrig
behavioral1/memory/2200-49-0x0000023E24ED0000-0x0000023E252E1000-memory.dmp	xmrig
behavioral1/memory/2200-47-0x0000023E24ED0000-0x0000023E252E1000-memory.dmp	xmrig
behavioral1/memory/2200-18-0x0000023E247E0000-0x0000023E24B37000-memory.dmp	xmrig
behavioral1/memory/1684-275-0x00000235817C0000-0x0000023581B17000-memory.dmp	xmrig
behavioral1/memory/1684-274-0x0000023581ED0000-0x00000235822E1000-memory.dmp	xmrig
behavioral1/memory/1684-265-0x0000023581ED0000-0x00000235822E1000-memory.dmp	xmrig
behavioral1/memory/1684-279-0x0000023581ED0000-0x00000235822E1000-memory.dmp	xmrig
behavioral1/memory/1684-293-0x0000023581ED0000-0x00000235822E1000-memory.dmp	xmrig
behavioral1/memory/2596-295-0x00000215E24D0000-0x00000215E28E1000-memory.dmp	xmrig
behavioral1/memory/2596-306-0x00000215E1E30000-0x00000215E2187000-memory.dmp	xmrig
behavioral1/memory/2596-305-0x00000215E24D0000-0x00000215E28E1000-memory.dmp	xmrig
behavioral1/memory/2596-316-0x00000215E24D0000-0x00000215E28E1000-memory.dmp	xmrig
behavioral1/memory/2596-318-0x00000215E24D0000-0x00000215E28E1000-memory.dmp	xmrig
behavioral1/memory/2596-321-0x00000215E24D0000-0x00000215E28E1000-memory.dmp	xmrig
behavioral1/memory/2596-322-0x00000215E24D0000-0x00000215E28E1000-memory.dmp	xmrig
behavioral1/memory/2596-320-0x00000215E24D0000-0x00000215E28E1000-memory.dmp	xmrig
behavioral1/memory/2596-319-0x00000215E24D0000-0x00000215E28E1000-memory.dmp	xmrig

Downloads MZ/PE file 1 IoCs

flow	pid	Process
221	400	240810296.tmp

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MicrosoftEdgeUpdateSvcs23069B5B\ImagePath = "C:\\ProgramData\\a864071ecc989736\\A6E1BB5623069B5B\\A6E1BB5623069B5B.exe"	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Executes dropped EXE 24 IoCs

pid	Process
3372	alg.exe
4204	DiagnosticsHub.StandardCollector.Service.exe
2304	elevation_service.exe
3624	fxssvc.exe
4568	elevation_service.exe
4668	maintenanceservice.exe
4720	OSE.EXE
892	msdtc.exe
1704	PerceptionSimulationService.exe
4012	perfhost.exe
3632	locator.exe
2492	SensorDataService.exe
1384	snmptrap.exe
2868	spectrum.exe
4252	ssh-agent.exe
4240	TieringEngineService.exe
3668	AgentService.exe
2112	vds.exe
3496	vssvc.exe
4408	wbengine.exe
464	WmiApSrv.exe
1068	SearchIndexer.exe
400	240810296.tmp
2060	wnbqiniees.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
220	raw.githubusercontent.com
221	raw.githubusercontent.com

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\671cf705862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\240810296.tmp	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	240810296.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	240810296.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2504dbe5663dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea0fedbe5663dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea0fedbe5663dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b23413bf5663dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066aceabe5663dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000527692be5663dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7dc37be5663dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2860	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
2860	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
4204	DiagnosticsHub.StandardCollector.Service.exe
4204	DiagnosticsHub.StandardCollector.Service.exe
4204	DiagnosticsHub.StandardCollector.Service.exe
4204	DiagnosticsHub.StandardCollector.Service.exe
4204	DiagnosticsHub.StandardCollector.Service.exe
4204	DiagnosticsHub.StandardCollector.Service.exe
2200	svchost.exe
2200	svchost.exe
1684	svchost.exe
1684	svchost.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe
2304	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2860	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2860	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	3624	fxssvc.exe
Token: SeDebugPrivilege	4204	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	2200	svchost.exe
Token: SeTakeOwnershipPrivilege	2304	elevation_service.exe
Token: SeDebugPrivilege	1684	svchost.exe
Token: SeLockMemoryPrivilege	2596	svchost.exe
Token: SeLockMemoryPrivilege	2596	svchost.exe
Token: SeRestorePrivilege	4240	TieringEngineService.exe
Token: SeManageVolumePrivilege	4240	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3668	AgentService.exe
Token: SeBackupPrivilege	3496	vssvc.exe
Token: SeRestorePrivilege	3496	vssvc.exe
Token: SeAuditPrivilege	3496	vssvc.exe
Token: SeBackupPrivilege	4408	wbengine.exe
Token: SeRestorePrivilege	4408	wbengine.exe
Token: SeSecurityPrivilege	4408	wbengine.exe
Token: 33	1068	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeDebugPrivilege	2304	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2200	2860	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	84
PID 2860 wrote to memory of 2200	2860	2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe	84
PID 2200 wrote to memory of 1684	2200	svchost.exe	103
PID 2200 wrote to memory of 1684	2200	svchost.exe	103
PID 1684 wrote to memory of 2596	1684	svchost.exe	104
PID 1684 wrote to memory of 2596	1684	svchost.exe	104
PID 1068 wrote to memory of 3972	1068	SearchIndexer.exe	122
PID 1068 wrote to memory of 3536	1068	SearchIndexer.exe	123
PID 4204 wrote to memory of 400	4204	DiagnosticsHub.StandardCollector.Service.exe	124
PID 400 wrote to memory of 2060	400	240810296.tmp	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3316
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_a8d41a377701b6922eb3f13db6ffb6de_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Sets service image path in registry
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2860
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2200
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1684
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2596

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3372

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\system32\config\systemprofile\AppData\Roaming\240810296.tmp
  "C:\Windows\system32\config\systemprofile\AppData\Roaming\240810296.tmp"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\TEMP\wnbqiniees.exe
    "C:\Windows\TEMP\wnbqiniees.exe"
    3⤵
    - Executes dropped EXE
    PID:2060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:892

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1704

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4012

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3632

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2492

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1384

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2868

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3528

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3972
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Direct Volume Access

T1006

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fbf1444ce143972b7ff5114ca45447a2be02f473f5227bc64d1e0b7759201fee
MD5 874deb728d8f364f3635c1d9373049ac
SHA1 573d04ce7ae9f6c9e1cfb10feaddea033b68bc03
SHA512 0e614125c5811ab71cc96a6195d1e2fd53243b19b519dff441a08c7468e14207dca0a9668ca0a0e0f7307c3bcacff74f4bcb7e7f02c3b8ac6933d87cb3834ec9
SSDEEP 49152:Kb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnS+tgauhwbR3P8wT8:83q6mjBogaPJ
TLSH
T130D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 6a843b2fe4ea5c53c15829d17a06d923c3d60b9cbfbc2c4246b4cc43851e1bef
MD5 806e7bb2b2e0fa09b504843807aca292
SHA1 ad90a58c1d61c299549569d46cc8f970766e6d28
SHA512 ea757257826490044fb96cc5cf3d4ce66a2d572f02a63fbe33c22aa40e344040da9d55e2b0b548ab381e5db9cbdabddb9016d08c205ed1525bfa29811e397d5e
SSDEEP 24576:bXYfDtczAR+4ZAgayjhwbmY3MaReFeDvSP3b:+tco+tgauhwbR3P8wT8
TLSH
T10585F128B3D408F9DD67823CCDA28511E673BC9547A0E78B03E4AA654F736D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 459308022ad8bc3ad2de1544fd17591f52594ee11bc2c14b6a9489f521917ae7
MD5 e9b47ec096dd3e88c98959f5ef79366b
SHA1 fe02f5b58ddce763e770b83dda0bac3ea8b5b881
SHA512 959e98c0029bfb1006b88e619d103eaea0f2dd4a9a8502db7075c88fcf6c12187f4196ba05962b6d5bbca5d60375614880d4e259a60c743e24aad6a2aa80f7a5
SSDEEP 24576:i0Le5ji0hmxhrMq+4ZAgayjhwbmY3MaReFeDvSP3b:iPji0Azj+tgauhwbR3P8wT8
TLSH
T10A95AE16F6788335D073C0B9C5D2A69AED7134821B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 55f4bc1dada5c75c441ccc07e9245363a773138f183b7197017d7af46d1b5e9e
MD5 f388b045f8e99ebdfa9c76078aaebfab
SHA1 e42517645eab51006c3e716e8eae1d93e33d6eb3
SHA512 fe90f2ba4341515f40d1c8bb5cc54f1ea785bff763be9ea1709c24af5b8b7248a4e63cfd6c629eb893f11675e8a9b2661604f02a069a2d0a84b6f493b395e099
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWj6q8wyu4+4ZAgayjhwbmY3MaReFeDvSP3b:m/ezSC6vUzPv+Hjyf+tgauhwbR3P8wT8
TLSH
T1D7756C15F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 791620e8f6f4ea75b38c4647844f24588f25b938f8cb62583fa76fddb4aca7a0
MD5 fb5212314339a88eaf55dce46022998a
SHA1 9cc0a17267a60a435dff7130457b601d19d0811e
SHA512 7c0ea5b4cd5972464e74993407173fcfafdbe3e79aafb45ae659a018a440c6a6d80b3ec23bdf7aceb6448f3dc51bf259185b2ed60dc35ce8120998d3feea7f0a
SSDEEP 24576:dVbqPb88hv/l+BV+4ZAgayjhwbmY3MaReFeDvSP3b:dVO88hXl+D+tgauhwbR3P8wT8
TLSH
T116559E66F5748331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E77BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c7c622aa1a754ee39e21aa2d05c88c3dd2d0d6a4381145a016233990d412062d
MD5 81a860a6cd209b20f4b86da613949c28
SHA1 80d31ab042a87c724faeab5e4bd54cc619dc2ed6
SHA512 6de40ce1bf261e5c93d5383cd5380b5ef1669a6e9962f3d3cb4e96819c49f76b019d956ec4f9be21226e3304bea62d954ec0bde33d9ae24ef20f4acadfaa80ba
SSDEEP 12288:wGHeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:wG++4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T14A652381D34C98CACB7B0B348B7A0D706699AFC52D85A504E5C97BC9CCF0DADC6B2395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 c308b50114fe6f1cdcafc7189ec8409bc2d83abd409e871a88f1dcddf6e156a6
MD5 d93b15c881dae49909aaffeab096d686
SHA1 4e32483d57491306f3633109fbe55140a6c11759
SHA512 1729c5099e67cd4d7648ee8fbd5be23e2383bff6038e4433989c9655a25cf7f009466b6e1f7a29c7dab778d1115ca313d90099e3b18772d0d3fc92eb74ed8f61
SSDEEP 12288:NeBNUbTVO86UMeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bw:NJIUN+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1D885CF7BEE28FCD2C27E4DB85B918600A76278704F52A3CBD165830EDE235E54E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ecca728617f46ed8ebd53f311233784e6c66f3ebd082eba3dd245f805ddcd6ed
MD5 0bdcc6a5e93f03232bbee3fa2dcf04be
SHA1 f6e39ec5b061c8d237ff25b6f56f6be3d4304d13
SHA512 c31d77bf4a0188cca4ab795077f5828652c0da2e33226125cc18b0ae786e0b6d6ec8aa49e3bb8ec4bbe8917fcec3d4fddab83ba41fba32fc1e2044f1dcb3f857
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THn:VQvGAdlCEL8c/WRNw5CrgaPJ
TLSH
T10F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 9058d02537278f3e88480c954304dc078d6c5345ef9cd81512438e22db8085e7
MD5 bd6839911958d7256a969f58f410f80b
SHA1 4a6cc5d8e7213a04870500d5bb6d5ace2a930c80
SHA512 e0220762a97e381d53335730b4ffd41d0c6ef2036f00871c5877b2fe851179dbafb6bbcfbd35aeb710cad192e90dfd53a10e56a9c629b46595564628c162d64e
SSDEEP 24576:gfewsAjz+4ZAgayjhwbmY3MaReFeDvSP3b:Kljz+tgauhwbR3P8wT8
TLSH
T11C85E031FA74E436C27B0DB21B36C712146DBE604F511AC3E3E89E9E99706D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2c1e8bd7d72dcfc54a81ca85549fbeda807ab85c416d5b47babd7d41d4bce422
MD5 53806267c0868a08deb7ec79a329cfac
SHA1 c9051416dc4d8bb18d869948878a18c7b296992f
SHA512 04f1f708ae87ab42d03616512ac0aa2057665a0495720139f33b970a6fee9a3f5179b0f04df35534c4dc19b41ae0ac79b2805e8b50861e7593647c86989a6143
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHFax:GUEtQevvqc2W1cpV20I32m
TLSH
T182474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c82b7bb54adbc01357b2e7c35c163cb003070eb4ca80126f969fc1a8f12f6b10
MD5 a131ffa50581cfef5fe742d9ed5c0574
SHA1 1a65281a5115262315c87d8c3f2a162e924ba688
SHA512 358d5bbd481ec7bc88242321e8e9a11e343aefb2f77544dc93e3ca4b7a115fcb94b0618e71f6629af844a5b81ccbb9d92f12006adb437728d6c403a492335ad9
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/zT+tgauhwbR3P8wT8:WoqtVjnmXgaPJ
TLSH
T1EDD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 32eef1b414da6051a43c048545f2f20904c5caf8867f4ccb52e2434ac25289f6
MD5 075b5a5a23015cf6301abbb84c253ce0
SHA1 7e2d6ffaae3dd0f5320375b6e74e80152af93f37
SHA512 ad2b9cdac0d45e038ad9c74282dd2170f7e99f196092e509c8e410eaecf165ad17517a5ec6eb4d5290eb14157334fb9971f74dd5127dddf27637af0d6e80b30b
SSDEEP 24576:rAhGL6IFoiwtA5l7S53U+4ZAgayjhwbmY3MaReFeDvSP3b:rAM5Foiq5E+tgauhwbR3P8wT8
TLSH
T18D359D80E7F955D4F5B3AA789AB68570EA76BCA65E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d209ec49ecc109a40b309a6a4ce099efe09ab45cffb53b48e990a01fd070c49d
MD5 57be66a1a0ee1992a8228fa1836d0fa3
SHA1 aa99b21bf4f89e1d7e3a9840feb99c1ab2d8402d
SHA512 4c8d6c134ffbc4f26b2baba083d64b2dd012d9d71652f2ed2c2a3e8e01d38e9ed9619bc8ad1d3bcd5a423ca17741c3b780519b70c68fd1d0860730301de9e56c
SSDEEP 24576:8wuROW/+4ZAgayjhwbmY3MaReFeDvSP3b:8wSOw+tgauhwbR3P8wT8
TLSH
T1B085F14673A80CF9E9674238C6578532F7F2BC022A21DB1F57A0C75B5F73661AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 90502a9dec27421bb4821f694ab0a82cec6a5ef9d4731bc4d7cb41afaba6e04d
MD5 c053839f418a53e95053e78b35d21e16
SHA1 3feb23d9dc98f7982e981c76d7e96e6fc6c08145
SHA512 f89c73fc722a310e2a44c6699138e75a0488c4439c69aec414970f9e309006bd93c4a60fdb37962e790ecc66fd0aaad6e5b1bdfe466629b9cda76450b593c27f
SSDEEP 12288:syZ1Iy+eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:RZui+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T167751285339860F9D1A70338CEF60A10E7B2BC922B7243CF9595679A5FB2ED54E35321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1fab3293bf8f85e83dadf3031bd729949411e9ad2bccaf380fb4bebf93cbaa3e
MD5 16ef354ef9e244aa85b0e7c49a581130
SHA1 f4d6130a50f0b5f031fe6d47d2f735cd761f194c
SHA512 d8c5c6d3ce5198dbd707a96a8e46fabc47f3d822ed5473956619515d577c3d0066958e19c78f7542b25c90bd269eeb7f0eb78dc3019f22285f2d41dc75b8733a
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ur:CQRQyi36YOcPDLvw2gAf+PN3cgaPJ
TLSH
T131667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bbda5a239a9595b851aa8c598e5610e33721df5a1b18c447df8efb0ac50dff7e
MD5 8d22540bb9a338be838a06d85e9b07ad
SHA1 ed4b4e702e90f0aed26a47cd76974151752e6bb8
SHA512 ea26a456a16e41f20b4cd1fff5fa8860f23b2768147e5f2c35826646982bc848ceb6b1a6d7e86a08e54d56a5118a2884abdc1bece4edc44aa6b79dd86ed04e23
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ur:TQRQyi36YOcPDLvw2gAf+PN3cgaPJ
TLSH
T1E7667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2ff551af8ba05e681ee2d81092be131f15a66425edd85a77fe8201068ca1bd3d
MD5 898e32036cfe391082bc9528258837fb
SHA1 640108be5b458cf80653336b5ff0299fd7e8e322
SHA512 cd314a394fc1c4e88d43294519014fd9550a1c3f7096c92b0e3f666f0400fc53f2eb654027623ae8414974404efeb66f16fb745a368691509fe4df31ac4df251
SSDEEP 49152:b68Qg55nhkeWu7PNU3/j+tgauhwbR3P8wT8:lthTRc/2gaPJ
TLSH
T1DBB54933B2F60099C44DE1769F4A873196D27C758FE0E3DB8545720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e49cef628fc4025027282ee2aea5bbfe60e7f8ab7c733f83c04b3788ff1045bd
MD5 021fe6b68054308de7e6dd7c7b5f5452
SHA1 b92b9aaf4b237c7459618964336f3249002ab36c
SHA512 b4c468e75a2be9f6fe426010dc89f1016dbd092ba1e7f3e2be331d0f6757a7cd8e41a249fc75e01114e34047e698c5021d0555450a2ad91514cfb0e3d4b4b4c6
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk999:Dy5112gYy5azzVvU69nLKnhZRgaPJ
TLSH
T1D4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6787db0910ba4502ec69e3f49a394bd1ef6b9ec2c687e8ed0a2f84e00376830b
MD5 f1ccf9439253a087c5db95ae5eba9daf
SHA1 b2d3ca852098aa2efc421c33abe1f05362710b16
SHA512 200ab76a65516b0b5a075b0c58895daba77834bcee691a292e493a5451c8458cb0ba4a973061960eaf0a4728e04202508467dda32230fc1db9bb299867957698
SSDEEP 49152:tB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glB+tgauhwbR3P8wT8:zu6JmIxd2dkgaPJ
TLSH
T138D59D13F1DA01E8D06ED578874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7529b1c1858dd4f63f2c8ea36bbb2c5faad9d68ef0af64798f6a25884eb12f39
MD5 622f80f7c9f9d179aef0daf9b600888b
SHA1 b6737a248b5dcf892b6de8b7e35f13deb1db1761
SHA512 32791e52f78555af0409a781e23981028124c132d8678b1734f183e48d3888602c1e777a42043688122c0404efd54c1ed63e1b7dea3c89623575de73370e86f3
SSDEEP 49152:K1hpsNoJpF1A67U44CwH7R4xt+tgauhwbR3P8wT8:KmifPqRXgaPJ
TLSH
T1D9B5BE13F2D800E8D06ED17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f608b4d4db9b431c19b28ce0bf2eec16d789ff7070dbb5b77b3c080fb6419c1d
MD5 18b47e3a9782ec94eb3199a55895e2d4
SHA1 0e70d7d968afbfaa8c1b735e08661ba30e08cd20
SHA512 a894a3c0d666daf26db71ea1be88047b95946e070ae77bbbbacb7a84e8bff7a7a82d21a0064c914ccaa708d0d6df6571d1ba858313680ef66745c8ffa74a15e9
SSDEEP 49152:dSuZQIY0Be2KkRVtOnks6NMHqi+tgauhwbR3P8wT8:z5dKqi61lgaPJ
TLSH
T179C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 85e16506d68b09cfec414017da279381269bbc694d0514cd5abc49f4c637c8e0
MD5 8cad934be1815924e24f59a63bbc6943
SHA1 282b015c6f5cf18f2bbad40070826c2aa6b5dd88
SHA512 c3cf56d255ca24c8bc63dea459bc86efb05149960cc03161cf5c01e095b7b3f5bebd3f49c50cc4b704ebd9ff6b27468265df51a0c2a770e682a3cfd5838940c0
SSDEEP 49152:1htSn8EApI0figjgiDn0AP5wR+tgauhwbR3P8wT8:EX2iWphDgaPJ
TLSH
T18B95BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 be483c032dc90aa7308f6aa531ae4e9d3c3c4d7fae06ddc2b6b177cd1fb4a234
MD5 41d0f17ac936438ce2a2acbd6e0f03bb
SHA1 c95514d23f8528df039cb8b8289918248f2d89e6
SHA512 e8ef7b335d77b9444d6768cd2aa1c364fb312b9b735babc05baa7730ea258765f6213dae8cb5f17f74824d3f96b65f351671e1cb122996a945d897a17a4cccec
SSDEEP 12288:EfeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:EW+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T18C652381D24C88CEC62B07758B6A09606699AFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 0c3855260e81fe205a939ada5687398ad272b5c1e429b5831b95b9ac6a944473
MD5 9bc76943749248ae4a7f141fb04b3a8e
SHA1 d315bac2377284bc34725d0b0cc79d32f32262cb
SHA512 e0d9a2d551f767128ff4801406d7874f3bcbd4a99d6713bfaf7e8d80e584bffe393ff30881f8d62e75e3a27398113a0dde48072d0b870cd3fc9021566b9fcdbe
SSDEEP 12288:LyeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:LH+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T17A652381E24C88CEC62B07758B6A0960A699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 1826bb46a54e0e232792eaac4b861a9f2b05f13a6eeb6c362536cf16fe5cfc13
MD5 86fb3d9f07255ff0dddcd2a2fd53e1f1
SHA1 af1c1e1da51d6e0d60c25238a846545ea22608e1
SHA512 45fc85a948d21141413d6477177ed577d68fc28f0137958cd3f2b8ec1b131606a496f0f98ead61f13dbd1290fe45b9b9946f4f12280519ceba4077bfb67e2dcb
SSDEEP 12288:SEeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:SF+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T173652380D24C88CEC56B07758B6B0A60A699AFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 65d31effa287b8f340130e67dee8564c4b6c58a512c08d5b77dcfa199ea64a5f
MD5 ab4126eed9c33b76b49f7347a12c6a5a
SHA1 d920898a782162ec6b784e5cad98cde8ca839a32
SHA512 47da5b8f52e3f382511237077e27e6a860e0dd3c1401f98ff87921bf9bab4d9a0b8c3ec222520fc5e2b66a27a10ca813358df729edcc6b7c2544d5896e10069d
SSDEEP 12288:ZVpeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:A+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1D9652341A35C44CAC97B4734CB760520E3E9BED66F62624FEA853B854DF0FE88A70794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 37948e5ff427b5362267b135fcbc8a3c86d91f48e21784b7a3bf0e0b1e3ad61f
MD5 6efa55fa7fcee94a37038c67a409607c
SHA1 3a3261e11faf682f203558fa6892d8f84ab4cc1e
SHA512 e2bd2080149369eba20200a4219f9ae57c79e956561da57adc46fc330189feae4ec5fdce8f1240935e7c7de483353b4f408c566a6bf3c1db9135f8c81cc6a673
SSDEEP 12288:eReH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:e8+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T16A652381E24C88CEC52B07758B6A0A606699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 336663bddbdf6914e1a16f0bd08822a75244f4310e1b817260c1d175d3591e86
MD5 ce2ae5228957f1de0e96eed9ae6a100e
SHA1 211d5edf6516b76bda346693d2c49200e796ee9e
SHA512 2b5ab37ecd7343a6524ebe345d468b7155e1e63e7c3b2d57d9506b613fef93c652b399c49667ebf1f835ef3e2bf4a40a0a955befc86a8e319ed58b3b8cfa27a4
SSDEEP 12288:rGeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:rr+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T12A652381E24C88CEC62B07758B6A0960A699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 8268fb3126b91c232f52a8645b9e973317ffe2c8db8ab426f7380fc0f76fe60b
MD5 9323571b1a08de59b681e41f47a88f27
SHA1 f72a5c5cef084d2d3b6bacb5232de7d740d4457c
SHA512 f4f7b8f35c566f2b759490c7dab7709a8cbc5bb7a6cae22ce2c2f047cceb9a357fa7bd57984c762a4b71e21b2958339b4dbd39ac6ad4884ea61ac15645a15bfe
SSDEEP 12288:B6eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Bv+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1AB652381D24C88CEC62B07758B6A0970A699AFC73E866144F9CD7785CDF0DBD46A13E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 e9dcbbce64f4090bf6cb7152d725c8ec6f59949fa3a308b9821b0dc9ae2ee965
MD5 ae6141cf66126686c2c950059d5c5c57
SHA1 5c08426161f19ee9b4f7dacd5b2373ac7cb11404
SHA512 14bfc5a571bf5e09a04530dfb07211a5129b4ba2d9c136c1277c3563680f8e143fa8d9a95819203b22841459191de70763804f291c69e664f1ac9c8b64cf5719
SSDEEP 24576:sZM3zFVSOn+4ZAgayjhwbmY3MaReFeDvSP3b:sZM3zf7+tgauhwbR3P8wT8
TLSH
T17C850194B39418F8DC67423ECE264911D6B2BC5A0B60C60F53E837665F737A10D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b12b2b904758ce730db6398a731a35a497882fbfbfd45032c809390e4e39be1d
MD5 b62c3fabd03e10d2f499af66cfb90ebf
SHA1 ce6086e32367d7bf23362f8149f0a9e22346fc43
SHA512 74e618719c47b4473fd6a6ba4d6ca0aded07f3d13ac6e3f95fa35dc8bde064933c5cc334f994e9d1ac6cba6beefe8c8ec39a6a6d3ac241b784d472805d98266d
SSDEEP 12288:gbeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMTd:gy+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T15E652381D24C88CEC62B07758B6A0960669DAFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 125fc48f231a4a98e2ddf8eddbfa914342495de46965229d966b08cf45012d8e
MD5 f9b086a37fb9bc83031048b70726bcc4
SHA1 6574e186467f2b288548f6b7f8ee09d5fce42716
SHA512 dbc403ee9634a5e3f8161f9fba78c51e894272681d0b8e72180d0741dd52ac20878d5a103619aa210fc8b9f48917bc71a7f3651c77212983d80c9a0c56f90f17
SSDEEP 12288:Y3eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMTd:YO+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T109652381E24C88CEC62B07758B6A0960669DAFC73E866144F9CE7785CDF0DFD46A13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2326fd249637c2f627345dfe391d299d818215b2e92f46b3b0a1e9de2f2532ea
MD5 ec77cce09033efbb6d3ca3122e658c0e
SHA1 f782a33e322fdba0ea42792da15ccef76a9a4f6e
SHA512 eb372b394200906cc2590c23f5431652bec08b6287d64781a7ddb0cef5f231b18e942c5b3e9c5ff2564ab343a61df1bdaa9a7f9c17b74728a2f652bb8aa4b591
SSDEEP 12288:GyPz5L8+eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:7zyD+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T14F75124773A430FDC1374238CA620A11F776BC721B609A9F979417765E73AE48E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 dc677f9c6589b3f6136847452eb4633c702ee3d3bb70b844b61217536e58c64b
MD5 90b8cdea57868ff1ec7fd48aeb5b81e5
SHA1 d2dd40c3a78e7d89f8e224b13c213f38e27e6e3e
SHA512 e7cd1856bdf40cbab9de35c7641c4b54d1e02afe5593e62297495982074467ac6caf70b61d01796f444f8782da73ec3c0f70d3c4493f4d1facae9d246f260352
SSDEEP 12288:sbeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:sy+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1E3652381D24C88CEC62B07758B6A0960A69DAFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 68fbc153e9d3de20e7a6390d66e67bd9dafa4d079f22b50e9fc44befbdad3870
MD5 6263d519d94b82973fd41d2c46bffef7
SHA1 d9fbde803df2d42a1b7af959dadcd01087368e69
SHA512 0fe3ec83e20f2d69204848e3b0cdf805341b8e3d55251f255563868123ff2fc6bdf0e3ece1e3b33aa45aa504b27c8ab598ff3a7bd037acca1457f961c393f35e
SSDEEP 12288:BbeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:By+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1D9652381E24C88CEC62B07758B6A0960669DAFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 5461d66092b86a6b46f22e6104028e786e1e0dc5092f647ade0a983f96575f17
MD5 9f397526593ef41757e4c2c0193ca8ad
SHA1 c6587ad853da7e1955361129676b21ca8af0f4a3
SHA512 8712ed591fee3a3724cde7876945912c3673bdc88c4d7d967ae156dc9d2b1dfbd27683cd4560f3f1b7a298bfa807ef3b4e4131964d457fcfc18742486ca8bea2
SSDEEP 12288:RyPz5L8+eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:AzyD+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1D775124773A430FDC1374238CA620A11F776BC721B219A9F979417765E73AE48E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 230bd54755edad53847db2584373ba7806141cc53666ef2f587559c5f67359cf
MD5 a18957553d572f700a11eeb04857a3b3
SHA1 400d11e762296dcc1f96c4cbf618c3aa8ee6e32b
SHA512 7351330617065945910f7eb8d72dc612855933688404090ff3cab7ba204f1ff799ea4209fdda52eb99b0599a042e304171a1534f28d05b1ee8a19d2e7e7a70bc
SSDEEP 24576:lT8aLl3z0zD1+4ZAgayjhwbmY3MaReFeDvSP3b:lT7Llj4+tgauhwbR3P8wT8
TLSH
T154850194B35018F8DC67423ECE664912D2B2BC5A0B60C61F53E8376A5F737A10D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 d882e48240ae30b7dd2e6aab157e6219c0838655c3b232aee935769b62b44216
MD5 71610624234816084873ff55593cbb67
SHA1 586835cc2bcd32eccc9cf90283316f4b4f4a8404
SHA512 160e5b82e6ea0686cc1fc91c2ec8a6fde6be0553e3b5d0db6b50d0acab7bcc9794577855c31bcf36a8c300171343961f4c9b6d6af874755f47311cfc2216cec3
SSDEEP 24576:03rd9CHKy7GZJ+4ZAgayjhwbmY3MaReFeDvSP3b:+rd9CHKya7+tgauhwbR3P8wT8
TLSH
T1E195CF90F3E414E8F0B78A35CD764511DAB67C9A1B61DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 699d63709fc5daaad6db9a1b9dafeb8c72368a296eaed160818c7964eb7bea25
MD5 f2b92f77a98882adb7f7208037b09bb2
SHA1 372db0b25b82ff2e274fbca810c6a5633cc42ba8
SHA512 07af1ded5e7792b6af061ff51fac18fb841782866f8dd910e4f195d071fc319220ec102415fd71e67a1516f5935fc8fa061463e03853f3fc4c09a0ec6d53a4e1
SSDEEP 12288:/keH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:/l+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T135652381D24C88CEC52B07758B6A0A606699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f33ed4766498c17aa764cedad6b0c8bf067c980342b7a2b22a256a68155b06db
MD5 a7a258a1f16226713ae695e4ddf0a1a7
SHA1 07d83e6364739dced41933fc8b7cd4f86e809fe1
SHA512 d6780309405c0a4295e16b98327961c1a0e56fd7ba13dcade545296c443741295a8d9b6b99db9d0ee5279c477a3d26a4a1159778023f8f9f3e0d2670a8189ae7
SSDEEP 12288:reeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:rj+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T18C652380D25C88CEC52B07758B6B0A606699BFC73E866144F9CE7785CDF0DED86B1398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 3652be08087eae285ebc1ec276c7106abe4122e0fe0e9809088f1443e9cddfc3
MD5 7292e45313f7f8f174e53a286601718a
SHA1 898d4b747bcc602bc8973575558fbb338ce10204
SHA512 a444fdfaa92fe79370f11553c69d4804c3a9a59d72c641f84d77f874c11863acf453e34b790256e5d167d5d8ecde8f937ac329c6c5b0b250f2f32108312f3c3b
SSDEEP 12288:FleH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Fg+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T179652381E24C88CEC52B07758B6A0A606699BFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 865877a1d77882f0f899b6afddc8ad052c0fb51bd8887ec6267bd0bad4fbde60
MD5 76368921e544eeccacb1a82fff67b6d9
SHA1 d111a5d7fbc3e40185e1bc9862e13d5cf0d6e6d2
SHA512 28c6236caaf21b68e178dfa552dfe5cb909d66764073788b76dc6813bd984d8991b2ba133c207e676cf112e36693311b33073c0821ed9e34e852586c484e9dee
SSDEEP 12288:PpsfreH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:gi+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T10575F149D29801D8C06E1279CB564A40B3777C6657E2D3CBA6C0F67E0FB1AD48EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 869d0bd625d6db5222fa3736e0a91c06aa1b1ab998766b728841692c5e3c70b1
MD5 e94c7e7c7e2c34b621bf2442e1d42df5
SHA1 45a0ffc93b3a36955f730d4753f2130e7c806413
SHA512 2bcae129de215a409df89bb5ff9c7a305d4df55aa0e776434f257f66ee3b39093114e7924557f6547643a64530c15908cdc19b2b89ec7840e0c28d0dc8ff672f
SSDEEP 12288:B/eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:B2+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1E0652351D34C888EC57B0B308B7A4930765EBFA62F41A14AF58977898CF0DF98EB1359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 523b9e825eeacc97739bc0d25e09741181773c88c79c4a2ab9fb57df3e2db2ae
MD5 7d63b6667c8977175dd0b169e24e1271
SHA1 cba6a424de1228f4e60c9277d5bad78e23024c9f
SHA512 8630970ecc83a07f08008f1a91659f0c5a2498539d189978fd9330dda4bbf81390576bb0e3bcbcd5d924bfaaf0da69498e1b377bec40ec674270e20d26944191
SSDEEP 49152:ka0h2GEkuAe73q3pp46zwwQs+tgauhwbR3P8wT8:ka0hNYG4JwqgaPJ
TLSH
T17D85AF1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 bd39062c2e217014b44b48d8f05f074cb806030467dda956132f36daaf95e104
MD5 a21e4361b9610cc0c32d61ff1c6f24cd
SHA1 facbf274f6fa94b1c065d646b39b3a7982d92d85
SHA512 e747c8931776aab7bcd4128ed8e057b806f5eb8decd90c9974c530fd3947ebd8d15757b81a76d6a02c61a47d64b5ae6ec61efe3121078ecaf06cc0e92023c63c
SSDEEP 24576:VhbHjP7+4ZAgayjhwbmY3MaReFeDvSP3b:VhbHjz+tgauhwbR3P8wT8
TLSH
T1537512BD52AC20C9E176927C87664502D371BC661B12A3DFA2C193BE4F73EE84D35B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 47d3c081aaa88c9378500b8529ac39a0dea238b1fd67b6ae388627c3356667ca
MD5 f20fbb91db37dc5da29e8e9cd185ec3d
SHA1 ddc72f0f91a8f4f234121b155a10225a6c337b3a
SHA512 3fbc539dcb82d0ac12137cc397a4a844fe4a38f2603d8dd906c55927a68dfdace1baeb6f6e7126a73c1981e25c20cbd110c4de39120637e73e7fdd6f1c910eac
SSDEEP 24576:j3YgnJcRTk4yti+R5dBR/j+4ZAgayjhwbmY3MaReFeDvSP3b:jIgnaTk46pBR/j+tgauhwbR3P8wT8
TLSH
T18845BF2DF2B910B9C8AAD236450147B5FB71782D1F209ACB0174C638AF16EE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 70e8a8ab0bf2af62032003c968b02837c25ad218b8a48489e48ba53099d821a8
MD5 3f127772f37c7a3179497b9b9a7d0913
SHA1 4df06ae49b69e0c378a9fcab16225428b883c4c7
SHA512 c8dca7d3517bc722bd87c6e88a53f3a48844715a3ee2a0cf8d49be460419449173a1fa0977039ea16029d8b5872419a1d0fab461112c64af17a8b3f4dbfd2967
SSDEEP 12288:zbeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:zy+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1C4652380D20C98CEC57B07748B6B0A206699BF862F5662C6F4CD77958DF0DFD8AB1394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 227000c224e2a13d119526912b0f93174d9d346965338894adb84e77e9b99616
MD5 0380e8fcd215114cd8cbe7d22e26f61e
SHA1 658ad0cbfde171b81215aa58d159e144acd991cf
SHA512 024c535fe55ab5fb9cc63478cb6a37cb5ba17b1e667543cfb9d77a598683acf2df167f264b72f3fc257d4b957320f59c17b2ed14487a87fe41c894d991cf1e3a
SSDEEP 24576:5AL3UTp+4ZAgayjhwbmY3MaReFeDvSP3b:5AL3UF+tgauhwbR3P8wT8
TLSH
T13D950154E79400F9D97B823CCA668A12E2B2B89D0760E7DF43A84B651F737E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6c44729651a5acfcd4fd177121e2f76a24ed7a12b8e9b7cc96c3e03f62a6606b
MD5 a4c58c83d6f1546c080dd7bf390d00b1
SHA1 7a08f7dba05e8f1a069e185632ad678d6f905454
SHA512 67b507a3bc3016b97f959264b0460e9bb1fb0f8a8a807af9a5874546c88ce67b95bec003dc57483c4acf74f6ddc6111790e9a86ba56f32e301b8969086d25be9
SSDEEP 12288:zpFtvOkeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:tOl+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1E0750219329C10D9D57A523C8B974205E3B1BCA61B1253DF86D092BE4FB3EF89C36B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2955304904821ff89d1a053ac782c04b9a870b967486bea59026cafa74167c49
MD5 6951a84d521dade8918de940866155c9
SHA1 408c6ef8effd2ac5a0694c75f0b0f24b7dfcf37a
SHA512 7f094b2aa635ac181bdfa6be25bdb3562f0ef6aea7c70ce60e9a7603a4245ca7b567aa3021202d3eea7a35126f755699918dcfd877e2f782d267e12d16b9ccdd
SSDEEP 24576:t7NM9YqZqmWMUkPjZM48Mv6bEhsm+4ZAgayjhwbmY3MaReFeDvSP3b:t7cBWMpPjN8DbEhD+tgauhwbR3P8wT8
TLSH
T18265AE2E6BAC81D5D477D13DC9A28205F6F2B8611B318ACF5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ca70e4d956552f431e23b83f0afd6eaf8865f85255482edb60285c9a39f81105
MD5 b1b9f64742b4c74ea064d9da923febcc
SHA1 95aad52f4c87ff815a16d08afdddbf398624ac35
SHA512 0095d7116b8d2cc6c48b595a5d7a715c34f1ed3dde26f8a3951abe24589629f620a05335fce01e05d99f2288dbeb98bad9c330f530d70d1013e67c7f4b9828f9
SSDEEP 49152:lF2YuHNETovAvNYf8kmG+tgauhwbR3P8wT8:A6BCf8kIgaPJ
TLSH
T187858E2927ED80A4E0BBD27D45B79246FAB2BC511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8d2f41ebd2b6461f80baccb7f1dd1da1f81ad476155e513158ed87f597d14ee2
MD5 7fe32438b09456f1d8cb6af07ced36ed
SHA1 d4f98135e0630e90096b7535c4f71d0c264328c5
SHA512 b743bc6f026448d2e2c536bec838b721d007eb52efd0b330dd5cdc832bae15dd6665f5679f1426f6ac060e112e088759ca4709823b94c07b238161944278d832
SSDEEP 24576:LAFs06+Omlf8NXEbToR+4ZAgayjhwbmY3MaReFeDvSP3b:EFs060loXuM+tgauhwbR3P8wT8
TLSH
T18165BF2F62AC00D5D07ED17D8A97C916F6B1786307256ACB0160867E7F6BEF81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 c27fbc9533cea3ec231d9e227e3634fd934273ed0d7aac7a9b91e56ed5c2438c
MD5 be177c0c136576538a8d449f346b926c
SHA1 f82ca3365b909d075dabf5c3a7995df0d05a646d
SHA512 5002d1a65d5f5255d2a3e9c0d1715cda75d54ea6748cb3c2e2fd5a84b30ec9d880b68ef4c8d6d463abfbef3ade5f678f61799bfa52928c5145cc732f4b3c7213
SSDEEP 24576:MJnJ5D3WXM+4ZAgayjhwbmY3MaReFeDvSP3b:MJnJ5DGXM+tgauhwbR3P8wT8
TLSH
T1D785D02DD2A810E8D4B7C374825A1B51FF72386D2F2269C768B4D5357F22EE09A79F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d46b37bff2f50f68261a049c98dc1295e2243efc912696c587352bbbbe4c21f3
MD5 68b685fc4129660982f8204c2b7c5474
SHA1 9befb665bbc556361758ba2c4cb69e69886b21a9
SHA512 9553d8ed821c26733fda3d127a23020dc6ad24cde2a9dcef6be18909023a22181e8cd3d49fbe150fb15b81a8ca032a4a192a6304900e72adab26130ec96e905a
SSDEEP 49152:rg06DIKdwc+eQnSt65aV6+tgauhwbR3P8wT8:kzgaPJ
TLSH
T19F956C16B7EA5294E8B3CAB1CA6295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 b5abb08f5c1600bb7cada566fc38f70ba632cf8f0425997dff3bd2507c0fb4da
MD5 a034af57a3bb146e199134d2768ee0ad
SHA1 1f3c45fce145e47b3ded6561098b75c3b6f0f448
SHA512 6d950f7e73876fe162ef3d468f5db03182e66e8ddf2feebead557b75fbcad547b19e2f57f52879f0f3f15a27290a79feb785b00c1ec14c576d0d899996a52a1b
SSDEEP 12288:0EP3RnxeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:vnc+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T11675125D679C60D9C13B523C86A18600D3B2F8A12B5227DF95D5D37E8EB2EF90E38B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 c2c567e4a9278dfc8242024754a6e4a3d24ce9e76fe92acf922a6baaa4d28987
MD5 578cddd3a2621b2f13f0aabc716c39d4
SHA1 2b5a7d729bf352ff7cb4feca726b56611058b99d
SHA512 8c5076ae433926a950e5f03014432cd8ae2ea99ed058bbf129dad73e60acfcfe6a245db99d1f1e00ddeb1f14bb0aef97924b34bf409c7d0879553fa6afe0dc3c
SSDEEP 12288:ijkyOeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:iIyz+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T118751244A39894C9D67A06388B7742A09A75BC612F1193DFA0C0F73E9EB1FE89D30B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 4df2401d55e5d310c18b42abd82c0dc46a73d53c1ac420d40604aba25dc3b721
MD5 a2d3975f241ddda351dc397a344e22d7
SHA1 d99ac4bfefa18a2dcb9e29154e614c640fd1e4dc
SHA512 b3d9b9ba30e7854b609dc8a0f3959f21fb332fab7b674c00e2b6755b8db084b1a449a2d78131c0b4ca3d4703a909b567eaea149aca2f13528ae6cef218c3cda5
SSDEEP 12288:1yUeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:U1+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T139652344921C64CEC92B07748B3A0E6062A5BEA62F4271DFF4C9B7B5CDF0DE946B1784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0e4ce47326c20ceeafc17b036d09d7050beb52f3bea873accf247c3d609f4abc
MD5 6ab2cec6ed05639a01cde1736f90de18
SHA1 43fc508cb800db99b7d10d51a99364602903472f
SHA512 18c4c1780ca6bf4f1dee74fd1f25c9bc86b145b3d4c4a3a9aaace7df98b902f2f546318e07b258ce78f4cece4a9d225db882d62c0210a10967e498e7b8f66a71
SSDEEP 24576:NQ9MxZKdcz9dw3u+4ZAgayjhwbmY3MaReFeDvSP3b:NVKZu+tgauhwbR3P8wT8
TLSH
T1BD558D2DABE9058AE177D235D5A240C3A673B4311B31D6CF2448D13D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 46cabede3dbb8891deb0f04aec8d2bb8009ef771093f51f3a4b121d5d20c0d51
MD5 f519320cdfa20679410fb6e7c5310afb
SHA1 8c8bac322c6f80621ff22274bece59173f1a75b3
SHA512 eb4fa2d25260676f06c51f3c5c3910374dce135ede1351e8384285b7cfc79e884afe07de2bfab53efa052365e4a83ee0252223605c8688d95d24df84ef84e9bf
SSDEEP 24576:nyocDApf+4ZAgayjhwbmY3MaReFeDvSP3b:yocDApf+tgauhwbR3P8wT8
TLSH
T1D985E01FB76D40E2D176823C8A858641E7B3B4701B6263CBA591C33D8E73AE9BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6005a8f9c259541ddb5026dc0497a45f7412963f094900014cf8e6b9782b20f9
MD5 5897a2bf0add33238772fc6f99e4ee34
SHA1 8d434dbde9819d34c70cec0ca0c01244c1860102
SHA512 e96074bf1c456be799b21fbed251c942622b8540b7da1cdfb080f4ea6991d0bccaa9dff746be066439016bed612a1eba89d90e53fb04915c939f51ad2d347dcf
SSDEEP 49152:AWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKf+tgauhwbR3P8wT8:y0zuNIcgaPJ
TLSH
T1DBA57B3DA2BC00A8D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 802848f2b0178d0e71308f60ebbaf486757b73467a46422ee3f134b2cd92f7a4
MD5 1036c3dc3d348491b60bdf172c3ae5b7
SHA1 a38099fa7e3aef3cf27ef48d9934306dc6d4343b
SHA512 3f678783446f79d7ae98c98be179d872f4e01fc32862366a7858d89e94b4462ac331c58f609427aef373dcb8b43dced6d6389f06a9a8eb766e882715da6fbbde
SSDEEP 24576:t1QT7EcpfxR+N5AWAz3ooiYzjMqbc+4ZAgayjhwbmY3MaReFeDvSP3b:YTDxR+N5YzTBjMh+tgauhwbR3P8wT8
TLSH
T1B155B02EA7F815E9D17E86798B238512FB727861073193CB42A0C17E0E779D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-398-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/464-645-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/892-296-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/892-380-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/1068-457-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1068-473-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1068-646-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1068-441-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1068-485-0x000000000CD80000-0x000000000CD88000-memory.dmp

Download

memory/1068-411-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1384-478-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/1384-351-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/1684-274-0x0000023581ED0000-0x00000235822E1000-memory.dmp

Download

memory/1684-293-0x0000023581ED0000-0x00000235822E1000-memory.dmp

Download

memory/1684-279-0x0000023581ED0000-0x00000235822E1000-memory.dmp

Download

memory/1684-264-0x00000235817C0000-0x0000023581B17000-memory.dmp

Download

memory/1684-265-0x0000023581ED0000-0x00000235822E1000-memory.dmp

Download

memory/1684-275-0x00000235817C0000-0x0000023581B17000-memory.dmp

Download

memory/1704-330-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/1704-385-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/1704-313-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/1704-323-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/2112-637-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2112-386-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2200-14-0x0000023E24ED0000-0x0000023E252E1000-memory.dmp

Download

memory/2200-49-0x0000023E24ED0000-0x0000023E252E1000-memory.dmp

Download

memory/2200-47-0x0000023E24ED0000-0x0000023E252E1000-memory.dmp

Download

memory/2200-23-0x0000023E24BB0000-0x0000023E24BD0000-memory.dmp

Download

memory/2200-18-0x0000023E247E0000-0x0000023E24B37000-memory.dmp

Download

memory/2200-9-0x0000023E247E0000-0x0000023E24B37000-memory.dmp

Download

memory/2200-25-0x0000023E247E0000-0x0000023E24B37000-memory.dmp

Download

memory/2200-24-0x0000023E24ED0000-0x0000023E252E1000-memory.dmp

Download

memory/2304-58-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2304-64-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2304-66-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2304-257-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2492-404-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2492-479-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2492-347-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2596-321-0x00000215E24D0000-0x00000215E28E1000-memory.dmp

Download

memory/2596-306-0x00000215E1E30000-0x00000215E2187000-memory.dmp

Download

memory/2596-292-0x00000215E1E30000-0x00000215E2187000-memory.dmp

Download

memory/2596-295-0x00000215E24D0000-0x00000215E28E1000-memory.dmp

Download

memory/2596-318-0x00000215E24D0000-0x00000215E28E1000-memory.dmp

Download

memory/2596-305-0x00000215E24D0000-0x00000215E28E1000-memory.dmp

Download

memory/2596-322-0x00000215E24D0000-0x00000215E28E1000-memory.dmp

Download

memory/2596-320-0x00000215E24D0000-0x00000215E28E1000-memory.dmp

Download

memory/2596-316-0x00000215E24D0000-0x00000215E28E1000-memory.dmp

Download

memory/2596-319-0x00000215E24D0000-0x00000215E28E1000-memory.dmp

Download

memory/2860-1-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2860-11-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2860-54-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2860-55-0x0000000140000000-0x0000000140427000-memory.dmp

Download

memory/2860-10-0x0000000140000000-0x0000000140427000-memory.dmp

Download

memory/2868-355-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2868-361-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2868-490-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2868-354-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3372-28-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/3372-256-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/3496-638-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3496-389-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3536-505-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-495-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-500-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-508-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-499-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-502-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-491-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-492-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-493-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-494-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-507-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-504-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-496-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-497-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-498-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-503-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-506-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3536-501-0x0000018ACDA50000-0x0000018ACDA60000-memory.dmp

Download

memory/3624-114-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3624-79-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3632-345-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/3632-396-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/3668-382-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3668-381-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4012-334-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/4012-392-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/4012-340-0x0000000000710000-0x0000000000776000-memory.dmp

Download

memory/4012-335-0x0000000000710000-0x0000000000776000-memory.dmp

Download

memory/4204-40-0x0000000140000000-0x0000000140268000-memory.dmp

Download

memory/4204-41-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4204-32-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4240-377-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/4240-540-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/4252-367-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4252-523-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/4252-366-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/4252-373-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4408-644-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4408-393-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4568-258-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4568-76-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4568-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4568-80-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4668-82-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/4668-90-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/4668-93-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/4668-104-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/4668-88-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/4720-96-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4720-102-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4720-105-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4720-259-0x0000000140000000-0x000000014028E000-memory.dmp

Download