0fc5f75b52ece7f1296200779945c5ea9d5a3c35a46fe54c3deae97daeaaa0d2

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 1.6MB
Sample261027-sg2bfsvtht
SHA256 0fc5f75b52ece7f1296200779945c5ea9d5a3c35a46fe54c3deae97daeaaa0d2
MD5 6c32fd81f6ecaf1d03029af2bbdaf0fc
SHA1 31893bb563ee79794cc722ccb776edfc67d7ad7c
SHA512 4eeff2e2ac2a79054d89d0620b2742c498d5a9b9a49aade2bc1cb9cd23970675d340bb02c6592c224a5fec6a229ee69449282cd9762c31a6c851acc054b8dcea
SSDEEP 24576:JhNVU+0ImOT62S6aSB1bbfYH6vQVSKNx4fl5Tn7UOy/t3z0+ld:J162NV1QSmSKNKfXTnC9T
TLSH
T1C785BE1A725841E8F577D07CC9B68A07EAB23C4A132196CB16E477AE1F376E05E7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4144	alg.exe
1800	DiagnosticsHub.StandardCollector.Service.exe
1020	fxssvc.exe
2912	elevation_service.exe
3988	elevation_service.exe
848	maintenanceservice.exe
4348	msdtc.exe
4456	OSE.EXE
3764	PerceptionSimulationService.exe
1152	perfhost.exe
1404	locator.exe
3228	SensorDataService.exe
4592	snmptrap.exe
2780	spectrum.exe
5072	ssh-agent.exe
4828	TieringEngineService.exe
4864	AgentService.exe
2856	vds.exe
3748	vssvc.exe
5080	wbengine.exe
1060	WmiApSrv.exe
1572	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\33264d86862f6ed0.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\java.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ec032cc2466dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001579c7cb2466dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c870ad12466dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e1ea3d12466dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f9a0ccc2466dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089d437d12466dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ab2c2cb2466dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000910f41cc2466dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1800	DiagnosticsHub.StandardCollector.Service.exe
1800	DiagnosticsHub.StandardCollector.Service.exe
1800	DiagnosticsHub.StandardCollector.Service.exe
1800	DiagnosticsHub.StandardCollector.Service.exe
1800	DiagnosticsHub.StandardCollector.Service.exe
1800	DiagnosticsHub.StandardCollector.Service.exe
1800	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1616	2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	1020	fxssvc.exe
Token: SeRestorePrivilege	4828	TieringEngineService.exe
Token: SeManageVolumePrivilege	4828	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4864	AgentService.exe
Token: SeBackupPrivilege	3748	vssvc.exe
Token: SeRestorePrivilege	3748	vssvc.exe
Token: SeAuditPrivilege	3748	vssvc.exe
Token: SeBackupPrivilege	5080	wbengine.exe
Token: SeRestorePrivilege	5080	wbengine.exe
Token: SeSecurityPrivilege	5080	wbengine.exe
Token: 33	1572	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1572	SearchIndexer.exe
Token: SeDebugPrivilege	4144	alg.exe
Token: SeDebugPrivilege	4144	alg.exe
Token: SeDebugPrivilege	4144	alg.exe
Token: SeDebugPrivilege	1800	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4376	1572	SearchIndexer.exe	109
PID 1572 wrote to memory of 4976	1572	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_6c32fd81f6ecaf1d03029af2bbdaf0fc_akira_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1896

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3988

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:848

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4348

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4456

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1152

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1404

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3228

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4592

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2780

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5072

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2900

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1060

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4376
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9abee8c810e6c4dc7074164d5cf4276d441f2ad1067ffa852ee45f5fe6ace4c2
MD5 10da5a5f59e70c42c0c60085f5974f7a
SHA1 4c0d73211e4b6c49f34ab52813d8bb0f54f70972
SHA512 de6a0d1f35b18b53e1c5ecbdf4b3f424e59a83db6cb090b7247163afc6105a962d5403b149a3114e626eba4e3a1d1c5617056402417a01f4275a303c9d8446ea
SSDEEP 49152:Fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnaKNKfXTnC9T:b3q6HjB/KNij
TLSH
T133D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b33a18f42db259789cffdd10a01c0431801c762a96681558a437c5bff455edce
MD5 904e30326b49ecc9bf2ca9374a8c5288
SHA1 ebca509b77b8715061fa41de860de93aa64b983b
SHA512 67107394a6c06365cb2605d26c859cbbd86077c100ceda07899b7409eebb1c41fdecc9b91b72f614dcc5f3ab873e6701a655f6d364f5fdeb8348f8c3b3cd3cbd
SSDEEP 12288:91XLsswWkxy2lRq2czATts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxn:zXYfDtczATKNx4fl5Tn7UOy/t3z0+ld
TLSH
T165750125B3D448F9EDA7817CCCB28515EA3378554760EB9B03A49A390F336C89D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8522d2184638e07b7f2a1f4d65b3793164f8609941813cbd5793afa0c16bee8d
MD5 c18b95c3e03f6b2f9aee897bdd4a772c
SHA1 805075919c46f33148ce8a66ed05f3650f36d5e6
SHA512 2c4055232ff6ef0b21aaa6c37610a7113a7b898410a01dffa5485da20956d6f8cb4eb5d3a33a1078fc4e54258d78616f5b755e9870bf44f5cf52419d45d101c8
SSDEEP 24576:M0Le5ji0hmxWrMiKNx4fl5Tn7UOy/t3z0+ld:MPji0A4FKNKfXTnC9T
TLSH
T1E695AE16F6748335D073C0B9C5D2A69EED72308657308ACB4286D77C2E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 737221c8745d5ebee2d81d48ff0978a8f70819c259b6ad715f17c6d1de1f8145
MD5 1c10ba59eba7217eea4f64fad7ccd3af
SHA1 2a1f840f154da01c90fd49ad3e2c28df6bd4954b
SHA512 ccc330374440fd6403b17d3887e15e1948fc297276435c4f869b57b467cdd42252ce0f01a2b702b08e175e077a27af86831c6f02bd25fa779f70bacd7ac27dde
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyu4KNx4fl5Tn7UOy/t3z0+ld:C/ezSC6vUzPvxHjyJKNKfXTnC9T
TLSH
T101755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 359f2f14ef3c2a8787fdf3b84f41de73934c1e871859d6361522f2954b05412d
MD5 66d1e927f354d8ab6713f3f0e447bf89
SHA1 f305c7706dd6c18badd51d6f1f5aec880c98debe
SHA512 a0b39c508046d61de8301970b2cf3026194af09371e87c82d9d3988e3082d2699de117e2a25648cb2c54020104175154f5eb172884d85b6e5183477550eb26f9
SSDEEP 24576:CVbqPb88hv/l+6PKNx4fl5Tn7UOy/t3z0+ld:CVO88hXl+GKNKfXTnC9T
TLSH
T147559E66F574C331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 1c9cde40d2a023b1938795325b1e452afd04f3771435ffc56673cc2d61162b62
MD5 f801fdf0566b319f0b550d66bdfee5f2
SHA1 9a3dc7b21cc1058e6746273e7bcfc8a5638afddc
SHA512 66882e4625f8cfe9941a03c8b8ccf9cca62afc0462f2aed95fabe94854ed7355cbe229ce65469093727bcf14fd102a8c0161552474e168538954fe620ec1ef85
SSDEEP 12288:Vw+ts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:Vw+KNx4fl5Tn7UOy/t3z0+ld
TLSH
T14A552353A58CC8E9E7E304B069F559FC4A133E6564899C13F6607F7C497D88AE83B8C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 a40bef82aaa4a96253fd2c3c80286269ca9f79bbb91276620c7ddb1aa259ca8c
MD5 cb6702c1ecd1f3531ba1dfbd33ce21f4
SHA1 031b8cf0706a56e37298089269b6782a7c8e16e2
SHA512 1de2a35466f2ec4124f094b4fa23697042d75ce9ac2995d211b7d6a011cd09861a1ddf9c396084909ca3cc77614a9375ae50d2c5d9f609f180538b3ec3afc65e
SSDEEP 12288:veBNUbTVO86UXts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:vJIUXKNx4fl5Tn7UOy/t3z0+ld
TLSH
T16D75C03BEE28FCE2C27A4DB85AA18640D77278304B52A3CBE174830DDE275D55D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cb17927ed0d54f8ceccef62fb5a668f65634a57a1313497018c2e44edb027a35
MD5 90fc328c4f7a16743ea62e425d325b81
SHA1 750432d1263e88ee97d30a60208c658c801bd5c2
SHA512 9eb21b6322f9137fdaa331958ff2ea191f16cc17cb769a56b4bc9c1de26a88c7a53f3ac14a65b2ec5efc3fb97ceda368ae0d089fe00d3956e1811eab805e9b95
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THO:8QvGAdlCEL8c/yRNw5CIKNij
TLSH
T1D6267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3591f3c62cab76b442e7445fa202feb6559ee8799eb1a76b2ae39a32290ba875
MD5 31aa8c92f87b23d27af62ecfe0ea73e5
SHA1 d497414325b7379f964772491bff67451d1a8f1a
SHA512 a67d92964f213254ea68ca0b514e216672850c208ed08e22c023fde773d43c89de3c5b02dbba395bf3c45487d12cfc246d7e6df6b0c5d8596890abd762ce9591
SSDEEP 12288:BAwSfxL/2Dc3EDLLmt0LDQewsAjVts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zwi:iZewsAjVKNx4fl5Tn7UOy/t3z0+ld
TLSH
T18275E031FE74E436C3BB0DB21B36C71A182D7A204B5219C3E3A89E9D59342D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 926ce1b9da35b186f2da632a38ee4e4a51e0ccfbdf9fecefa6a45d1694703747
MD5 49f13d46062c783de4a45d0c6de29392
SHA1 77816aed31928b894be18f6d7140f52f28be75ad
SHA512 0c024daba9fca2770a25b29d7c3371bc6042fc54f3506bb0b594d00aab5397e3bee025cb3cf2af8c0c0f52178311cca425f9f6c49cb9aa8c1a68bc27635ad2ec
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH4E:kUEtQevvqc2W1cpV2EI32
TLSH
T159474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9670ea2290fcde6463ef41dac0c6fea7fb04bfd681ff16f254e46ab951ee3206
MD5 d02704a7b01b1fdf1b236210e3626988
SHA1 bdfc41b7e0e94bc618a1147ad98f6571b8412192
SHA512 c30f61037931014be8badde2b50cb7cb139ad6286e388ba584242c6cb782a0b9b7fa643bce1030ece125428ee3445e37001f07749ebc7a21989c92efa52cecfc
SSDEEP 49152:CCbRquA/m2yL5zifFiV+XenmE3/z1KNKfXTnC9T:HoqHVjnmMKNij
TLSH
T1BED58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 88e36ba18af87816741586ca1073fd52430da1c905616817f71fc24c2f47b0ff
MD5 bd3ec9f5cb315f5ddad774edcdb5b39b
SHA1 12463970a06cbfcca6b565b20752e52282658c9c
SHA512 e862d7faa0d4b42dc54a62daaf4e2513f526a108f9b9439a3ef758bc1d00cbd978d742f63506da723d3b89aacbafa141b38da5a728335f44a8b3364a6b238ee9
SSDEEP 24576:QAhGLJIFoiwtA5l7S53sKNx4fl5Tn7UOy/t3z0+ld:QAMyFoiq5cKNKfXTnC9T
TLSH
T18D359D81E7F955D4F5F3AAB899B69170EA76BCA65E31C20F2160D11F0E33E409D24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 5ad0d433958ea718471c93794fec69e691d66040bee3a8f6992d49f163ae4dd2
MD5 6404addf311e91354fb6d5cdac091719
SHA1 612721dd499ab9889ebde84d174a1103fe75652c
SHA512 491aefd87a3dc20684eaabade553c64511d2646860efa3d614d5f632bda2f749bfcd1fbe89e81fbbbbf6d5ed73fb6faa832fcd8ffc59b4c7dbd0d1ab181a7c84
SSDEEP 12288:Cmw5HEjsChNpBFgl0WDm+CYts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iR:bwuEOWpKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1C575F14672A80CF9E9A3413885A7C135F7B3BC122A25DB1F1760C66B5F37251AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 b6f8801bd79835009ab18910a7ed632b6428c8aee35fa67057862b80f8b7f54b
MD5 125ca2549c547a3e4e0c0ae0f046b7a5
SHA1 a1bd76c0c403f038393915f7458222c19ec5a82e
SHA512 2fc0911b243eab751c637bf0edc0a17d1e0fc4ed79aceca4f7e887abde86192425d6fbe6fcebb7cc2474fa862f88b2425ca356c42b57edeedf2e28bda43a4a5c
SSDEEP 12288:VmZ1Iylts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:kZuqKNx4fl5Tn7UOy/t3z0+ld
TLSH
T12465125632E860F9E2E34178D8F14698D7333866237647CF62205B781F37AC6AD3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 84fd9342aec8d2bd2030f7dc83008a946edc0cb2f7684b7d6c8360be911d43ba
MD5 52b9d043dfb078170cd42a1020ed5de7
SHA1 1fe2b7634a5b9c15a1873b9bb97d92509ad8338e
SHA512 c9c8b67b8947636b67aefa1ccda58d9101d13214da346ffc0fe238f68f124a97c6d261c466aac4a840775d72cca12f2e35ffd3a61471cd25b3ad09859c7d2b5c
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:kQRQyi36YOcPQLvw2gAf+PN37KNij
TLSH
T199667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d4921260a4d14e95b5a9378ecfc1bc0bf2f33658a3e462d58e00cb2c44b8ea59
MD5 3ae28fed21291ae45514a3ddf7a9acd3
SHA1 940d1c5a4f0d0157c1c1ac2283c3975abc97902a
SHA512 914481d4a0b7fc445bc039eb35362cc012380f1867e7c2319dea8ccafe6219c63afd5e6ab60ff320fbdbcfcb1d747cf3eb5adddfd1b906a1666bb3bb17383050
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:aQRQyi36YOcPQLvw2gAf+PN37KNij
TLSH
T150667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cbcc7110578f47efe9a93448aaf8a27ed895ab4b67830642ddb494f46c0bfc72
MD5 dcf0a64bdff0a288b94f1c3c9bb7de43
SHA1 50b317281cace8ce34efbe68d2b0f018eac08e54
SHA512 d1153803c2bba19e6db8b7c9e123db406a22adb15b98700afee58db72079f94cc20da500402ea60ec2a08fa0083cf2b9f8df40062ef45a59e2ad4bd21dc7f481
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0aKNx4fl5Tn7UOyT:k68Qg55nhheWu7PNU3/FKNKfXTnC9T
TLSH
T1A0B55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fe02c8fa4314ba3a04d2b0da0011c8836b74e3e954b3df723133076d0ea5d2c1
MD5 af2eb22b9119dd2794a2bd26994535ec
SHA1 a2dadb2454220d7eb463c16cd99ba88664586bcb
SHA512 98436bd2abbdb58ac0daff08f3830f1a60b43bc53c61d0b3de0da3a4e23c0f17011833908ccc21ebe9fdcad3230888a413c14877827b1058bae68d427197400e
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99w:Zy5112gYy5azzVvL69nLKnhZ+KNij
TLSH
T1F9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 82589fae0ecf978c753545f24a2ae2d701425eddace9bc46371abf50ae441aa8
MD5 9b749f18969984a638ac7d06fda46e56
SHA1 3423514c28b5cb2b4984787799290ae74f4c0746
SHA512 455d393cc3e0ff9934728197149ca042529921a8c5bd1fb489a2b97bd304f89285a482504b0b59365cf227a5db6dc663a1cdf61ac272fda67dc037d8fa4dd463
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glDKNKfXTnC9T:Yu6JmVxd2dDKNij
TLSH
T179D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e5f54651bed9daeec15cafc22658cfbc792258aa7e1b5089dd831951af986afc
MD5 dfe52169ef44b10a26f18b012c7bc558
SHA1 786a72100447b025ef77ea9bb14d6cf5211d4da7
SHA512 121ce2480ee365d0f0d07c3273ebf065c4af96a299e901c7efbdb54b07a235f6be029b06a11da6c7fde04f27029aef8c79c237384ea3f9b3a206823d86f143da
SSDEEP 49152:f1hpsNoJpF1A6UU44CwH7R4x3KNKfXTnC9T:fmifPbRMKNij
TLSH
T1E4B5BE13F2D801E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9df755442cf78f26a1fc0d8689ea9991192dffb372d3b5a96bda0f7b254b1a62
MD5 e950de1254d735506704869478ec084c
SHA1 1278240fdc44eb423d47b53f171a74986daa8a3c
SHA512 67d4168563c92fb9f8d67601526dfd1f100ab61b038873620ac7a3dde0af35a55fbb4953611c6d4d901e72d0a96e0a1b0cdf9a6c989ab6cb14c334b082095c37
SSDEEP 49152:7SuZQIY0Be2KRRVtOnks6NMHqqKNKfXTnC9T:p5dKTi61qKNij
TLSH
T1FEC5BE03F2E940E8E0BED67487659236EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 89a96156bd97cbf6bb289f5a248e120a439228a6fdd6f880910eaf14fd383c29
MD5 25f9c91ba64ca9640c90affed76aba55
SHA1 58c55fc2df9d7d3e2bf0e5a3dadad726194ef153
SHA512 1d0af245701ac831183a78fea3fce408e45647ff954a4f2e42291b22d01f681c67dd0db9b2769ad1872d3b79786e77ea8b32ed9e841207cf51dc6ab40eafff25
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5wTKNKfXTnC9T:zX2iyphAKNij
TLSH
T10A95BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 160f82f9f3bc87ef1871bc4bb2ecdf399e1f9080aab82ed229f3b16bbd7bb18c
MD5 3efd7565df1b7549a5b4eb877502a3c9
SHA1 0a749324a67e641933464def41b79e7077c30f13
SHA512 595e8ff30718ceb947aa68281ed683dabe73c66ab2049512d6a34256a883f888e59330509ea29dda09419ef8b0a474fed114be9add0bc0a8b9e9c51ef0384a4f
SSDEEP 12288:LGts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:LGKNx4fl5Tn7UOy/t3z0+ld
TLSH
T125552353B49CC9EAD2D304F099F055FC45173F6AB58A4813F6547E384A7E88AE83B8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 9ad82eefe05526d662f77dda590097d98009ac0dea91ccd305155b82349e46b3
MD5 41d6fd98287a2612ad879ed944e8389c
SHA1 a46443962b4e44c9a0159420fd0fd748ccf17207
SHA512 b97e5569c2165a504064d2f9c0d28b0e5889efe48ae60de965f481837dcb8e9fffce818b71b9e487613fcfdd9f8e44df32a6857b029d546ac1e04bff7c6628a2
SSDEEP 12288:zBts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:zBKNx4fl5Tn7UOy/t3z0+ld
TLSH
T11C552353B49CC9EAD2D204F059B055FC49173F6BB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 ea34390484635d00cacd8801f82b96a06f0c7947e3ef7b03d3645f2663e4899e
MD5 601fae3857f13074483790807044726d
SHA1 087a9d29ae528c56697b2ddf10901562fcdea880
SHA512 3f87eb33e3222e33b7e0fe27c668ceaf27d2e3e2d958552a20337d232f8435f4ee35fa2046e361ff665d0fe2a7c71efcab92d8e4c9c3a7285d2882d3713770c9
SSDEEP 12288:p/ts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:p/KNx4fl5Tn7UOy/t3z0+ld
TLSH
T1BF552352B49CC9EAD2D304F095B115FC49173F6AB58A4C13F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2d931919b9266d7d20e2bf0dd77babef0f70a89cefc7391eabdcf37fc6e68740
MD5 2a5a540da7b3047279d39d2dd5b82dd6
SHA1 d22ee92adf7621d1ab13591c52569b484ffeb812
SHA512 c6bb58088f80736dafd490a4a974d73e5586faf5a898503bbc3d2fb5b5b5735405040030d28956ee5f6c4492ec0e22542077efc8043f13d9d2604372360b41a2
SSDEEP 12288:8VMts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:TKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1E0552313769C85E9D5E380B0C8B141F8D6333E6AB3565A5BF7102E380E76685EC3AED4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 55dfa39ea45ef4e7c916fedb6871e0b66d944bfe86ba36ce71c4fd0695d9232d
MD5 52a09783aff4ba2f734ba290ed487ff1
SHA1 4741b1c306fc3a07a35a50e1fe0bfd72f6434382
SHA512 71def576c2ea2f088641eb6468bf96c0bb13625b5aa52fc61808e71c91977359df7916e13e2f02542c1d4f31a08d46be9791ff881b3ff93fae552db36fa66a3f
SSDEEP 12288:9Ets3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:9EKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1FC552353B49CC9EAD2D204F059B115FC49173F6AB58A4813F6547E384A7E889E83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 cae7c73cdcfc311eec7bf3e88911e8010ccd1999f2634b7241235685af68a3a2
MD5 8175eaff032da7685734edecd9873240
SHA1 a890a2c36aed98f9f7a58af85f7e811e4b9da9a5
SHA512 f50b643d674d79c4ca76827f4c5f4cd03c4dd4b8a3391e7451826bae29a5d415e008c43df3bb30d877b5ea2bdda59ff8e0a9e5435cb7ed115b9b05032705bd7a
SSDEEP 12288:Adts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:AdKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1F1552353B49CC9EAD2D304F099B055FC45173F6AB58A4813F6547E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 615fd49bd579b6920d7b2e6abd2b07cc6f22f460b3083eb3e71c718b52b87a60
MD5 1e0c13cfb11a007b0c561b850470804e
SHA1 7af38a91764f099cd985ca5b3e7dc75fa42d52f7
SHA512 52a762db929826f864cee979997b66e31b16f1f1bb71637fe6e811640aeed24855b1fec35cd7de52168ca99f4eb84ef0d0c6f8e372bf9bc202ce664b53aaa257
SSDEEP 12288:IZts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:IZKNx4fl5Tn7UOy/t3z0+ld
TLSH
T154552353B49CC9EAD2D304F099B055FC49173F6AB58A4813F6547E384A7E84AE83B8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 524b688a6e7fe45eb7bcbd40cbad6d83f5ae242beddf3e1f29f74d74d07a1310
MD5 936ff7e30990c934ee6e510a1c50ada6
SHA1 a617da0cbe7de33560f17687897989c5697e8885
SHA512 991d114fbc12d532a8dd8c51e7c3b3df786f166d363819a71c1b37b25edbb3551b15aefce3bf8f7f57aa68083a8d0acb009691eebfb8e0114f9feb42ff585009
SSDEEP 12288:uiZwbWzzFEoS2cPvyhts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugd:RZMWzFVSOhKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1D4750195B39008F8ECA3813DCD658959D6B27C6A1760CA1F13B4362A5F333A15C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 544dc20d56386617db50c71da645b497a98ccbd6c595f9225a987a8134a1f18f
MD5 550530af1835656e4072046afb696d16
SHA1 6a615bd7ee3658edf325402a1cdd10a0b3617101
SHA512 ac0914de5bf1ee4a4d7ca73c7d9999270cf181faaedce756600434742122c8280b64137f97f3bf69df89da58336d660012d698e783f20c8bba1674577761ee04
SSDEEP 12288:o6ts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:o6KNx4fl5Tn7UOy/t3z0+ld
TLSH
T179552353B49CC9EAD2D304F055B055FC49173F6AB58A4813F6147E384A7E88AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 83721bf6d95135ce36047bf97a33b1c0f127a6296dba163d24cb019342678bdf
MD5 ed9be5f3ef058a728fd1eea31ac47ccd
SHA1 e757427e1a79fe1487757243b531a801b2d1121d
SHA512 68ca6394e5e572098f0464f23501cc6314aa6bd19fb02358220df3713f1077741868ed593388f68da88ff309599b704e0e9fa044d2ba9985acdc3364026ea663
SSDEEP 12288:zOts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:zOKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1AF552353B49CC9EAE2D304F059B055FC49173F6AB58A5813F6147E384A7E84AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e45a54fb26917ee1d1821f678541a71d922ad888a2e09c44042487e6c3851375
MD5 b422e5075581e4657f8b7a032d643c0f
SHA1 b54d3950c2837594420579ddfbe4c8839d1964c5
SHA512 8aa1417a6a2c2f1d9e907aa28d25503974a380508037108790eea4efb445e249d5b8b71317293a152bb154c86d2feda1e51cff428a112351006811678f0b9b42
SSDEEP 12288:UyPz5L8lts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:NzylKNx4fl5Tn7UOy/t3z0+ld
TLSH
T14465020372A420F9D1B38174C8B21A55F772783657648EAF63601B7A1F37691AD3FBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 a49f2b97a5e4629b1d9b71f6d37fe20e8f64a8770fe6bda59f4cc807267550a1
MD5 cb0581ccbebce6feb0bc97b430533c47
SHA1 0965799d60435a37c1642318160079174dff483a
SHA512 6aab4ef633df996f8156dda91db5e154f42abfd8d1a226eb4fb00f1513de935b34ea2c38876004be1463d3b93b6938d51de27a35dbfd4a78503326b909cb30aa
SSDEEP 12288:G6ts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:G6KNx4fl5Tn7UOy/t3z0+ld
TLSH
T1E5552353B49CC9EAD2D304F059B055FC49173F6AB58A5813F6147E384A7E84AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 2c220f02903fd0d78b455c021f3e0ac00c91cff46538dc74cbb4b480eedcd237
MD5 0a24a453f127ba799f18ee20b929d464
SHA1 086de257db2021e8255eca5ff1fdf51c11cbd3bd
SHA512 04157eba55cf5e2062bff1505b8063224fb2d96f97574e6216d7c672eeda5d3d7ab07bc2d55a8258baff01d4711c7d559efd0ba67dcd81ea708dfbe0ae3f4975
SSDEEP 12288:56ts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:56KNx4fl5Tn7UOy/t3z0+ld
TLSH
T12B552353B49CC9EAD2D304F059B015FC49173F6AB58A5813F6147E384A7E84AE83F8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 796618318c8fb253d1d4ddf1d9a97ec5aab27302ddb725d70f70b7a8f397423a
MD5 34f38160405fdc97e03f5e1fd265b036
SHA1 66a138287fc85a1515e9cee5db5ea850e36a7e7b
SHA512 92e5a826edd8aaacb70b308f1e2981daaa36e7e62ed3853f53cd385e3673c754f63d612b94bee6a221377f799de503fb1adb61684e7e3cfe3930350125389036
SSDEEP 12288:byPz5L8lts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:WzylKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1CD65020372A420F9D1B38174C8B21A55F772783657648EAF63601B7A1F37691AD3FBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c9359634394e7cb360304b026674dbbe3fa791b320e9a1ec5d878419f62fea5f
MD5 115b707a1a03e3ee6fd2fba2faf9061f
SHA1 756254df5b05b92d8ff0f0ae5fec3047c9da9e90
SHA512 08c1617b7a5990a9472865fe91f3115b7c88af310d324f29c24356d528b72e2d01b56bd41d2b0f3423760bd42cd0ea076b5b300f60d8fd76ad38d19cc87cbe93
SSDEEP 24576:xcP4mcvIjkGOxhKP2l71SNKbrh/8KBSKNx4fl5Tn7UOy/t3z0+ld:mP4m4IpOO67N8KIKNKfXTnC9T
TLSH
T1FB65AE2DABDC0096D0BB917885658A49FAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b4c9230545e9bfa5a82540f9ba65c75ddee7049e1599b83baaf1bbe22ce01250
MD5 d7d140b4c637f4d0a1198af96f09c40d
SHA1 3212d1d0a8b44769a9f4f87607bb2b6f014bc89e
SHA512 6788e290802e75c74944064e78dd774e99caa305eba16085e6b08398e7cc54bf0b52c3e260504f9141e56f569a814e237816c912401de9c901199f20774b9d80
SSDEEP 12288:Nxsfqts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:eqKNx4fl5Tn7UOy/t3z0+ld
TLSH
T13A65011AE29842E8C0AE6174C7654A94B3333C2593E1D7CB63D0F93D0F7A5949DFAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 3a7f0bd7cdaa2cdb80aa6ce46181f4e90e69ec816c16a98919a25439906bd546
MD5 330973aeebc6f868d2d32d1619ce2a00
SHA1 7a69bd0657323587ac2a567ba800f514f29b0352
SHA512 9e81639cccc883fa98d9c9e0dc6a262c2918782b1f7a365a92eb0659c6b7a776c9ec6ed825ebf0faf1120fd2b9025da0bfb3a56f9132dc8e28194e6f7d65aab7
SSDEEP 12288:4Kts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:4KKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1BA552313F29CC9AAE2F315B058B585FC161B3F397B458853F6107B384979886EC3B988
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8b1fb2a69f231d2dc5b8bbf57886ea73865d0e8f7a81e4b7a646f352a3e31684
MD5 a3d37e81a6a249b91fbc6555084b94e7
SHA1 89d31191d9e6259beee94449addbe1acc2631291
SHA512 efb7686fb4de2d049755b3ca8203345849d3541614d770ba01d4883e94149aebd16dc70bbbfcc541e3997d0a6cc0aa9de79422d65e6448759690f296f56d136d
SSDEEP 49152:Ha0h2GEkuAe73q3pp46zwwQEKNKfXTnC9T:Ha0hNYG4JwNKNij
TLSH
T1DD85AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37DE48D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 c923de9bc9659ab512099a54c068e8b8bf66bd09d2f2a4445b995648143e7b3c
MD5 fc513cb7548f4ff63dc7333f4a430f07
SHA1 68c9a6ee8c51d5d2abf419731a137a4664d4ef43
SHA512 89f5ab4910af70d792c6549d3026dd4402491e0060b21efabc64a1dbdb224e7145ba264de56d04620367c2c7947fef8e53846d41451917b2e4a4c9d766f78624
SSDEEP 12288:HhbHjfXxts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:HhbHjPxKNx4fl5Tn7UOy/t3z0+ld
TLSH
T19B65127E26AC10D9E1B2A1BC95A18589C332BC25271197EF63D0927D4F3BDD59C3AF80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e124b323a998c9fa871324dc3ba9208edece7e43b6a89735c368b559cec992b0
MD5 fc1ba54ea381a5a24d54a50445d38d12
SHA1 3fed3461c14cceae0a38266c88dee1ea74f23459
SHA512 0dada646456d6bfb06ed9841e8e4f4bd30d93eb86670b624abf15f3c3d7ea4ec4fd54215071a30927dd7e0066ece13a09580995d58b55912a7dba7ca6a3c29eb
SSDEEP 24576:Z3YgnJcRTk4yti+R5dpR/pKNx4fl5Tn7UOy/t3z0+ld:ZIgnaTk46ppR/pKNKfXTnC9T
TLSH
T14745BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE89E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 efd9c02e8300b55d5b9521a8664085553a4c55322836be598a4c6e2b4b9972d7
MD5 96dddb9b810e52aebedcf4d68f094154
SHA1 e52f23d39daba7ffa9943d6be005c6d642e9256c
SHA512 215c6161eda28a55a047b8025373bf564d7653ce782ad6bc9dd9f73db795d2f47cbf200d417df3f20c971fcda99f6022a706aefa6ce162513bded3ce7da7cd5b
SSDEEP 12288:fets3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:feKNx4fl5Tn7UOy/t3z0+ld
TLSH
T11A552352B08CC9EAD2E344F059B155FC56073F25774A4DD3B564BA384A7E8CAE83B8C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 bb1adc70a341b5de9e3bc1b0c1aee51a018ccb28e8223ef0edbcbfcd9f8aa3c5
MD5 d857e865827ff6f93e347431432dc55e
SHA1 f5df5c80cd021cb7520a9d69a72e8975b1cad2a0
SHA512 07b7b1e6b94fe1666a9e36d6c419518d2c716983cb34ebe1313f7f51f374124e507d589b774cb99cecaac90cde07ae04b8739261acd5305a7c3939919243805e
SSDEEP 12288:qOb5A4LWOsvAYFTTts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:bNL3UTTKNx4fl5Tn7UOy/t3z0+ld
TLSH
T12585F155F69400F9E9B7813CC9B28A26D272785D1364E7DF03A84B651F237E28E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 27547acdafe8781d6019b1bf4391ff1e5019cc370f6b36296f2df709bd784d46
MD5 db4a054fb5dcdf55b09fd9e62665d47b
SHA1 e8734cc3414a2ac209a5ba31384f03e0bb2e449e
SHA512 54617dbbdc0be57c208456b261167ba826e02a09eb7609916bc56451da2f467885add9a91e3d5ae8329877577765ed99b5b28c134d4a4f940572f7abdf748014
SSDEEP 12288:6pFt9O3ts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRXP:sO3KNx4fl5Tn7UOy/t3z0+ldP
TLSH
T18C65121A32EC10E9E1B6A17C89A2435CD3727876171257EF42D0857D4F77EE8EC3AA90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fae198946220e770e419926acd345c72d17ee65e65fc9c7389c574d46c85b31d
MD5 a4122414c9a1600a14b3d7e46f09cbbd
SHA1 7ec4553e8efc68c72a3491e073653dceb4eb57fb
SHA512 5096f8a9aaafa6f885bc89da9dda4218a7fcdee7f4a246856adb0bc603179d602558f38bf94a08b20fdbc30e1a8e9b6e4ba6170b42f69f87dc60dddddd0ed27e
SSDEEP 24576:77NM9YmZqmWMUkPjZM48Mv6bEhs6KNx4fl5Tn7UOy/t3z0+ld:77cBWMpPjN8DbEhRKNKfXTnC9T
TLSH
T19165AE2E6BEC81E5D477D13DC9E28245F6B2B4611B318ACB1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 180a6393ab1344317e4ad0131850dfec7956e6085cddc6960d92e1084a40aca4
MD5 fc69286cb36ecec66415a4f940c99a35
SHA1 4af851c42b7d79958075b2cd16b2b8c36ddc4081
SHA512 3c0baadf2e391337c27bd5584f3386fa6624c9da5f8da3da4e9c626fb5baf2c0121f7c0b1bedfa6a03949c16294f3d311ce3d4ef2007acafa2cdf9facf968d65
SSDEEP 24576:VW6BApg2YuyuNDYTabvcRvNYf8km1wKNx4fl5Tn7UOy/t3z0+ld:VF2YuHNETovcvNYf8kmaKNKfXTnC9T
TLSH
T152858E2927EDC0A4E0BBD27D45B6D286FAB2B8511B3055CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7df5aa83c07f3d3c0db4b2f256e3111b81a3f52458f48962c7722650f512b732
MD5 4f04a608437ac737009c0a47d5bb1afb
SHA1 54d65693cb461dbc7be99a1581cce7e12e9d3ae7
SHA512 d93488bb9a128ea3fe84e0e911c3a51077800c9402fc08ab472f7ed1fad4cccfa529307a9c0b2a11dd6b1b9ca7f73b4081274c061ccc6e29d0948ff1d77dceae
SSDEEP 24576:nAFs06+Omlf3NXEbTobKNx4fl5Tn7UOy/t3z0+ld:AFs060lVXukKNKfXTnC9T
TLSH
T16B65BF2F62EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 3cfee1f8a46152e8c62be8b3d984692b207d57ea864fe3a042668714c8dd8da9
MD5 030b290d4567162979c76bf0ff3c4bc7
SHA1 6808cf885cc5d0cf8b08b58c9c59768daaf58d42
SHA512 30d0b34e99d20cd4626695f31bf1a49ece10b3f3f1f94bb8d27751ea7f41b344f11023329277965dbc7bd9ea0ae6e697415cfd7c50b070b4e89791ee0ffb788c
SSDEEP 12288:KCJnJ5D3Vkrpzxats3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:LJnJ5D3WZkKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1CB75D02DD2A810E8D4B7C2B4819A1795FF72383D2F2269C724B4D5353F22EE0A979F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e4d7ce2c006cbfb5225761b80aacc62a3785c4a90b0c913b5d984f2d027df4c4
MD5 0ecbc7fbd98f041563a03a8fbb52f633
SHA1 bec1d777ace14316fcc8dd8578c24fabfba09f56
SHA512 d90eacfeed50ec1b31f5c8a90469863ca94001eafa5e79e630925b35c72f5df1ef148be2728f2ecc99b44749a702a479a49c1f30b5d4ecbc4ce0df72415e543f
SSDEEP 24576:wEPohm6/7IIXdwcXrif7qQncjlP65i3VupKNx4fl5Tn7UOy/t3z0+ld:Po06DIKdwc+eQnSt65aVGKNKfXTnC9T
TLSH
T12E956C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 954bffe3a4af686f05e8302feb50949d3bafd2cadd57511cbe7a98921adaaddd
MD5 ce0688d1e5f774504dfc9302807be987
SHA1 54a934dc8671fd847641502165f58150669d8854
SHA512 94f0f4e135b553c079d7af7f96f37005e5a1074a259519bb5b0e33e758d1228b1e016c3aabd52e407f1d867cf6208a45c3f2f6cd0437632a73b6be8da268b577
SSDEEP 12288:9EP3RvYts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:evYKNx4fl5Tn7UOy/t3z0+ld
TLSH
T10665126E769CA0E9D1A2907C85B18598C373F07527422BEF6290D23D4F379E9AD3DE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 9439de7e2c1640e4672a6201fb8d51b751e6a32a923e33e1dfabb3801ea13da8
MD5 3b1a303ee072093b7a424e6e004f7707
SHA1 c9d466574386a2da1a549c50e01263d88b89d12d
SHA512 565a770f5e769b3928e05bbf4f5c0b9ab5a897f76f1f75c269b4c6fccb2b9ac846647cee63fe638f5cc35cbc24b67b53b55674bd7d4e69e8e3c90e8f460e678a
SSDEEP 12288:2jkyBts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:2IyBKNx4fl5Tn7UOy/t3z0+ld
TLSH
T108651201639894D8E6F2057899B281E88A36BC306B1156DFA190FB3D5F3BBD4EC35F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 cc3d6c5e022f5ecc4203d10e86ff3720391bdf5210c2358da748732466b6f851
MD5 b63ae68887cb905412a6be91d30b77f4
SHA1 705de1b1dfc173ce62b3113da507b1b6c851155a
SHA512 5e8f751a116dc5737a9d1bc507a4ae36d63f7ab9ba3807d930b74e7e6488c7ea8b6e32bf5735d8550a42073bcde0ec1a8a3bac8e1f0d40e00ad883b56d4757e4
SSDEEP 12288:B8Hts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:WHKNx4fl5Tn7UOy/t3z0+ld
TLSH
T162552316715CD9E9E6E304B055B15AFC46233A3537461CE7B1A0FA388B7A8C6E83BCC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4f3fec8131ec3c76fa9d9c7ed889952e861fe308256bcc8c865c7c43854b656e
MD5 a23b662646893ed84086e25e16ab39f7
SHA1 0f7c7ce1b659ada4adcb7d7f05b9807b2747c09a
SHA512 a0cb1c3c4d6fb7125d785f146a4c7a461efa2dda35eb7a4d8c43268e3ee7c61cb2957ad5fdb2e7a23cd47edccd6c50b4b306d9866fca575de5b185ea50889079
SSDEEP 24576:LQ9MxZKdcz97w3CKNx4fl5Tn7UOy/t3z0+ld:LVKXCKNKfXTnC9T
TLSH
T116557C2DABE9099AE173D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 fe22de69a26b1f02c21abb2c3da95f9863497269240dab2d31d4006517eba23a
MD5 82a325753ea832135fcf02e99f6df055
SHA1 2fb4b74707f4e922f00b7d78c4d5e26ac76144b0
SHA512 535bdc8e9b4c8612cc4677d2390a5193c93967e7836b4bf8c08d2fbbf54873ded1ebaa98faec318241e134af18ddf0a355989097d8dcff824b8aaf10154ad395
SSDEEP 12288:YyoKo2jRple9pVts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:YyocFApVKNx4fl5Tn7UOy/t3z0+ld
TLSH
T17A75E01FB76D40E2E1B2813C89958688E773B0306B5257CB6690C73D8F279E9BD39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 be728401d790af9966c9613d1641d44ee14f776c95a634b99f523de455a78455
MD5 6d10bb92de7b3ff949e95a4b2b57f539
SHA1 03aba753b456991c71e4a1866f764b908494d1ac
SHA512 89ecd95dd3d85b8df2c923db62b6e1c0d5efbace7c062c7941174dff5bebc1b81dc6cd0fb9f5614a07e3bf87d2ef0272e694bbc954bf0c4aec4ede635de1e43c
SSDEEP 49152:rWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKVKNKfXTnC9T:b0zuNI5KNij
TLSH
T163A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b4fbe5b5b609f18e1654945319723b307dc9a5fb04e9c988e26c7ae3913898f4
MD5 2a27a1b723c470dc692382d20e030f51
SHA1 0880c178808c3f7d6b76de5c90c106246b7f32f7
SHA512 a44ebd56b2069b9317de0546906df72107b4636f90290870a6d027d78cca87d82741ea39ed715f152dce541dbf387beebe9706fd90c8ca2798ae1667225578a7
SSDEEP 24576:Y1QT7EcpfxR+N5AWAz3ooiYtjMqbYKNx4fl5Tn7UOy/t3z0+ld:lTDxR+N5YzTfjMXKNKfXTnC9T
TLSH
T17555B12EA7F845E9D1BE85789A33C516FA727821033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 6079b34bfd9c1381d36c10adb2fd44b97a7709fc54633036f3352496cd27bd2f
MD5 35ee727442276907ad4675f91bd37ed3
SHA1 1105f685b0f52f929067ced312e62e508d9faf0e
SHA512 afd04119643b55e1e26e2a80dd47a3107f74d2198546367481ccc03e5235f027fda0850a4ceb36eb2140c86c559fa85dd0304415790b87eb1c2f165e4dcf1ff1
SSDEEP 24576:1TMdOz0FFS+WmSLMKNx4fl5Tn7UOy/t3z0+ld:v0K+WmSLMKNKfXTnC9T
TLSH
T1F675F13EA3AD14E5E47BC17CDA538906E673346603226ADB0690C1792F6BED4793EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 dc6999cf0529934a6fc5b1a98c96ea4ddf96a89b636e1d9f13c71af83a9b59b8
MD5 4f8c21c33ec2ae8a04418f17858becb8
SHA1 d95b2b0dc513ecc7f4e5a58544a7665116fcd850
SHA512 686bba717e44a66eb2b1ad7d287de237ec5370250c8e80cb3ce182ad16fe4dfd9f0b1c568a29b876362beb0733dd99e4cd52a54aae0063ca39abebb34123376b
SSDEEP 12288:q4/Tts3Hz2ctx5GiCHonW15TdNRpUoV60y/t3zw6D2/iogxugRX:1TKNx4fl5Tn7UOy/t3z0+ld
TLSH
T1C765121A63EC64E8E0F351749A7241A886327C3623155AFF35E0EA7D4F3B9C4D83AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/848-79-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/848-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/848-77-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/848-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1020-37-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1020-43-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1020-91-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1020-81-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1060-540-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/1060-415-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/1060-238-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1060-232-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1152-118-0x00000000005E0000-0x0000000000647000-memory.dmp

Download

memory/1152-123-0x00000000005E0000-0x0000000000647000-memory.dmp

Download

memory/1152-404-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/1404-127-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1404-406-0x0000000140000000-0x0000000140150000-memory.dmp

Download

memory/1404-133-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1572-243-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1572-390-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/1572-416-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1572-266-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/1572-282-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/1572-457-0x000000000D090000-0x000000000D098000-memory.dmp

Download

memory/1572-249-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1572-541-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1616-0-0x0000000004400000-0x0000000004460000-memory.dmp

Download

memory/1616-459-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1616-466-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1616-462-0x0000000004400000-0x0000000004460000-memory.dmp

Download

memory/1616-8-0x0000000004400000-0x0000000004460000-memory.dmp

Download

memory/1616-6-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1800-27-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1800-388-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1800-33-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2780-409-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2780-164-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2780-158-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2856-208-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2856-202-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2856-412-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2912-53-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2912-47-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2912-399-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3228-407-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3228-137-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3228-463-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3228-143-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3228-460-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3748-218-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3748-212-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3748-413-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3764-105-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3764-111-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3764-396-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/3988-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3988-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3988-402-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4144-19-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/4144-21-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4144-20-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4144-490-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/4144-14-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4348-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4348-83-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4348-403-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/4456-417-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4456-101-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4456-95-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4592-408-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/4592-148-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4592-154-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4828-185-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4828-411-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/4828-179-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4864-197-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4864-195-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4864-200-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4976-511-0x0000023F23040000-0x0000023F23050000-memory.dmp

Download

memory/4976-513-0x0000023F23040000-0x0000023F23050000-memory.dmp

Download

memory/4976-514-0x0000023F23040000-0x0000023F23050000-memory.dmp

Download

memory/4976-515-0x0000023F23040000-0x0000023F23050000-memory.dmp

Download

memory/4976-508-0x0000023F23040000-0x0000023F23050000-memory.dmp

Download

memory/4976-509-0x0000023F23040000-0x0000023F23050000-memory.dmp

Download

memory/4976-510-0x0000023F23040000-0x0000023F23050000-memory.dmp

Download

memory/4976-516-0x0000023F23040000-0x0000023F23050000-memory.dmp

Download

memory/4976-512-0x0000023F23040000-0x0000023F23050000-memory.dmp

Download

memory/4976-517-0x0000023F23040000-0x0000023F23050000-memory.dmp

Download

memory/4976-518-0x0000023F23040000-0x0000023F23050000-memory.dmp

Download

memory/5072-410-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/5072-169-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5072-175-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5080-414-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5080-222-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5080-228-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download