924ad1f8e5aa6657017f093d97c6b89812269dd208762485e4d48cd9c509d2ad

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
Size 1.5MB
Sample260714-ys6m7sft21
SHA256 924ad1f8e5aa6657017f093d97c6b89812269dd208762485e4d48cd9c509d2ad
MD5 cf9142f404f3d8a6d0f1c1b71779ae0c
SHA1 02335d10bcc98f5eea45f123cd19b7de54080036
SHA512 7a4ef1578d3368e94f685df524f3dc74f1fa1d05c8585714af9445357f871fa4c661cb8103b9de1ab7857aa954f6ac26203765b59f8edabb820c8754e66efda5
SSDEEP 12288:pRLUjmGPQf/gjRpphnUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8S:ppUCPIttatr0zAiX90z/F0jsFB3SQkx
TLSH
T1C675F01273D1D4B3C9A326314FFA8B59A7BDBC605C729B0B23853E0E5D38B419535B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4832	alg.exe
3892	DiagnosticsHub.StandardCollector.Service.exe
3704	fxssvc.exe
3784	elevation_service.exe
1168	elevation_service.exe
2180	maintenanceservice.exe
3684	msdtc.exe
2512	OSE.EXE
2680	PerceptionSimulationService.exe
1592	perfhost.exe
904	locator.exe
4408	SensorDataService.exe
3192	snmptrap.exe
1840	spectrum.exe
1060	ssh-agent.exe
1140	TieringEngineService.exe
1796	AgentService.exe
4768	vds.exe
4928	vssvc.exe
556	wbengine.exe
3272	WmiApSrv.exe
2620	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\12d63b6f68b29bb.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8ee8cf0cb13dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004acb28f0cb13dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050e1a3f1cb13dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e78f2df0cb13dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b75170f0cb13dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008001a0f0cb13dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
3892	DiagnosticsHub.StandardCollector.Service.exe
3892	DiagnosticsHub.StandardCollector.Service.exe
3892	DiagnosticsHub.StandardCollector.Service.exe
3892	DiagnosticsHub.StandardCollector.Service.exe
3892	DiagnosticsHub.StandardCollector.Service.exe
3892	DiagnosticsHub.StandardCollector.Service.exe
3892	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
Token: SeAuditPrivilege	3704	fxssvc.exe
Token: SeRestorePrivilege	1140	TieringEngineService.exe
Token: SeManageVolumePrivilege	1140	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1796	AgentService.exe
Token: SeBackupPrivilege	4928	vssvc.exe
Token: SeRestorePrivilege	4928	vssvc.exe
Token: SeAuditPrivilege	4928	vssvc.exe
Token: SeBackupPrivilege	556	wbengine.exe
Token: SeRestorePrivilege	556	wbengine.exe
Token: SeSecurityPrivilege	556	wbengine.exe
Token: 33	2620	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2620	SearchIndexer.exe
Token: SeDebugPrivilege	4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
Token: SeDebugPrivilege	4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
Token: SeDebugPrivilege	4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
Token: SeDebugPrivilege	4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
Token: SeDebugPrivilege	4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
Token: SeDebugPrivilege	3892	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
4556	2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 5040	2620	SearchIndexer.exe	110
PID 2620 wrote to memory of 2608	2620	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_cf9142f404f3d8a6d0f1c1b71779ae0c_elex_emotet_icedid_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4832

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4988

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1168

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2180

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2680

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1592

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:904

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4408

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3192

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1840

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1060

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4152

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4768

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:556

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3272

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5040
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 32b5aaf12d93e4657572415651c3b542e15df6b7325b2f8c51e9d1cbb8603571
MD5 28bb4372e77e587a8efb7d00c0545722
SHA1 961a19d547c807fc7907e35738d772a6bbbe0cc5
SHA512 1862ce392fd9d9c22ddcff2439a9aaf6500c052c5fdc3c99acc5f44d32bd3bc2963aef3cc1f47b33fd03951a2d21395be3d9ea6586dd46186bc53fbfb6823f2f
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnBaB0zj0yjoB2:E3q6HjBXB2Yyjl
TLSH
T166D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 09c89d7de6442b30fe50448ff99c696ca16da03065d31c33dbfde9a85097eccf
MD5 a00a6c031a219922cc1cc060feaa0eca
SHA1 529aed1f6db1df7f0590f9f52be3941e9c359d8b
SHA512 24799ed9dd4ef65991c32d4c5a9357a9a0342a4d742a18a2df8d43e41ad1898bd15e4559a8fcdac3920ece104f6adb093aaac4a0684ac778d868d591b5049109
SSDEEP 24576:TXYfDtczAsatr0zAiX90z/F0jsFB3SQkd:2tcTaB0zj0yjoB2
TLSH
T19D65022977D504F9DC67823DC9A18506EA73785147A0E7CB03E4AA2A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 eaca2bab7ae56d2da1fa72de6e7941a413012add580d98503101d0284e28da2a
MD5 253f3ac74b408dfacb6f8c2cc01742c5
SHA1 0d2d3e07c752d3f25a03b86f75506cdcfc8d0a36
SHA512 92b534694e7749b6be6bf640c56ecfd9f0152ec6245922e82eeb150b72bf7c4ae189c2534beb269dea3a3c4791deb54c98be68473ab7bf0e44d4843b7f86537b
SSDEEP 24576:00Le5ji0hmxirMJatr0zAiX90z/F0jsFB3SQkb:0Pji0AcqaB0zj0yjoB2
TLSH
T1F2859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2fec25940ce182b7ca4c4f4489450394027a2ac614e3b00f6f66b94d2145176a
MD5 6beddffdfb958eb688ffe443f647cc39
SHA1 717bcd216eb43fbaf6cdd839f8a1a6bc186927cf
SHA512 05a3c4265e734828de493e4d183d3ff7b0e7624841169f92eabbdbde61beffd6c997f841f946b09004672ae73795d6be21d3c345f8e60c55a06ce898ebf18779
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWE6q8wyujatr0zAiX90z/F0jsFB3SQkc:H/ezSC6vUzPvxHjyeaB0zj0yjoB2
TLSH
T1AD755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2df6ac06e195b1275ed50d4007d03acf23b96b679b02ae2ca662460543b666a7
MD5 eac92eb9383b5d9c48d167585b1dfe68
SHA1 52d695894fb464e181e1c417a41584c253e895ac
SHA512 829cb21ccdfb3ad2436fa5ab226cc2a9422787a877f2de7221262207009d24e9e68403afc7b0168798aa5e9ce97a3c9f3ce8f688d13b1ad3072e59b4efe8e8c3
SSDEEP 24576:fVbqPb88hv/l+6oatr0zAiX90z/F0jsFB3SQk5:fVO88hXl+taB0zj0yjoB2
TLSH
T14B55AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f023d975e72db7e2d6186d5050919ab62571e070973fb96eab9d5f87d80689c1
MD5 343dba4898114bc8ae2d251d3d33ff56
SHA1 f4243d4fc3da7f428c6a181cf93ba6ea56df44de
SHA512 19d79f189106a46c79b74114fd92ac5bedfd68f4fbcac424ca33add93fc7f599b0cc1c1f8036993cd1dc62b240f8f1ad1b98fa20aa818ccbedccb0e38af83cab
SSDEEP 12288:2RFUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:2RFatr0zAiX90z/F0jsFB3SQkQ
TLSH
T19145230B341E80F2CDC32B3526989C4B1AB99EB065E2AF45E2913F4F9D3C1C6D6656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 08f91d19a45f04cc1414cdccdeb0cfdf16ad38a086b7a5f1aca83ea529988096
MD5 3f968aa0f387768161963dde359ebbbd
SHA1 6d492aefdb18ff0b665b2a57c971ad51af7e71e7
SHA512 b01cc474eeccb2b72c970080840b71b960a1a391994eaaf3ce0ca50181f517a591149fba7e576d19f7b70b074020de0c4db55db6516a98f0dd0eee4663b578b0
SSDEEP 12288:geBNUbTVO86UQUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:gJIUQatr0zAiX90z/F0jsFB3SQkK
TLSH
T13965CF3BAE28FCE2C67A4D785B90C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 713655ffbee40464f9b4a181eb3f821fa171c215a8e48e2dc070b727c66d802f
MD5 200265d55e349ecb55682e8fa140a62f
SHA1 97c015519b074124bb17112f0eedf4d9aa39535e
SHA512 70fba7a554283c889a8a83a03f90eaf20dec660038a548c020f723d007db9d3c522941c97275f0197687aee69fdfefaef7f6b9a7ead2e4c6ac4fec98d1e92170
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:1QvGAdlCEL8c/yRNw5C+B2Yyjl
TLSH
T1FA267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3fc7c734108f42bd0e11fbf800ce1e94d0f179bb54aa8df3ccf060a2729c1ea0
MD5 4ced63f9619425d787430e8e6f19dd49
SHA1 3bc7d7090784467948fe842efe67825f4eacea9a
SHA512 52205f81fc7720dc86325f46a2aacf9d5929773ff36a29b4b355620203d9814e080194d3b9e69e8e05e41636b4795b3a902bd8ea5670f58acadc95b843c284aa
SSDEEP 12288:BAwSfxL/2Dc34DLLmt0LDQewsAj6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHN:idewsAj6atr0zAiX90z/F0jsFB3SQkV
TLSH
T17E75E031FE75D032C6BB0DB61B25C706187D7A604BA21AC3E3E85E8E59342D22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2792e533e694951b0b2d5b24b5d8b7aa0cec35b314d901cb11727f309b28f9c4
MD5 127ab9e1ab761b9b7179fb47ed747ec2
SHA1 2be17531c0afc7db8d138a999e6f34da7efd29ef
SHA512 ccc5ada20511a374f0dbb183ba7771f45b74456448b580cdb2e86adad54a4d2712397e789b5ddf14332c018cbde67dfe249ddb8e6c08834138fcb1e4b8c96537
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVZ:hUEtQevvqc2W1cpV2EI32P
TLSH
T1FE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 07e45670d46ee2786f4507174708f3f1a0b38d22edb9f02ffb3776d1e102c4b0
MD5 ddc482539ff7c7db39bee7fb3d397384
SHA1 c3586afa16a809759ce55cb4d28e3cac3826ac2a
SHA512 6a42d7bb3ab31c1ab3db662a9287d2d236f9cb514040977fa2193566f5816ea002df53ffc5212b04306dd5f68639d7eef9e0419608bbcd8dd8a4fba4839c3629
SSDEEP 49152:WCbRquA/m2yL5zQfFiV+XenmE3/zaaB0zj0yjoB2:boqtVjnmqB2Yyjl
TLSH
T125D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ddcdf8e445c3ca8b23f6d7fa9e58c0ffdd85ba77566471085d6143d65e5448a3
MD5 7bb416119b2351189be1a2bf71c779ae
SHA1 bda20c7b936b8030cc1cd841fc85e18e62f7a344
SHA512 5a23b3d36fe4ea2d494f0097709818bb5e96a3c34ab2b50b2cd67c6cc9987f39f3b4f675093cc65d822006300b3c24ca75924c953ba20cd0f77d71e86c777cc5
SSDEEP 24576:4AhGLJIFoiwtA5l7S53Xatr0zAiX90z/F0jsFB3SQka:4AMyFoiq5HaB0zj0yjoB2
TLSH
T155359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d93717184a68460d48cc2a81ad95e331dfdd64ff03cef5a3b5385c1c705fed4d
MD5 bc92cccfb74629772bd7215fa2aba606
SHA1 ff8f6344059e73bcd1502a3ae75cb437613b418f
SHA512 1e65d1dbc52e65c64ea20ddb1fa12657cf1ea870d283135349ce97b39e84bbaa6c44363cc2a27bf3ecb257569d5bccacc17df63712762c34be2efcc5d5ed4b5a
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+CDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:7wuoOW+atr0zAiX90z/F0jsFB3SQk3
TLSH
T11565F14A36A90CF9E9A342388587C536F7F2BC112A61DB1F1360CB5B5F37251AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f6a6ff8ff15f20be985603d5701dd253b4101f32eb223d5e7bdec605cf1ef3b6
MD5 baddc360b9d8bc7e77b65eb75516322d
SHA1 3a9460218dc67bcbf4ee5fb0a5b5f414bc52c743
SHA512 bdc52b0e3d6e840639b0b72ead220986dbf9e708a289c819a4606af1e5f2dfb35e1fc47aa3c4e06f33b25d3050cddb47fc0869713002ffd282b88e98231981b6
SSDEEP 12288:DBZ1IyKUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8M:tZuRatr0zAiX90z/F0jsFB3SQkp
TLSH
T15355124B32A960F6D5D3523C89E48906D7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ba077f3f134387a87389ac3eaf2f3337ab9672eea075a3c364972018f1539e50
MD5 1c01410be36fffbe7b94aa8917a2ee0c
SHA1 bea6ae9702328166be59b411a42c08c2062ebc41
SHA512 5f6e06f51d0bc8aadc25087cafa32f48e944fda164279db170fd807b2c0d78a1fd3c6f9f97c42f49dfc100d02e29e4b925734a137fa137b6b3a907098b00e7ba
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:pQRQyi36YOcPQLvw2gAf+PN3LB2Yyjl
TLSH
T1EE667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e01453f59edb30a0fc5029835d465a3639d6449449d46dce9687b5d5055b0896
MD5 390026cdea8f1afc206b3ca0c3d9c9b9
SHA1 8e7742a747b74261b35fc1084ad0535241356656
SHA512 c05cd13acd46c733319fa29d6a82729d8d4a001c5ea2778f6d75f4d97a3f78301147523b8dfec9c4f9a3a7a17468e7224d7d47beb5d86813c8a0503f1547ea93
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:tQRQyi36YOcPQLvw2gAf+PN3LB2Yyjl
TLSH
T15D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9d3b8d6d5d9ae77f2e048bd3106f5442dd369845c9ff9b527cda7b619a207e60
MD5 2b9f19b57bd847950a342d2a90a7e377
SHA1 f6e200f9e96571b3840ee9a0d0aa3dc8559f0548
SHA512 ba10f7ac0ea71f1d5d74bc1ae533283d0ec69be000d0b26bb07fb2a9280dd80780c3690ba284f5b092306ee714b29be17141244882024e0e23b18604ce061b7d
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Batr0zAiX90z/Fu:H68Qg55nhheWu7PNU3/qaB0zj0yjoB2
TLSH
T1F8B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a03c65a7e0111d238a45ec43793c3822487b2458e62f8ffad55ee7b36999af1d
MD5 7d7845a8907a0149538709ba0f4ead47
SHA1 b76d17ac5f6cf46064931888b8e60861978344c5
SHA512 af6eeff3cc1e3bc3367659dfa9158b8e243c4ceb71acc9d8cbe22a6d60652a514b095c63886a0f625c6218f9747118855d3993c713f22c4fd947127aede812b0
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99k:gy5112gYy5azzVvL69nLKnhZ0B2Yyjl
TLSH
T181167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cc55a9a69e6caaa2a1fdced22e100f7af3e0c19f1e082a6629944cec8b9ce4d8
MD5 a700ef414374973a50726c403146a85b
SHA1 4eedeb98d377ca0839349a2ba07e0cc3f1e5b67a
SHA512 b551984e4677b794d401b6775d768328ae727ce46def92a0c9478a024c7e7abed4c15fcc6154149fb02ca5ada14c205099896205ad70c331ff5bd9f70733928b
SSDEEP 49152:PB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glcaB0zj0yjoB2:xu6JmVxd2dTB2Yyjl
TLSH
T1DDD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e1c3d7f2413d8ed9c8bda51558f64477a3b379c82cda5ddd117d26207f2f866e
MD5 1b13ad7a2589ff4ffb5ddff056a9b401
SHA1 e4fdc87f1283d5b79d432334ec2bc4505927364b
SHA512 b8949c8ca8c128f7a06956710b896593dc78248098ebc344ec5ba22b472eab5151eaed6b0b5d07fc8d73cd1536ef3b4f094e801c0ed844e5b23231dc59ff6f44
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4xwaB0zj0yjoB2:OmifPbRqB2Yyjl
TLSH
T139B5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6fdc917c7d4a8bda259fd1d220d08411f11b9619a3db90538f5930bdcd07057c
MD5 a6bffd5e0b9b1c4c130b977b86be3167
SHA1 94faef9b0af960eb292cd7f13dc85e4923c747ef
SHA512 93371b700b3db4b4528b38e332ccbc3ed0a7ef2ecd55e67bf22d6caef9826e72f5a8c785441411c7a0c05dc4d5663115d9ea2b9ccada907c58b7f7270f4cf03a
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqRaB0zj0yjoB2:S5dKTi614B2Yyjl
TLSH
T1C0C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6f519a4d3e6b0e06f05b6def0cd3a2a0aca20132f5aa081df6735afaaca2084a
MD5 f458a20e5df515a76984af38ebf052e9
SHA1 74d6502932241ec9c91cfb2ca84310ae782f3e37
SHA512 edc5ea792ed9a7054d3d14a9d74affcdf470e2034f22b6d925b064895ea8bf2e6a92f40ee22ddfb12bc67d7642cc1e360a6d950aedc67287b1552fe0b6436454
SSDEEP 49152:XhtSn8EApI0figngiDn0AP5wsaB0zj0yjoB2:GX2iyphWB2Yyjl
TLSH
T18F95BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 514bd45d6918f8ae14885f275725b102c60cc186f1ca2406fbd84c1e85557a1c
MD5 9aa2702d96a097485f93a4bf1575d3ee
SHA1 35656c9a0c4bf2496f47fd4343405ee780957708
SHA512 83e87c168b272190140452aa4078a592d7f21b4f3a4a4e731fe0cb24104d215079078c717c41845fda75e8840039dbc0205c0a55f19c312c008f580631fff00e
SSDEEP 12288:XtUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8g:Xtatr0zAiX90z/F0jsFB3SQkx
TLSH
T11945230B341F81F3C8C31B355684984B1AB95EB476E36B85B2953F0FDE382C716656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 20c3f22765184fb6bbbcc532cf0ea2c87548efc5f79ab7cc1d841badb84fbe13
MD5 74cfa1a3d150f651889370b66ebfd510
SHA1 cd0d42caa321b4e9a4837335b7902bf8134b5de5
SHA512 7d9d5e71d227959c7ce53112e9f6b51cf5ca5df3dc64c63cd4679cab051396c3452d23b53ebcd0ec42a4df4f6e72fee1e42acb8ced8580bcd9d6c7c7828d0fea
SSDEEP 12288:t2UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:t2atr0zAiX90z/F0jsFB3SQks
TLSH
T10D45230B381F80F3C88317355684984B5A795FB472E3AB85B2D53F0FDE382C61665ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6f1331e5508a27327c132a1d50fa6ca5e062dda70b1a9ea160c91ae8c85abc63
MD5 c7c470faed5a5af04998f0c812e0b5d8
SHA1 a132d23d9a6c90b49f6c5b9b81730602c04af025
SHA512 a07741f61d0c6bab2c8db51e51b03703ee11b1f84c147500d238b2d9efc651537d436e5f03922be5d41eedb757b1efcc02070885d14be0c19a4aad97639e774f
SSDEEP 12288:uYUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:uYatr0zAiX90z/F0jsFB3SQkd
TLSH
T1D545230B381F80F3C8C31B355244984B5AB95EB476E36B85F2D63E0FDE382C616656D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f63c5b66ac8becb21be75d017381b2a893078492a921295d733c1e28683232c6
MD5 a3c85734a2d56ad22e41322d826b388f
SHA1 35e58dd82e364ce229a8f9508299e1f691e22198
SHA512 6c1b64a4f9bd6b1f84d97bff2e3dbfd6c2d669e41078ec375cb824f5e8f3b8c5b671941e54542ece301099d2eb6bf1d3a9b3e9756915391acbe054219912253f
SSDEEP 12288:tV3UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8T:vatr0zAiX90z/F0jsFB3SQkm
TLSH
T19F45230B351F40F2C893973586948846A6B5BDB0A3F3AB9FA2413E4F4E343C56935BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 39385e2e7c32f0b38f65952962c5da0a8203ac58668b58517d8a6360448716f9
MD5 0f5f3c3e9e8a735d353bea8097248886
SHA1 f4f5409c8d2cf1b4a18426a7acf6a02471351677
SHA512 d3eb8ffba2df802825d8dc8e22e40d023bd36d90af7f38b56023d5b46790b11b32bb39a8bcfb8f382cefabb7f9f295571e972b14dad78fee63efed78b57bbbcd
SSDEEP 12288:zPUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:zPatr0zAiX90z/F0jsFB3SQkC
TLSH
T13E45230B381F80F3C8C31B355644988B1AB95EB476E36B85F2D63F0F9E382C616655D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 54f015e225ca6634dcd5d2b6a3495e207e779de8a7f60960b1a660d4775651dd
MD5 16e1bc0e6f8f18974fa7c4947bfd6bbf
SHA1 cb22ec82d9bb1d5fe41356272eadf1d51c595d56
SHA512 a429fd5f664c0e1b2c699c1ca686392cb535800fc9824633ad0183fda2691dc4931aecee1e203199ad0a849b024984ba87f63ce7a4480b5894578b395d026fed
SSDEEP 12288:YiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik86:Yiatr0zAiX90z/F0jsFB3SQkH
TLSH
T12A45230B381F80F3C88317355684984B1A795FB476E36B85B2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8d602148947d93f7114dc3869a46857df7f438d8922ae01a5f8ccb171ec8a923
MD5 3f9e53d69263e8b33a273035153d69f9
SHA1 bfff9b6eb5884ca26153d49bcacfc137780d9998
SHA512 ed6fafe8331df14f0f3bc1c4a049f5b956cf9dd78fe20cd57a5ce7b6b2a970917adb0fea59594ac899e43c693afa9daf88f975f7862301415a32769bce7d714e
SSDEEP 12288:QuUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8k:Quatr0zAiX90z/F0jsFB3SQkl
TLSH
T11245230B381F80F3C88317355644984B1A795FB4B6E3AB85F2957F0FEE382C625256DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d8570b469b6f24cfe3d1b3b817bf2b96024068aa85e98e18e3de3aca78935e8c
MD5 80f716e2fc427dd8fe222d96f59b138c
SHA1 339d84faca4e9112c20924ec7f9b954d000b9f91
SHA512 7eb9511a5ca7681c6ee6c2a8775863fcca152563856f3f44679188b2266bdb0f73f37e46f1c38a41cb61c07ea62d74229d74afbd78a30866b54ad760cdfbeca2
SSDEEP 24576:cZMSzFVSOWatr0zAiX90z/F0jsFB3SQkG:cZMSzfyaB0zj0yjoB2
TLSH
T15B65019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a07dd9b7d20abcb94531264f3f4e1bd82f3a756c3840da1d02eca9f170075d68
MD5 1bd1f2421b5b7df3075a861303ddd69d
SHA1 85c93a26364845a39517bc8d0bb79cedcca44010
SHA512 48443b7ddbb60ac8392cabb40d17eb217a772adaa0f376af28fca7d866f9ebcbeb9d0feb9e0d5a72aa007d57dd51f0880ea6afd5ca955f994cef4c29555d6bda
SSDEEP 12288:/hUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Y:/hatr0zAiX90z/F0jsFB3SQkV
TLSH
T18A45230B341F80F3C8C31B355684984B5AB95EB472E3AB85F2963F0F9E382C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 eef4f39571b042bc7a38d1de3a6f7b4bfa725aa468dc675aa05d07fff01d8cbb
MD5 a3217d0d7f6bc13de9a751dbf56d3360
SHA1 662344dd76780ea4bff08d9b282678c05cccce9f
SHA512 56ae0e2a0589ab3231fc201d2e9bf4b5ef3111afc89b85537bf5aba312f1b0ca4303d1ccb2682dd92a16103f69a9899a120a0274e546a489522089b784237b5a
SSDEEP 12288:BVUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:BVatr0zAiX90z/F0jsFB3SQkT
TLSH
T1B045230B341F80F3C88317355684984B1A795FB4B2E3AB85F2953F0FAE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ad2d86950851dd1882038a651703b297286d83e08e3dc9fb25ff2f3b711b63b4
MD5 19367efee516c23f76d243f3e4d24627
SHA1 6abedcb36350dfd713bbf94dbf492cf32e2e1944
SHA512 30412e376324ea03944309c5cac7ea39192bf62248bf9bcd666d9b35d78ebb9d420c59ca7beb111bd7d18f66bc3b00aaee7b9f1f4a164594d4d75bf2caa1606b
SSDEEP 12288:0yPz5L8KUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:tzyKatr0zAiX90z/F0jsFB3SQky
TLSH
T1F8551207326620F9C4639239C9901906F775B83117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4288d17940036c527cc22ce66c3b7d2cda91fd591663397902734f95ca51bae1
MD5 5589547a68c440c2090152c0c99cb16c
SHA1 25cb7803989deda0e2f26ec26d23f7c13ecba356
SHA512 8281a8a0c2578d292f402d729514cc848383b479a44a184c5aab6d80282ca27a322c6ad147c54cb94a3d082eaeef2af49c4b0c90436bb621d4a0501209c64822
SSDEEP 12288:ChUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:Chatr0zAiX90z/F0jsFB3SQkR
TLSH
T19C45230B341F80F2C8C31B355644984B5AB95EB472E3AB85F2963F0FDE382C616655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d33d721bae9f4366d4c4d6973984195f1394cdb844a6718af5c7cefbc3abeb79
MD5 b1279572bbe7ebfaa7e55e75fe37de97
SHA1 026f965dd15de2fe27d29196dc5ba0195fea87b3
SHA512 1f0bc16ea14171d074c8a94d29b0c8d59ff93b98f95ec3d3f863231ce491d1f7d18114ad7175a7eaac8d20afd9b2c8ce305fa2942e4551ade1b2a82980ee560b
SSDEEP 12288:PhUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:Phatr0zAiX90z/F0jsFB3SQkH
TLSH
T15745230B341F40F3C8C31B355684984B5AB95EB472E3AB85F2963F0F9E381C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a97ed780a82342880228daaa14b627bff30bc5fe4b1ac1b0b92bd2ff1903fd74
MD5 edbf5d011f5bbf694f72c7d99d84d9eb
SHA1 f40addf0ba523ac681187c968994b1f1e7ae554e
SHA512 a3a333d19605626053e3a7a9aa02fb588676e0094f87daf3ae8fadc4142bf22b851fad6154e1242fa4b96d7446568b304a11e54f578b2719acce6bfdb9739a8a
SSDEEP 12288:tyPz5L8KUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:EzyKatr0zAiX90z/F0jsFB3SQku
TLSH
T1D8551207326620F9C4639239C9901D06F775783117A19FAF53A02B7B6F372D15E3ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f88647b3f99bef2cdedae7c91d8d99ad12414b8b1cabe36ab9f336af3d18f934
MD5 9c029ed037745b5842d3edacf24cf650
SHA1 5997810bbf1bd4b90b7bd90aba71bbc428c29228
SHA512 63a4bdfbc8d5acd69772b4d3ac815498480f4fb5bdc5a722cd3506b66461bf3573a97394af28e08873aa62be1acbbf03965250cdb9b8ec07a6edcadeddb24bf1
SSDEEP 24576:KcP4mcvIjkGOxhKP2l71nNKbrh/8KB5atr0zAiX90z/F0jsFB3SQkV:VP4m4IpOO67W8KzaB0zj0yjoB2
TLSH
T13365BE2DABDC0096D0BB913485658A4AFAB1742A1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e0f5042d8306e05aea9df40a0b5328727866285336578da82bdedcd1d69b30c9
MD5 97d3af939b6d7d909ba46a4b0707a559
SHA1 3f1a3ffa4707ab318f90ba1df2816623a35c2199
SHA512 e163ca9815bd2a54b512f95f29021512165ef3947d1536b94f90eb6ceab31f965a2c41c1083214030ce55986419bed903e93fb663932930f776d7fe43c610fc3
SSDEEP 12288:SNsfRUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:rRatr0zAiX90z/F0jsFB3SQky
TLSH
T1DD55F00AE25801E5C4AE6239C7544A41B7777C6493E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7939a3581db45b71a69bf689b83a9d6a1ae171d0f2caeb6dc2fc9240645d8cc2
MD5 2dac24343f7ca885b42587daa124488e
SHA1 57688f3638c5742ce65f473021b218a05d94c6b1
SHA512 64b39abf979df5fe2853e871dbd9b4de1b30165da7565e6327fb54e2116e2c7284b051936e1999f3640d3f2f4bb737ce1d52a908f95b93f7382afce905ee0afb
SSDEEP 12288:uxUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:uxatr0zAiX90z/F0jsFB3SQkT
TLSH
T12245230B351E81F3D8E36B341658880A267E7A746BD29A8BF1813F4F99385C259356CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e1674409512d867f9efa98855463b3fa2a2c1b1275cf5a86a5c50936f56033ef
MD5 f40442b2e22cd8b06cc2d841df03cf8f
SHA1 85aa63ede69f0d858d683fd8412e63e3e42484f9
SHA512 fb6dc97e2db4182737c548341c1eee3f8958c20a01912914ad6dfead8ed234531ca71a5b2d2b7cb80731c4f150ae827c379e39b0c5c3fe583d2e7147fd0bb96b
SSDEEP 49152:Fa0h2GEkuAe73q3pp46zwwQPaB0zj0yjoB2:Fa0hNYG4JwVB2Yyjl
TLSH
T18585AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 9ed8d3e800fe43ed87e1219a7dc5054814cb1823edbb9db72199320903c9c8cb
MD5 15d34ca9484533aaf7ade3f3a0f5f31a
SHA1 8e695ecc0e8bf86063468f55e4afd61a62158147
SHA512 f936751bdd36c1694eee5308dfa60a169da5a00bc4cc2418db19657d8db55bddfaf5efda8da6dff5b3e25fbf690e4b13f96a2ce927ccc2d0f06fcbb92e6901ea
SSDEEP 12288:OhbHjfXmUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8H:OhbHjPmatr0zAiX90z/F0jsFB3SQki
TLSH
T19A55126F26AD10E5E4B2A27D8584850BC731BC341762A7DF22C1A27F4F3AAD51D35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f1660637c434865133d3c924bb6473b61050ca3dab499d66211d5b8fe594b752
MD5 ca8bebf2adbd42b94e596ed5eb2edf18
SHA1 4569d49a95a3f0ffb7eeccd1d39acf421d450e2d
SHA512 eb876c44c4c6b9edffef1418130f2c5b05f273ccf82b44e212c9e707729ec380b3f90db2c7cc97d7a4e2e81fa6be660fb1a75ceab810726ed659d7c1d476b888
SSDEEP 24576:J3YgnJcRTk4yti+R5dBR/+atr0zAiX90z/F0jsFB3SQkC:JIgnaTk46pBR/+aB0zj0yjoB2
TLSH
T1FD45BF2EF2B910F9C8A6D236450147B5BB71782D1F209ACB0170C639AF1AED85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 6a736382a47397cefeeb34c12e1bff32ab801426077cb7ffdf6d5536d1114d14
MD5 b180715d58f7756738070b21942677c4
SHA1 dbb3a011380c9e49bf6c6bfae6b267a16aad72b2
SHA512 4b8655552e03000c790fc65d86bf9857da04fb6822da215db950b2a69ae56ca8484c0e0776a26e2225a01ae91e7ab5cab3d1e70e8d7c87a974d70c3dfb4f3458
SSDEEP 12288:ClUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8y:Clatr0zAiX90z/F0jsFB3SQkf
TLSH
T1ED45230B340F80F2C8836B755688884B1A796B7063E36BD7B1927F0F9E386C756356C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 f2612c6383994fde914b58b0a1216be3d8113d9784aa926d4ea86d1112213984
MD5 7f75853b42a932c06eb4d5b7e75478d7
SHA1 51c97cc1da5634deb11bfff9387eedd1dc2eb658
SHA512 41eb3a627626ce59a9ad9ad5d4bf2c2e920205ff8191b08a1ccffff9efb2d5bc4898e46855ab0a717c363f62ed9340c2cb9652af93d324114930c4779203fa99
SSDEEP 12288:qOb9A4LWOsvAYFTsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:bpL3UTsatr0zAiX90z/F0jsFB3SQkm
TLSH
T1AC750106F69500F5D867923CC9A68917D672B86C03A0E7DF03A85F5A1F237E24E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 8c9e0ea34f764168c6b01d59275cf765da81cf8c601a391ea02fffa642349664
MD5 4a1bb86d079080ad52ec064bd677347c
SHA1 57d2352e94c5584d289bb6accdc65019d5bf73ef
SHA512 af2da7c452fb16c8e96d6f2056c2f13cd458af743c43692dad9aeb4c1bf680f9c60784bba9fbe747b4e4e325bd52752ce4e3b3446784b6fde855ed570ef9f378
SSDEEP 12288:HpFtpOwUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8x:rOwatr0zAiX90z/F0jsFB3SQk8
TLSH
T13655021A369D10F1D473A23C8A81820ED371B871176257DF42D0A66F5F77BE86C3AB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5c0832f2477ef6621efb055d7d70c21f1e07684fbd7768a2438699188a108564
MD5 48377a278b27086c2b1a9d8fb4800460
SHA1 567cea0f5a78c1e9e4299132a65355506baaf28a
SHA512 d82ece451be1381f1da00d64981a2ef73398ced50a7c81dd12e0ac9690e361c9b1caba9bad01500b373e5c775ee8866b2fb53dfeb260a32c97831500e10ac8e7
SSDEEP 24576:N7NM9YqZqmWMUkPjZM48Mv6bEhshatr0zAiX90z/F0jsFB3SQkm:N7cBWMpPjN8DbEhGaB0zj0yjoB2
TLSH
T1A765AE2E6BAC81E5D477D13DC9A28206F6F2B4611B318ACF1152833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 dc078e775a5b062960ada7ed622bdbb719282370e1afd95ef3e8056b171cf1b0
MD5 359705b834b480ff22ac1675f91df75c
SHA1 92e2c33683cf975471efb0ca20a4a29f00d666f4
SHA512 f48ae3e91725eab2365f66f73235e7176adf1f9742f9601456a8d5039ffe0b8e842e332f54eff8c2322cf4af7f78c0f59f6488ef907249fb5e892b9b94655914
SSDEEP 24576:mW6BApg2YuyuNDYTabvcdvNYf8km1batr0zAiX90z/F0jsFB3SQkO:mF2YuHNETovAvNYf8kmBaB0zj0yjoB2
TLSH
T1FD857E2A27ED80E4E0BBD27D45B6D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b5f1cbbb51c40c99c01b9f0ecc2bf8c3813959b34d89aa4a50de9d92682958cd
MD5 efe2e4dab5b60e31670b28929d810561
SHA1 8ede3fe87eb95fcdaf99d5afb7af8481aea559d3
SHA512 de08ac78782e8c6b5f6dc6772b10c43a24d45525ea9e46cbd7869348531a62548d2555f57d4551d6f1a5e9149816466fe6045d191e588dc0f469039e19c3d768
SSDEEP 24576:sAFs06+Omlf3NXEbTo0atr0zAiX90z/F0jsFB3SQkb:BFs060lVXuvaB0zj0yjoB2
TLSH
T1D965BF2F66EC00D5D07ED17D8A96C91AF7B1746307215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 4e381c39558c4c14fc063fd739c552df11aa095b39faf3702276e55a902af20a
MD5 9724f87c3ac23338a1b77d7766790bca
SHA1 f3bdea8ffa07b75d63e440fbb50a0e403dabf1a1
SHA512 fc877c79bc3ce2b0e1da19453d62d31207cf80bcf92731daf118f4fa37a0640aa54811c71f7151721cbeb6aac74bec5db4a4d0b99fff0c4db0415855e6a5c154
SSDEEP 24576:vJnJ5D3WXvatr0zAiX90z/F0jsFB3SQkb:vJnJ5DGXvaB0zj0yjoB2
TLSH
T18175D02DD2A810F4D4B7C27482591B46FF72387D2B226AC724B4E5357F22EE09A79F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8919483482f5c5213650da816db1ea9ee96bf3f178e2aff2895651048b6e99d2
MD5 8129bf4864a7b279ea1f5cefb78e9828
SHA1 95f8c33eee0ce0fa7b15e1dafc3b5dcc92888148
SHA512 dc5cbd209f3c306eafd8645fe5b0c749100eb319cc527772851a91b8db7840acea9525b2dfb4b86046365936d46d75a19c19964595d5b9ed400033255c52cb3d
SSDEEP 49152:lg06DIKdwc+eQnSt65aVtaB0zj0yjoB2:+mB2Yyjl
TLSH
T1CF956C06B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 86aeb6cc4061d2adff00d9ada0df7c8658ba5c08b7af3e2fdfd74ca9c5f555f4
MD5 e3574219affd4b0af4658476c1a472dc
SHA1 cc7a01d1bf5485fb4f6a0e2cbf927c04ef1bb1a6
SHA512 996b7efb7befdfa1c789636d5edf647a8d00c867864b9441ddab201fe9fb8d6a701663cbd4a20f679e1dce81c00c41bff671ef7f8fe7e98f8a2907a8a92beb90
SSDEEP 12288:xEP3RnDUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:inDatr0zAiX90z/F0jsFB3SQkC
TLSH
T17B55125E365D60F5C463A13D85908506D3B2F07027932BEF52D1A63F8F36ADA2E39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 38036408092382305e5647570ca51c2a8b03375b27e74f5944997ddeee908a03
MD5 938c7dec0612927c24cde5e6c09f4e94
SHA1 9fd2d52bf4bc98e58292da9519da7590ff573702
SHA512 bca47dadbe7c8af3b4096131ceaf605329b06c39418cae61464944a4a83ca5d48fcd37e836f35065153edaab02d267ede79fb745489ed2a864534e1696dc30e2
SSDEEP 12288:Qjky2UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:QIy2atr0zAiX90z/F0jsFB3SQkR
TLSH
T1ED55120A335990E1D9B306389AA181855B75BC306B6297DFA1C0FF2FAF357C16D34B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 1def767c33924bebc449940919b2f6e70e9fef0c193478b6268c4a1a4fdd2827
MD5 40e142c683a8c436efc1335fdcd47515
SHA1 b6321880ff476016720b32a8b24ff6d2deda1671
SHA512 fb18af3c62d1cfeb3f25e3cebceaca85b32fdfefa647289839b69bb1542c14289ac2a232e4cb777bc335de8641c98d4248b4d5621ee06208e0368f6ec0e35177
SSDEEP 12288:fyAUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8S:qAatr0zAiX90z/F0jsFB3SQkf
TLSH
T14145230F341B90F2CC8317795258894A16757A7027E26AEBB1D1BF2FCF382C62575AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2ef87a060471053bebac1f0d62b9b0fc6cb18efdf3546b6e53d7e907379c0cf8
MD5 bf78aa563164997f80cc65bf4050f0de
SHA1 66221280859c0e3975b1192d1de4ddb64f90b939
SHA512 3d155248e7c9dca65f2fc5f036bb39e21b044a95f27f77c42740f919540786e774689475da07cbd2237e0041bc026a05f2818ce002066f47cb80f75fbd1b3c54
SSDEEP 24576:2Q9MxZKdcz9dw3patr0zAiX90z/F0jsFB3SQkt:2VKZpaB0zj0yjoB2
TLSH
T19E558D2DABE905DAE173D23995A250C3A673B4301B31D6CF2448D13D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 ea677ff740980df27178779dd2a3efefcad80f4a57a69b520aecfccb41b58341
MD5 77426a3c8b22992f2c0c16b9d98147f0
SHA1 0a80a1bdeb545bec85ad596545f7fc373646f6f7
SHA512 f0a2e72a7265bbed093f195a17b69492c7e1a0d8a3bea45c46476bedfee4d2f5495b931295cc7c0cd4fce73825d803902c20a7a5c7fba2658c9d8c174b65a9c4
SSDEEP 12288:HyoKo2JRple9p6UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8d:HyocDAp6atr0zAiX90z/F0jsFB3SQk0
TLSH
T1E165E01F7B6E40E2D063923C89848645E773B0705BA257CB6191C73E8F27AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8273c6e040abf064a8950e542b006a8e6ce13582e50d64634d2e19677dd8a7a6
MD5 4c91ea04f39c80403547343ea01a701b
SHA1 ab62a4ce3ea92942b2102dd3f8cfd697359ca3f8
SHA512 395f93efb6621076a169d695d4c371a8c4c0ae7b126903743726e21f3d8fabf5005d46b60825da233e2245fc66e63121c9d2338488ead4c3f295314e7954936b
SSDEEP 49152:tWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK6aB0zj0yjoB2:N0zuNIjB2Yyjl
TLSH
T136A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b1174600e44df181ee510ee5ae78fae96e767f242647bd91a3938d7537217b0b
MD5 57d3afcf402c40085656b42d816dc8ea
SHA1 08e10854bc96218605a6ee11a3351d3a8d831fb3
SHA512 b6c575d33ca8fe8d52fcbad70b688de902a165c6516444d28e33065aee205ef1e5676056c6c329517e4a3527024c18c04d815a1f0bfc3dc6c556bc36add4482c
SSDEEP 24576:u1QT7EcpfxR+N5AWAz3ooiYtjMqbDatr0zAiX90z/F0jsFB3SQkk:jTDxR+N5YzTfjMQaB0zj0yjoB2
TLSH
T18A55B02E67F905E9D1BE85799A23C502FB727821033193CB42A0C17E1E7B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 f3b19718220e4fd4b15c35f0f0458a62d8a1825e975852a3e6b55fbafe8fd809
MD5 03d7cf663950ec7033860b3398a7da00
SHA1 e2ca5b30bac115e9a254212d5f70764707c1dbe4
SHA512 2d9d6f82231342edc76e418e6514ff3d532e27c75530270251b0fc7ea5422a9c7c22f1d0a64aaebabd79b90ce6327ef235b9dc9734f9a1ada0124be1d20f54c7
SSDEEP 24576:MTMdOz0FFS+imSL3atr0zAiX90z/F0jsFB3SQkf:E0K+imSL3aB0zj0yjoB2
TLSH
T13875E13E636D14F5E47BC27D96428906E67234710362AADB06D0D17E2F6BFE43A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 75a00b2094857ae26c3543890b68fcc69d7e1963d49ed31b8d954855cb29b2d8
MD5 7bc61e503ad62982d507d59566aa4915
SHA1 d844a0754dc6a25f83e4ab6327de84e50065c194
SHA512 c754b633597a7aa24600fa4ba7e9ddf8f32a00c3a34338af43777e5a87a1ae4441cfc9d992a57c50350b7c2b52d7385a763c41349f4e3be3e150a807b7e62fad
SSDEEP 12288:i4KsUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:osatr0zAiX90z/F0jsFB3SQk8
TLSH
T12855120E32ED20E1E8A35635966445468670BC7123A26BFF31D0FE7F8F356C59939B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/904-156-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1060-160-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1060-120-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1060-126-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1140-161-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1168-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1168-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1168-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1592-90-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/1592-155-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1592-95-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/1796-133-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1840-159-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1840-115-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2180-63-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2180-53-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2180-65-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2180-59-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2512-70-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2512-153-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2512-76-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2608-355-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-369-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-388-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-387-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-386-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-385-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-384-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-383-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-382-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-381-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-380-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-379-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-378-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-377-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-376-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-375-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-374-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-373-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-372-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-371-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-370-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-354-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-368-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-367-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-366-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-365-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-364-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-363-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-362-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-361-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-360-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-359-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-358-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-357-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-351-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-352-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-353-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-389-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-390-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-391-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2608-356-0x0000023A22CE0000-0x0000023A22CF0000-memory.dmp

Download

memory/2620-402-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2620-166-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2620-200-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2620-183-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2620-346-0x000000000C950000-0x000000000C958000-memory.dmp

Download

memory/2620-167-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2680-80-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2680-154-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2680-86-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3192-158-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3272-165-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3272-401-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3684-199-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3704-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3704-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3784-32-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3784-38-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3784-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3784-399-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3892-23-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3892-24-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3892-15-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3892-335-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4408-157-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4408-338-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4556-0-0x0000000000400000-0x000000000062D000-memory.dmp

Download

memory/4556-228-0x0000000000400000-0x000000000062D000-memory.dmp

Download

memory/4556-6-0x0000000002400000-0x0000000002467000-memory.dmp

Download

memory/4556-2-0x0000000002400000-0x0000000002467000-memory.dmp

Download

memory/4768-162-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4832-318-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4832-11-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4928-400-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4928-163-0x0000000140000000-0x00000001401FC000-memory.dmp

Download