d15aa7d548199e5641638edb9494863b7b7ef5cc769e06794ee4ad49c0bf287e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Size 935KB
Sample260810-hat9fsshjc
SHA256 d15aa7d548199e5641638edb9494863b7b7ef5cc769e06794ee4ad49c0bf287e
MD5 51b15a91ee3f103b1892571bee8eca78
SHA1 30b50f325d293347e4e34233de75f563ec541fdc
SHA512 573706c2656205a5fac51d84799d9971209880c4d5136d996a9e0ade8cb23ec488a7a60e4a8100a386ae72db6b7b629c85f42a3ecabace64f4d6f5932fbc8813
SSDEEP 24576:iQ8n4a65wpePMWuGMF36YKN4B1Jdi5hbKFlkJtx:iBpePxu37BvdebQKl
TLSH
T179150142F2D610F9E56B9178CA124516EA327C160B60A6DF33D47E963F237E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe

Executes dropped EXE 22 IoCs

pid	Process
4244	alg.exe
3280	DiagnosticsHub.StandardCollector.Service.exe
3644	fxssvc.exe
4784	elevation_service.exe
4304	elevation_service.exe
4740	maintenanceservice.exe
4228	OSE.EXE
3248	msdtc.exe
5188	PerceptionSimulationService.exe
4704	perfhost.exe
5024	locator.exe
2404	SensorDataService.exe
376	snmptrap.exe
4992	spectrum.exe
3900	ssh-agent.exe
4840	TieringEngineService.exe
5156	AgentService.exe
5204	vds.exe
2392	vssvc.exe
2240	wbengine.exe
5536	WmiApSrv.exe
624	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\41aeb393a19fe9b3.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff61563e9228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000847e53d9228dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da0a933e9228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049b07f3f9228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002737f0409228dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088ba213f9228dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005932db3d9228dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3280	DiagnosticsHub.StandardCollector.Service.exe
3280	DiagnosticsHub.StandardCollector.Service.exe
3280	DiagnosticsHub.StandardCollector.Service.exe
3280	DiagnosticsHub.StandardCollector.Service.exe
3280	DiagnosticsHub.StandardCollector.Service.exe
3280	DiagnosticsHub.StandardCollector.Service.exe
3280	DiagnosticsHub.StandardCollector.Service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe
4784	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3512	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Token: SeAuditPrivilege	3644	fxssvc.exe
Token: SeDebugPrivilege	2116	firefox.exe
Token: SeDebugPrivilege	2116	firefox.exe
Token: SeDebugPrivilege	3280	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4784	elevation_service.exe
Token: SeRestorePrivilege	4840	TieringEngineService.exe
Token: SeManageVolumePrivilege	4840	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5156	AgentService.exe
Token: SeBackupPrivilege	2392	vssvc.exe
Token: SeRestorePrivilege	2392	vssvc.exe
Token: SeAuditPrivilege	2392	vssvc.exe
Token: SeBackupPrivilege	2240	wbengine.exe
Token: SeRestorePrivilege	2240	wbengine.exe
Token: SeSecurityPrivilege	2240	wbengine.exe
Token: 33	624	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	624	SearchIndexer.exe
Token: SeDebugPrivilege	4784	elevation_service.exe
Token: SeDebugPrivilege	2116	firefox.exe
Token: SeDebugPrivilege	2116	firefox.exe
Token: SeDebugPrivilege	2116	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe
2116	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2116	firefox.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4836	3512	2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe	86
PID 4836 wrote to memory of 2116	4836	firefox.exe	89
PID 4836 wrote to memory of 2116	4836	firefox.exe	89
PID 2116 wrote to memory of 452	2116	firefox.exe	93
PID 2116 wrote to memory of 452	2116	firefox.exe	93
PID 2116 wrote to memory of 452	2116	firefox.exe	93
PID 2116 wrote to memory of 4788	2116	firefox.exe	96
PID 2116 wrote to memory of 4788	2116	firefox.exe	96
PID 2116 wrote to memory of 4788	2116	firefox.exe	96
PID 2116 wrote to memory of 4788	2116	firefox.exe	96
PID 2116 wrote to memory of 4584	2116	firefox.exe	97
PID 2116 wrote to memory of 4584	2116	firefox.exe	97
PID 2116 wrote to memory of 4584	2116	firefox.exe	97
PID 2116 wrote to memory of 4584	2116	firefox.exe	97
PID 2116 wrote to memory of 3440	2116	firefox.exe	98
PID 2116 wrote to memory of 3440	2116	firefox.exe	98
PID 2116 wrote to memory of 3440	2116	firefox.exe	98
PID 2116 wrote to memory of 2784	2116	firefox.exe	99
PID 2116 wrote to memory of 2784	2116	firefox.exe	99
PID 2116 wrote to memory of 2784	2116	firefox.exe	99
PID 2116 wrote to memory of 2784	2116	firefox.exe	99
PID 2116 wrote to memory of 5400	2116	firefox.exe	100
PID 2116 wrote to memory of 5400	2116	firefox.exe	100
PID 2116 wrote to memory of 5400	2116	firefox.exe	100
PID 2116 wrote to memory of 5400	2116	firefox.exe	100
PID 2116 wrote to memory of 5680	2116	firefox.exe	101
PID 2116 wrote to memory of 5680	2116	firefox.exe	101
PID 2116 wrote to memory of 5680	2116	firefox.exe	101
PID 2116 wrote to memory of 5680	2116	firefox.exe	101
PID 2116 wrote to memory of 5688	2116	firefox.exe	102
PID 2116 wrote to memory of 5688	2116	firefox.exe	102
PID 2116 wrote to memory of 5688	2116	firefox.exe	102
PID 2116 wrote to memory of 5688	2116	firefox.exe	102
PID 2116 wrote to memory of 5696	2116	firefox.exe	103
PID 2116 wrote to memory of 5696	2116	firefox.exe	103
PID 2116 wrote to memory of 5696	2116	firefox.exe	103
PID 2116 wrote to memory of 5696	2116	firefox.exe	103
PID 624 wrote to memory of 5468	624	SearchIndexer.exe	134
PID 624 wrote to memory of 6108	624	SearchIndexer.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_51b15a91ee3f103b1892571bee8eca78_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27099 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {2b4677da-9bc0-4e22-a2cd-5de959cc547d} -parentPid 2116 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2116" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {270e45a7-714f-44a6-b569-2a8b5be36928} -parentPid 2116 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2116" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4788
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3756 -prefsLen 27325 -prefMapHandle 3760 -prefMapSize 270279 -jsInitHandle 3764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3772 -initialChannelId {5da7be28-3dbf-422d-8a12-c5371c96e442} -parentPid 2116 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2116" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27325 -prefMapHandle 3968 -prefMapSize 270279 -ipcHandle 4052 -initialChannelId {d8e998c2-95b9-46b9-9067-643ac62c6808} -parentPid 2116 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2116" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3128 -prefsLen 34824 -prefMapHandle 3164 -prefMapSize 270279 -jsInitHandle 3256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4468 -initialChannelId {fc937775-5e28-4409-b635-63224ac10f27} -parentPid 2116 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2116" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:2784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2776 -prefsLen 35012 -prefMapHandle 2924 -prefMapSize 270279 -ipcHandle 3748 -initialChannelId {3e05982e-c0d2-44e6-be51-d1fc85ade08e} -parentPid 2116 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2116" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5340 -prefsLen 32952 -prefMapHandle 5344 -prefMapSize 270279 -jsInitHandle 5348 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5356 -initialChannelId {4733fa4f-d144-48cc-9330-dd8976ba417e} -parentPid 2116 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2116" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5680
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32952 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {31661f8d-2594-4c24-ad5c-8c2c6a148302} -parentPid 2116 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2116" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5688
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32952 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5732 -initialChannelId {15a9b412-dd13-4164-9ba0-9fb2877c1004} -parentPid 2116 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2116" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5696

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1240

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4304

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4740

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4228

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3248

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5188

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4704

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5024

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2404

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:376

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4992

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3900

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5264

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5536

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5468
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:6108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9a9dd0da001fed2574c3a878e385b402b0cede56e5f74dca0cade12a5a05726a
MD5 6ad6a8b32b2bf7ce01391a72ee84453f
SHA1 f7f4a607bfa5eea77c87ea9cf88cb3c5b7d5d866
SHA512 26d8fc3627655c057994dbf92aa2ba4265e924a8c884d22ed13a08bf3b3c168b4d9281dbc84cb1363ab1744400d62127bffff2b6ccf00db440a58797402d966d
SSDEEP 49152:/b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnwxu37BvdebQKl:93q6mjB6v8Ll
TLSH
T1F8D59D03F2D900E9E069D1B8D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 de4843b0db0c854ca92cb60333b2e6a1845994c9f94f6f6d229c4b73433543f5
MD5 e242fcd72e885066e718ff834e14e1e0
SHA1 53587142f70d8112e2f2a00cd6ec0dff35a541e4
SHA512 5fbf1129e303f6359a6e42d093d3dcd923fa858fc8130a16cb1b66041ec12a0ffad84f58d0220440df1a8afdbcbe0f256b2a9f87469775c008c2396692c38eb7
SSDEEP 24576:cXYfDtczAZMWuGMF36YKN4B1Jdi5hbKFlkJtx:btc2xu37BvdebQKl
TLSH
T13605F12963D408F9ED6B92BCCCA28516E6337C510760EADB03E495391F233D85E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 107705163e3587882795d172aba6156baeb6858e19c8e33681589670aad8e5d5
MD5 6fe85059e583378870f96fdd9d3b2603
SHA1 5465b13ab2fcd194e467e53eb7e78e5eafc58bde
SHA512 2129670c7a0ce1fd51271053624709bd2c0cb03c39f28173bb4b94d546d469f3481dcd15fa1c4a3a210ba035f8936b72bcbd20133638de57719eed54ec21971a
SSDEEP 24576:g0Le5ji0hmxhrMnMWuGMF36YKN4B1Jdi5hbKFlkJtx:gPji0Az0xu37BvdebQKl
TLSH
T130359E16F6748331D073C0B9C5D2A69EE97234861B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a925e61527f8a8fc0056e6e4d93978032f7e4c1d32029bf4c7bcfcfa661d7fd7
MD5 ad9190e634e81ef102e20eeae2217000
SHA1 5f2826a9d727a34ec3c57883b546660910a28cd8
SHA512 a2e1a984bc485a54f447dfb73de5ee4eaf495cc576cdfd33c314eb5c954af569ddcc51bbd2815ce737a7468ce375c20f92853d06d739f31ae5440c03001888cf
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWj6q8wyu5MWuGMF36YKN4B1Jdi5hbKFlkJtx:q/ezSC6vUzPv+Hjywxu37BvdebQKl
TLSH
T1A5755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fa0446f902b1dddec8778246bd471e11c7d46cdfe89398c3a7c1defcdec9a82c
MD5 919cae2ae9553ba6f4a314be5329ca75
SHA1 ddf92c10bd2fe7ccedf0c1f652c2ad75bb06d78f
SHA512 2875ce053ca461d4c06557d2cbd22cda3c9856d385a2cc0b14064df4f5e551991892ec2fd67257e603435d97d75ea22a8de9b6ba6a9788afb8a7fb3595900b95
SSDEEP 24576:aVbqPb88hv/l+BSMWuGMF36YKN4B1Jdi5hbKFlkJtx:aVO88hXl+Uxu37BvdebQKl
TLSH
T1F8559E66F5B48331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 6acf5238862a4989f3cc395c0ac2246e0652f792edb2ced9f3f44265ece4faaf
MD5 8ac0c0e5cf1c8f50315801bd3e2cc31f
SHA1 e0f8f54c294ea44d003b012104f554b9b1aed8b3
SHA512 dd6075a2013fda4a75f3d2cb5169b9ff14dbc881c94e844b65019e9edb771a89da00dd69a0c9dccb2ede16fd4000a2a8da3675b8ece9477de76254e594955f1b
SSDEEP 12288:iG7yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:iG7MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T12BC4238351C5A031EF2831F5AE7DA95E95350E200D20EDFBD690767CAC7A362E8C5A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 2febadc707c92c624e9c82075409c2a6aa45514f5ad82c4a6df62c4dfaa94c94
MD5 62a8666999649833b79812163b07335e
SHA1 12230525c285b79b20996ae261df2edee93881cb
SHA512 4cf1f27955d3c7817392ba9ad5e185d1eb6448376a1448e29bf7375527932f712d859b2922b53aa0649318fbfce74059d0a49f2c7d38a8f36440a67ea20a0b15
SSDEEP 24576:WJIUqMWuGMF36YKN4B1Jdi5hbKFlkJtx:WJIUqxu37BvdebQKl
TLSH
T1F805CF3BAE28FCE2C67E5DB95A91C600D77278304F61A3CBD164820EDE235E15D79C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4e4e284bfa9eb4287f23955c72e1bd4d45e3d6ed07f751c5ecd881fa401b34d1
MD5 bb2c387363dfcd30aef99d4b6fac1b88
SHA1 f5d8ba1fb7cbce6c8d9198bf4e78870fe90ca0f3
SHA512 e3ebbec63f1a0a73dc78af78482145b882e99a826cbe56af7c096900053fbaaf26a79ae0ed9cb7968a56d788b97cf74a93cb2ec3711386930bbb8ef0cdf0d674
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THi:OQvGAdlCEL8c/WRNw5Cmv8Ll
TLSH
T1D1266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 972af4a57ba3cdae78f29d4da0a954e8bb9b6099bc74815e6d250274c5947698
MD5 c1dc5b3cddb63013c803f940a849393d
SHA1 8f9c9d22145e71b14c9415c321904dee9b03bf32
SHA512 baf7ba89ff1bacdebdb8cf231f4c77dc16c07472d96a627ac0d0cece1fcfc6405dc76bc2bd460d1f04e545caff75e68508f73528fadb4550aa1d84d86933663e
SSDEEP 24576:TfewsAjkMWuGMF36YKN4B1Jdi5hbKFlkJtx:jljkxu37BvdebQKl
TLSH
T1F715EF31FA74E032C67B0DB61B36D71A543D6E200F611AC3E3E89A9D59302D26776E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9c59242eac8c984e3639981ffdbb3f47c09921741b8a5e5a8fa58f9ba31954d6
MD5 279afaacc2305972b231893803bc16c9
SHA1 cd69b77e975de8d14d0c3d439d5a91bad2a8e3d6
SHA512 0ebcacedc8274abdc9f12dcbe13b4b0e370c7fdd72e9aa43fa8287e0ff25320020bc42804df3d4526f1ab0842a505a7dafd9c2f2c0dd6f22845ddc0c4995043a
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH10L:MUEtQevvqc2W1cpV20I3210
TLSH
T1D5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8d0e1b16da03d3a4af3ff23f7b9c5602f82bee595cf26f964c659362be6889d1
MD5 5882c7e3df3808bb361a5abff01cc250
SHA1 749f9ecf614f94390eaa1e4f2f79605e7cbe03f5
SHA512 1caa9f917161fef846e27db02c7a4eedb7b114ad4420cff5e1a3aea8ba525874f2a12323393f1381b22d89e8da8977fb1d8673c6511c92c72af880568f55c436
SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/zExu37BvdebQKl:woqtVjnmqv8Ll
TLSH
T169D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3bdd66fe2557cc32ea4d9fc853809be6704f9c702971927309ecc737738a64a8
MD5 62a5db64d3dfe3d708465c2f32a2c3d9
SHA1 7d36e083bb5fee05e03f1a320a9b374d5d5c208e
SHA512 660017f6aedfeffa3ac4043e7a68f1f69396320b3702338c8319b1f680197f31fd36032a292d5c891d78fd67bbb0f836028b34e14cb1b68f1cd112905a2ac17e
SSDEEP 24576:8AhGL6IFoiwtA5l7S53VMWuGMF36YKN4B1Jdi5hbKFlkJtx:8AM5Foiq5lxu37BvdebQKl
TLSH
T16F35AD81E7F955E4F5B3AAB89DB69171EA76BCA61E30C20F2150D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 cc6b89db9bed443f10b497e6cd9721c64d9a8434c635e20933562906d2649054
MD5 a8db808f3656633d4ca4738cd3bc8641
SHA1 cb0404794525ec655e631340305ebf5f8cc7a9e2
SHA512 829beab1da56ddeaa0c54e3826acff8711c5424a579be91cbe8333c3a6fec6387448edfcc8c0e5bdb8e34f0969b377f6366694fe9120973ddc72f21d89cd2126
SSDEEP 24576:MwuROWQMWuGMF36YKN4B1Jdi5hbKFlkJtx:MwSOxxu37BvdebQKl
TLSH
T1F305F14632E41CF9E9665178C957C136F7B2BC112A21DB2F53A0C66B6F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 53f699ec9bde792846827f06d826110472232c88ad1712d5a2b78e441dd4b960
MD5 2df795591985249b31be4b2e7a451574
SHA1 fdc0d8c6b6368512ad5735d84e586bc64c4a7bab
SHA512 f99e4be6e9030eebeedc0ad99c245df00d65442780577736d0afad6b316ed4dd0c827b02da3bcc2f0c06f4fdaa558249ecfa1828ff6fc553bd0f9e4f81f6d78c
SSDEEP 12288:HyZ1IyUyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:SZu/MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T112E4128632D460B5E66662BCCDF59A0AD3723C22173183DF526052782F33BD29D39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 44f58f637f1c9c6d0510052fe62c7aa65fdaf94723d48c3e95b83929a38210e3
MD5 3ddb0de611f6ad4aca05c8ddfbd2508c
SHA1 b18e815eb35902712e4b7c85c180f56ebaba0a1a
SHA512 45a211679c76811973acc505717f4f70b9d73ec94dad5f9f3de0dda175c49f0040da5a3be708fc5992d8781cd962f3a3ba3ed504f2761d055e4b34cb17994cf1
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ue:cQRQyi36YOcPDLvw2gAf+PN37v8Ll
TLSH
T12D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f543b18bdb8013481a93875929143dbbaf20a06542b1994b27685c17b1dbbb09
MD5 bb7e1c6b5a1e2c48c764e9531ffdee03
SHA1 7d741f3727859ee8a34b4bc312908cb730933abc
SHA512 4d2248407c1fdfa04c0c5a804b8166ea7f112b79c8fb5b9d8ad036097afd6364bd2dc3351a34ca2e3570adae768fd850ee9a9653706f5de9bc7e302a5b2eaac9
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ue:TQRQyi36YOcPDLvw2gAf+PN37v8Ll
TLSH
T185667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 afd87d4eac54f469d1656229d47bc44332c4064a5f7871e8f77dd63323441c52
MD5 d6b3f9da8ef8c3f08758805b936ea539
SHA1 ff5f2dd183ac079e705ed01b3080aa92ee51e53a
SHA512 d90fa64e8521f837261c739cae8f55f12bdc2387f23a14b83c815cf5dc041522d615d4c50b64b3c560f1f8f17510042b77865c09166130f4f4612c6c1fbc211d
SSDEEP 49152:D68Qg55nhkeWu7PNU3/0xu37BvdebQKl:9thTRc/dv8Ll
TLSH
T1A2B55A33B2F600A9C44DE1769F4A872196E17C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5c5f8a242eda7a8fbb6db2198339e3fc0a23ea76ac175ef18976177f9637538a
MD5 fd079ce6ac1e5c3a90068bd3d26603ee
SHA1 cb58f7000b769a5ae1f82080261374114527fc57
SHA512 00bf8809159c574fa0607b7811f778474129c41e154bcbd6760444b7db0849ed07fa75a8aa68f5769defbba9f37991456d5cc889b8a712ea1b954ba4fea678fd
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99:ay5112gYy5azzVvU69nLKnhZMv8Ll
TLSH
T147167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a25f1f26d4843d7b0b1d56428811aea0f477228ca399578c923193444d130b94
MD5 59534ab6a1270c37a998ee54f64fd9a5
SHA1 99efbec573a742b44de1e653982f0e2690ced811
SHA512 7c0f7e131df3adc4ca937e3d09385bdce33349a1cb303beec7343ec4e774762c9e3fc1224abecc5ab5b7a43bc65e32e65bb5eaa49a30a3d6e21fabe7dbcdd770
SSDEEP 49152:bB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glJxu37BvdebQKl:Nu6JmIxd2dGv8Ll
TLSH
T199D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6EF0A9073552E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c599f690370ced0a1e59f72751cf0ab9599c0784ca08741c364f1c884f7b44a5
MD5 495660bb641264427f43b407acea6af7
SHA1 645477cf7864247cf135a6d3edee507ff375ced9
SHA512 ac3eab9d54fbec0ddd6b23cff3144fbd95204fef67e9e7118664f44e160d8f9551fc1e9f653baff7c3f3b438aef4967d0bd06ddcba04b874f00192d785a01f91
SSDEEP 49152:q1hpsNoJpF1A67U44CwH7R4xKxu37BvdebQKl:qmifPqRqv8Ll
TLSH
T1F7B5AE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c7c53b1f26b7bee5105493695caac20a4f5cd5170efef3d81659d6b954565483
MD5 1480941db9dd7ef5fe7f3a38e55b1673
SHA1 543495a99675029d09fb8110a93f029daddc76cc
SHA512 5e40f4e7c89e2f53f4dad647818ce98e62eeadf9ddc97711fe270483c1874cbb8e9e3caa0d7a48af2f3a32b43bced4c74c86930430f6e1bd83cdafde4a55ac2f
SSDEEP 49152:bSuZQIY0Be2KkRVtOnks6NMHq/xu37BvdebQKl:J5dKqi614v8Ll
TLSH
T1EBC5BF03F2E940E8E0BEE67487659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 18c1f004dba03fbb237a8b4b2224bff9794b3735608bba25b8307d903a3fd2c7
MD5 e58d90a3413dec29ecc47c1957012a45
SHA1 cff0c39ddf187302fac98ff128cfdbec90bb0ccf
SHA512 b774657d0c425f892a49f4e76c6fe7e9898cc889e8f63943e71356cc97833f43c7373ab1d24a7d5ed9d3b4a9c5132e9602f85f238a7edabaf84bfb6106856805
SSDEEP 49152:qhtSn8EApI0figjgiDn0AP5w+xu37BvdebQKl:LX2iWphuv8Ll
TLSH
T1D895BE13F2D900E8D05ED1B8C7568632E972BC150B34AAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 284d335fa398f05953dd1d5be29034388b3efbeb6554f652b37877c6a7880a7e
MD5 4e5f62765817d13b854d6b2379c4d591
SHA1 d7f902f2d402513a8aebe0e49d2788fb33d4f386
SHA512 62ca878d98b17a485a00476a374e602f0ec9d09555f00cd0a659ed8db909d34c4ee5cdd8c8c19cb3c42957afab92716de5a695072f47c4d7ccf66dda5b5852b8
SSDEEP 12288:BzyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:BzMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1A5C4234360C69032FE1832F99E79A55ED0351E251E21D9FBE6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 1a1c1bb24dc83ede0a29adad54ad004246887217168d9567f146e459ca97299a
MD5 fc14e9366840c9ce0989ac94f8dbf439
SHA1 84f32545dda6676389cc2b2aea3759d05d430824
SHA512 3be3fef1c9deb025c28e389e4ea9db3a355dbcfe97a6da213c722d0e6c0924aac9d23a5f7edd0581d1fda4ca0c98fa0088d486f8e3bc189ab9cdd3e039a8aa63
SSDEEP 12288:IYyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:IYMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T113C4234360C69032FE1831F59E79A55ED0351E261E21D9FBE6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 673dd25ea895a9b638d1d88a0cfe410457ac273d1958913495a0904d6698581a
MD5 fe7f4996007390a63c07521b91114cf8
SHA1 8a102613672a916e0662a3a11e48f70cc77e8820
SHA512 a6aca47b4e45d7476f5c6d0e0f015831b16580673e9e03be72d3592724ae02c57961e04d2675d256717326dd407ea63bee3eb106f74ea8aab792094df0457625
SSDEEP 12288:DiyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:DiMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T166C4234360C69032FE1831F99E79965ED0351E261E21D9FBE6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 29c9e10705abf449b3c501959d7475381448a615088d221154c6da3eb64964df
MD5 e3575f4903fedd786904ffd616cb9b59
SHA1 8b81b7e5ea9b47ee846b2dce30e021ea6c3714ad
SHA512 e1e4c5ce59ef3bcef475bdac8bce3418f60f64349ac7926ad615eeeb6357c284074e8652649f7479350cbd223eaffe407cf4bb39aa81acebf862175933a8e980
SSDEEP 12288:zV1yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:XMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T118D4234221CA50B1ED29B2F9CE79951ED1753D611B31EAFFD680313C2D723A1A8A4F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 85e54a6f71b18c077896abc4ff2ffd7025e2bcae6ba2841db09998ba29d6a804
MD5 916b512517bc7d397747b557de2f819c
SHA1 abc7d7fdd11f545d28c61877af516ebb49fc8dad
SHA512 f3782f12d60d9fc539329c09d6df9623f1debc55610c8f344ab2aa58ec7a931675f2b9ba9ce1223feb63d0d874ab07c3386d3a5a93787a55ad322d57ddf2317d
SSDEEP 12288:V9yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:V9MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T13EC4234360C69032FE1831F99E79955ED0351E261E21E9FBE6C07138BD76362A8C8E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 3387afdefaff5cd190f881bdedc17c95d801a55b1ea8d07ed42fe96c6020864f
MD5 2a92f8f7bf23158055ae63a3438a2e0b
SHA1 aa77ad43e1e46511e1db1b204cb53cef82818f2f
SHA512 b00f91fc293fed457980745f6d55636aef5faaff1d8c125ce3004463b7e08f5ab338633231f0986d354130da88e0ad795fdd48b691d4cb9c952799e4c5515c1e
SSDEEP 12288:78yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:78MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1CFC4234360C69032EE1831F59E79A55ED0351E261E21D9FBE6C47138BD76362A8C8E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 fc2eecda82a7f07f1f4776d4582ba12e0c578eb7b102d1dfb366518aa9d98b6d
MD5 d4211c9e095973d579a839725904e825
SHA1 b9355cf7e1f6e41baf7d4e8637b6ded3f66a9bbd
SHA512 dff669afa45cdc15dd70f5874f8baced7ac22b29ff4b8e490b9bf62c50e6b9883b8911a226b0dd8423006e4dd7a27fb0874490abc3ddda8426c47dd4da14ab4c
SSDEEP 12288:9gyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:9gMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T155C4234360C69032EE1831F99E79A55ED0351E251E21D9FBF6847138BD76362A8C8E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 7b10cdf2a931ab0389e998e68e9ab14c74761d4548cb164d9d32a6f5adcbafbe
MD5 45e68a9c9fb65a230ff4358fc9824a7a
SHA1 1e124b39da16fb3b20eb17f22da6e87a28f887e4
SHA512 c62ab8366c916cf6c4009439310d9ff2c7389eed453478cf5ef17bf7cac78d3fbff33f85f95024f04de6dadfd59bfbeb4c2d15b59b1a5c43532f1d73dfce392e
SSDEEP 24576:NZM3zFVSO4MWuGMF36YKN4B1Jdi5hbKFlkJtx:NZM3zfsxu37BvdebQKl
TLSH
T1FE050295739018F4EC67417ECD65890AD2B27C1A0B70CA6F53E4362A5F333A15C2EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 9b42b901a7031a7acee91d2c08246fbf13f126c2e028b7cfc079b7811297781e
MD5 097cfc05e3d3860411276f05caa0b56f
SHA1 ec4681258327f46349317383e048b789d64b5a1f
SHA512 1a89245572f748a9216409f1ca8e888f01b6ecd7bf54674b4dd51ebc2845c6f2afe12cf5f4b805ef3e5cfc949e2943843ced7156e23ca8e7278c356a5d2b1995
SSDEEP 12288:WvyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:WvMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1D1C4238320C69031FE1831F99E39955ED4351E261E21E9FBE6C471387D76362A8C8E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 cf978dda4ebb9fa02c2b857f36a31932d26823ca21b5bed54c5693088f5a0174
MD5 cecba6da82ce9001f7ac8ecbc1046c97
SHA1 9f989ddfb030f8c5a22ad1b2b212479ee6211e84
SHA512 b9ff08d8c69db8edf0281faa2c5386f28e1ff48a4e81462b19e5556567a38f0eae39e213973e5041027a9b92a211a38b3678efb7634ff9c2dd68517679cd94f1
SSDEEP 12288:BryPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:BrMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T181C4234320C69031FE1831F99E79995ED4351E261E21E9FBE6C471387D76322A8C8E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 f88e73cbe96a69b9066d3c9bfb4b1a668cb4d902639fd64b76a4f3b57f596b64
MD5 3d1256a5790cabc5abd0692e52a4442e
SHA1 d5af2ecb0523a54c5d20274978b62361b1b4c9d8
SHA512 c9e89094d58d3195997c93cadb7c1b55de5158c3dae28e4b07b005be6fcb3541c3955a81fec134b8f47e591d049e32619d776400ce5da6721bdb8acefd0243bf
SSDEEP 12288:eyPz5L8UyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:DzyUMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T18AF40243729130F9D52652B9CD665A06F3727C320B208AFF53A0137A2E373A19D7AB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 f46d1e6b503bef5410e1a36aaf6a042158b18ae7eeb68311404c3b9ccc8e3802
MD5 bbdb558a8aea41e1c63623f87a8b4db3
SHA1 35a4cf5cc2c951ac7dcfe24c4bbeafc7b3f4e30c
SHA512 ce0e7e16e1132010392639853832ecff621d79fe738bca26ac16be5fbc7ba4f8138391e7fdac2dd6ad40c72199fb134cf34251f9b20dc6f1f535650767dcfc9f
SSDEEP 12288:mvyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:mvMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1DAC4234360C69031FE1831F99E39955ED4351E261E21E9FBE6C47138BD76322A8C8E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 16d68a8b154051dd1f8ad20d0b7aa99a1b7094e1866e344c38127cee67d47468
MD5 035c7573320d820ef5eec93598e983f1
SHA1 9fc89d0c7d42a72c0089d79e9cdd15d9904b43a6
SHA512 9f355d6f738d90938383cc62e201f88fe4554c73ffe731f96c53157461516672f21c47617db5b8c308c7b73d7f3d196a10b924d008657ddadcb0b5bf7779b35c
SSDEEP 12288:YvyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:YvMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T175C4234360C69031EE1831F99E39995ED4351E261E21E9FBE6C47138BD76362A8C8E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 66c9066e5bdca309befb98174121fabe235da7049b7d4a97190290e278c982d9
MD5 5ae7bad54f1786d2dcf0071610403875
SHA1 e7af686dfdf937da8229dfd2873c0baa921bd260
SHA512 2c07fca385b1de75e72be028c40f7bd3dd3a10229138971a1576656bd827f1e901d3633453f7589b2a116daf5dae3e9e9b9d6f106232df10d43ae3765e73fa42
SSDEEP 12288:FyPz5L8UyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:MzyUMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1EAF40243729130F9D52652B9CD665A06F3727C320B209AFF53A0137A2E373A19D7AB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 dc79302f8902d73a81f5d2a537922400b10e625aab3f8988329729ef07c03120
MD5 080a7b8842545cc226be3e85638bc74e
SHA1 2f805c675a073d70fc467a82d662417c1e529854
SHA512 7f8b3a3174cd094cc56c44aca095b3ded08909fbb51f4413bb9e97da8e045a131a159befe1093b2f96b18e2303148721bed073abc48c533d21e81a071b18c732
SSDEEP 24576:fT8aLl3z0zDyMWuGMF36YKN4B1Jdi5hbKFlkJtx:fT7Llj5xu37BvdebQKl
TLSH
T193050295B39018F8EC67517ECD25890AD2B27C1A0B70CA6F13E4366A5F333A15C2DF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 bcb986ba15e35cf8bdc47e32b9030f7af579a3575fc554992e02a0d364ceb52a
MD5 1405ea3e5b671e0100a3debf099f3925
SHA1 fa90ec990fb6733f178072a9fe3929c220539d98
SHA512 5978c4ba352f42a00106c83ce9ca4ef8c6610129140bbcb93f0d898de2bd73df5b822d910d690969c69262d5ea750313e73295415e5e7b0f92b59bb90335bded
SSDEEP 24576:Y3rd9CHKy7GZWMWuGMF36YKN4B1Jdi5hbKFlkJtx:ird9CHKyasxu37BvdebQKl
TLSH
T11D25CE90B3E410E8F0B79A758D769512DA767C5A1B31DE8F03A4262A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 131e843a93413d12c3def5e1f71a6dd19e9ed7dc26065c5596dfd0f85015eb64
MD5 1dff8628e98aa4858432435feeb33092
SHA1 04eca6050ea3a8c9b4a12d03c5a1fd0431b2b81e
SHA512 4f42ca530d9164cb0278cde1bf91eec971f66c916bef98cdc8a28a11ea510dc9e24e2baba8b0648522c611c2783cb4b98cf90efed435f4a68edeb7eb08f6c961
SSDEEP 12288:qCyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:qCMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T17EC4234360C69031FE1831F99E39A65ED4351E261E21D9FBE6C07138BD76362A8C9E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 5a9eb265416645adf366beb0c71e1439a3b7ad977cec11a0b4d4ff2a0b7f6732
MD5 4d96d2b57eba753116e25747785ad769
SHA1 3ee90d3b57a9179e1159386b5e172d61a749723c
SHA512 49b70e7b5cbebe1399142db96492394dff99bfdc63be48da3390c941d87c08cacd7154c4309f3264b3a55d38f3532eb8ecbf15f83a442e17976bcfe944baaa09
SSDEEP 12288:U0yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:U0MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T17BC4234260C69032FE1831F99E799A5ED4351E251E21D9FBE6C071387D7A362A8C4E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c140ac7e5fe47ba6e42abfbc3919de1d8d9cb346fd5ad8cca6804a9dc3d77976
MD5 0e3df0331364230b84b46a993d308da4
SHA1 54b8f96c542be77ed84449bd9f943b91ad795837
SHA512 8208cdbfe7c31ce2165f91a79fdb7c2f1910f42c001e5e8c47935566fef03a59099253cbc44ee2b704fb2ff903bd7bb1c368d69401d7a9b8de687fc18cec39cc
SSDEEP 12288:UByPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:UBMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T193C4238360C69031EE1831F99E79955ED4351E261E21D9FBE6C0713CBD76362A8C8E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 012e077a823759434abfc9d73f32ae428fa5871b8b77d985543cfd8fcbc196f9
MD5 5894eb8bafed3f112e2e0aaeb68eb6f9
SHA1 f538191185e8ad7bc676c2ba3b9f84863375fb2d
SHA512 b9e192e1e7562a0b1431cef79f721c429cbc9a34b4320b00239abd0d86310ad86f3147e990fc8509b0a1b08cfa23c8abaf7422caa92893c3431bdb102c7a8390
SSDEEP 12288:upsf/yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:n/MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T151E4F10AD28801E8D46E62B9CB669A45F3333C2547E1D3DBA2C0F53D1F766909DE9B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 55783d1cd9140ad05dfa42ec29359bf1c25aea749d4b23d40d5e0013b7276bd5
MD5 75034803f8400efe14e43647fd18b563
SHA1 d021a0411b6213d78a447554b8caa87a6cdd9da3
SHA512 1c284da7e317c0b7a18e600426c49531f3e0033e6e0cdddb7566a692147057a83b68d0b438ed55a2c12eccf045d524e8f5bc4798c5e6dae1dbcdf26c94d71af7
SSDEEP 384:HwCe7iO024YNDL84KKDL849B7SOEAd9KVRaAcP+AWRMAUeV:QqZYNDL8lKDL8CB7S/AmVAf+hRMBeV
TLSH
T1A6729E399F013CAC1997C0E8C1F892D98D18B6A7DFE6806D21683D0DC7989A9B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 b30cd06d4fab613711b4a90df4d571e6cda36aa5bcd81fd96082d110b48515bc
MD5 da10b215836a3218a702a691abced267
SHA1 e2fcf6fdabf3ac2364f2986e3db3370c54732cf8
SHA512 addf88d720ffb204aa01fd9a1d7b75c4a1bed206094fa5ddf0760d7ed17fb553ee9209e0372f0ef9d96d50294c22e6eed9dfc8ff60c59b0e340503194dd8e76d
SSDEEP 384:HXkRyiO024YJDL84KKDL849B7SOEAd9KVRaAcP+AWRMAz:3mZYJDL8lKDL8CB7S/AmVAf+hRM6
TLSH
T149728E3D5F003CAC25A7C0ECC5B992AA4D18B7A7DEE6C06D21583D0DC79896AB1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6c97c54566f61c05d2829d9ea5fab394952e375f6d514d0990b180fa2594334f
MD5 38893ed0f0278fc5cb95cf25b6667719
SHA1 035fd84c91f37d6cf49eeedc25e07b50922b4237
SHA512 2e9ae19e4f5dc3159dd099c0443a0557b7db4d1e8d1474a470e4e9afa99bf88dc5d1a36daa310374945761438190088d9090a315006af833f05050c1d7241dcb
SSDEEP 192:/1/66JozGzgCl6mc0d0Ov5zboPeCWyj1Q4:N/66JozGzgC1jdboWCWyjp
TLSH
T113E12264E628863FC405027BDCA12B550F3A398B988E7F2935DC611C2C572DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 eb2c40158c45571d574493815390f151147c0edd7c0e8d0a7ee576044b8e7e9a
MD5 cd6381d5aab233d57d2e065e431ee22b
SHA1 0e5fa9035f092600e3b187920825324475d375f0
SHA512 b156a5cc185b4d9f64b89d573ebfee927291adefb08b980f4f83ff240fbada4fc41d7616f962e5581d10f8a1a28c573f22fa46e2f4dffd8a1973a9fe5ccfc39c
SSDEEP 192:COv5zboPJCWyj1OI1d66JozGzgCl6mc0dz:hboxCWyj7d66JozGzgC1jd
TLSH
T19DE13364E628867FC405027BCCA22B514F3A398BE84E7F1935DC65182C572DD7ACE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 e23783c4d1fc2f23e29ee91739365c345da820e0f50835b8058c3414e154de86
MD5 8cf6f4bcde092e3ace9fcdace259d5de
SHA1 fac8c6e63be3daeb7889c01f55c45e22724622e8
SHA512 d0da3ed6d57de7aa1c61930f33564407d3773b3a8ab2598ed6048795cf68d59e39d6f4f321ecd13b1ef847d6ed506a71a051fa77560008e05a916ab1b4420ae3
SSDEEP 192:k1d66JozGzgCl6mc0ddOv5zbogZCWyj1O+:ud66JozGzgC1jUbogZCWyjZ
TLSH
T190E13364E628867FC405027BCCA22B414F36398BA84E7F1935DC65182C572DD768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 38d57c0fe3fdb943991b186cc2e5a1451397e7ad66865327051ea7915ea43c64
MD5 1d32b094ca7e608e7aa85124a1545fb3
SHA1 3b92d255a28d6c1ad5318ea2074289b40d9b49d5
SHA512 5fc9d9414d060561888cc58834b4f5e15bef03f080c1d5121b092f1b39779e427d6084ac39310b2cab5b56e8ba6147a7fa8ad11cdb1fa0b093fc91835b01fe36
TLSH
T161213D5C39B94D2AB9C7E69D7881138E53518F0A048B1D478E02EE8DCDC19DA326E87C
MD5 SHA1 SHA512 TLSH

Submit Download

17809de8-787f-4a0e-8f88-1e0570bb32b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\17809de8-787f-4a0e-8f88-1e0570bb32b6
Size 883B
SHA256 a6b2e17f21ca696c7a92eefc74921717d50092124c8caeb82a8be67f84bf5108
MD5 7a4da11ee0713a6da19f80f10286c0a2
SHA1 1c72681a8562802ffa5cffb6cbb9a2b186cb9ea7
SHA512 79ed2df7613e44709a9c4ac29ca9a2f65545ecb8e9c566c68a930611ffaa54b55cdd62e2ee644c7c73f1397b2f260144a432a664953bb040938d4b8a325072c4
TLSH
T15C112341D634B6B3CD7D920BCE9177128FF9352390C695183DE15A184CBE61E936B70B
MD5 SHA1 SHA512 TLSH

Submit Download

74553dbb-be47-4c55-9d3c-2bf350c74655

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\74553dbb-be47-4c55-9d3c-2bf350c74655
Size 235B
SHA256 a0e8b0d70253dca3c7bba0dd7394e6707c5a12455fb238ee3d411d30ca96fcfa
MD5 5f1d8ee7a85e43bdb37b1b56e970a87c
SHA1 dddf0945e4ce973579a2fd972a4122439505826e
SHA512 980bc334c4733c271534c8a4af80cd97470dc7bc50f2045d6733b2d925149c0c1fd17c3c82e18b106456e2c8646b941de92454fb08db951dd01815bf70fab635
TLSH
T17CD09780149C271E08104F02F0B03ADA30954C339060A820DA9181789EF99D9016281A
MD5 SHA1 SHA512 TLSH

Submit Download

889c36f5-0b8f-4cf9-a491-dc278bd389f4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\889c36f5-0b8f-4cf9-a491-dc278bd389f4
Size 886B
SHA256 323ef9621add84ee3688ad7d7a07db08765e9ab072c37a50509d8dbc0c31d850
MD5 66a8d28eade2379cd24bb2e092e11d57
SHA1 d31d3889bfe334470131b6cd104b5c67de086c12
SHA512 b75fb5168fdbc9181c2059e6ed9201bf42e11708b06cc3bc79284d73ae6de4d6d6ef97709f0b494a89690254ac5b5375aaa92c837598ae93143bb82c971a3cc0
TLSH
T1FA1140409A34F9F2CC2A82479991B353CEE93123A0C655243FA05B180CEE61EB3A270B
MD5 SHA1 SHA512 TLSH

Submit Download

8ae4c501-36b1-499d-8955-a97861f54a97

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\8ae4c501-36b1-499d-8955-a97861f54a97
Size 15KB
SHA256 6d2f479bfd710163dd415f2c82fb0f895d00a2fe246a34fc7679c752ac11b23d
MD5 cfe7c87ec659ec0e6534c450fe16450a
SHA1 574498d9fe74c12aee72ef296c46844d4cef74e8
SHA512 23b8088bcc9e27edddc9ccc5e7169b02f4e222080baa13d30fda3889e5ea1f7128522a730b35c025e228e0bb2ffe95da8e044a3a07501135d752d85bde883cf2
SSDEEP 192:zbCIDAGRSzXRuRcKR6yk/hpzOXxuugac2zZ2CASONkJjbFzqHwtWb7yuDBmq16f2:zbNDAGRSVuRcKRFknzOBtpC7ysn
TLSH
T14272C7565820457A8251E36898FCBFC3E6F638CF4C019FCA9BE4BE085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acbb4adb-b306-4f64-bea9-8e9a6af5711c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\acbb4adb-b306-4f64-bea9-8e9a6af5711c
Size 2KB
SHA256 1bffb579e62312a8786a890cac821bf16a11c444ee3bd49432e0926342a3dcfa
MD5 c0f9f018844e3b8fca7a549682d71862
SHA1 f39a2c72a20e98cc30cd3d85d6f7f220420c0a42
SHA512 496020681c2a6c94e1dddfcb6f75a8c6014a1b5b1bca12fcb1e3e597a374cfcca290bfdfaa73368c5e379ec60e9b954c8d4da742b62bfd39e198c9b8cba0de58
TLSH
T10D41431C757C9DB68DDFE18DD481334EA7608A0300C229D32D51EF4C8CDA69E236A47B
MD5 SHA1 SHA512 TLSH

Submit Download

c3c67850-a865-4e7b-bcc8-b765c4c0450b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\c3c67850-a865-4e7b-bcc8-b765c4c0450b
Size 235B
SHA256 c53c2c041d47220e315414b80f65e06e17d1d49c3dff6f9efc03ca953a908818
MD5 2df0d7bacebc786c2bfddd4266894d27
SHA1 40d1dba7cf959c12a0f87b048c26d72bb6b82674
SHA512 857c6179576acffffe9beb19dc1b5d87f77509033d9c4bd8181cb79785028a825c6ed166b540dac548e0539704a4c1ceb7ed9a99b114a1eba9f38951bea15b9d
TLSH
T183D097C4189877AE48280F16F0E02AC230984C3324A458108A658438B9FEEC8819282A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\extensions.json
Size 16KB
SHA256 049ee07cd925182ffa96053be7bd838cf65183e1b927c5649726fe54b8bc83d4
MD5 378b168d5454f79f4134291bdc205979
SHA1 c38d287ebfa6325491a8d91b22631c352435346f
SHA512 90a46d4536627ff361c86e68828335c8d9f224039575c374e24eae3428e63ece4905d20a7e96b212c55b449aff8fad919ff82c64937f66d83f58485f68622087
SSDEEP 384:qkI4v3Umldvc8dhWA94z196o3tL4HzlL4PTL4HeL4HCL4HfX4hS:NI4PRflXV4H6Ct4p4H4E4Q4v40
TLSH
T12C72421545048EB8298EA79BAA367E01C27D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 8KB
SHA256 00e131ae96ddc02e53151dea180addb81800c25c75f80ed2153ac0dfa676e1a9
MD5 5bfbe395044844c7e53188d497f900d1
SHA1 46cb5164875cc6134bd4f3761cdc4be0f32a5d25
SHA512 da1d0922edc5da04a11936e3978bdd9c8c6fb38d9cec52e6ba4f74a002e54e7faa931aa959b94ad3d4dfc2c7b65a5700c7250dea8c89090fd10cea59948b6a03
SSDEEP 96:xHgpTUPDqGqnf9VXCObzSvgJnSSladv9jppn3WRrgRWq0uBw887W8L4cnFpC:yeORnf9VXCNgdSSG4REL0uBw887Y
TLSH
T13102FD385104CF7F74BA367DAC6889715AB2023BB6BF68D710A954D40548F3442FEAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
Size 6KB
SHA256 795bfdb7c9a5ae72aab80af89d07128119ea1e76a5b3ee7654a9e25da83c0f79
MD5 5a4f09fb6a180cb441f2e99fa7f8f232
SHA1 8bac307a8d05698604ae0f2f173a8319e74f7bde
SHA512 855319229feafaac739863c1d5a686d6905bdc997ce3a6799dfcfa845a87e97b865b3595d98879249239b4153fd4a0155fe3638134f342c9d54603fb12b34331
SSDEEP 96:xHgUTUPDqGqnfLXC1zSvgJnSSladv9jppn3H8RNBw88n8L4cnFpC:yfORnfLXCggdSSGx8HBw885
TLSH
T1EAE11E789508CBBF64B6776CAC6888716AB2013B77BF68C650B594C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
Size 6KB
SHA256 574930d86eb44c0d6d5baed4a626887a5c153d97b48ec2282528670003705c0c
MD5 a18eb159b8f43dd4ae9571c15af9f207
SHA1 cb84e7736c2be967da009b31e8a006c015afb152
SHA512 820080fe4c36211ff79c4e1bda3d891504f62c3ae2215e29072a2793ef42fae54aca6f86052322d153b939912200d5a56d586bfdaf091728f2ae0d7623546079
SSDEEP 96:xHgUTUPDqGqnfLLy1zSx2SSladv9jAn3H8RNBw88n8L4cnFpC:yfORnfLLy82SS78HBw885
TLSH
T187E120789508CF7F64B6776CAC6888716AB2013B77BF68C650B554C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 5bd17ed71bea03576be4ca1bbe811a3f58d7c4a2d4fedcd92e2e408d76aca0bb
MD5 42257b672cd3146e1c81f78bd7910acb
SHA1 cd4fcb76c4cd157a6083093bce4be7d2c5f9d6e5
SHA512 e838c15545b7a6555724fbc38975715bff02f0328aeb8a2df9db1e436bbd3997fdd28adc119a98b814cdb982ef1f2338d25a47a888ac0c90c834ed17ccba4576
TLSH
T13121CA939C3B2EF67B238115C0CC8FA1D758303148241CF0859D491272DE50E678E11C
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 7d134ab243b91cd5aa1766a2cc8bc0f551dd225fc4ba51b18f52847b294c2c23
MD5 eff2363bdfef123ef975ad1736fcc0e0
SHA1 7ee5d81ab93120822a5b6fb8d132aa64bf31cee5
SHA512 d01e3280084815196a5e7d42f10aa83dbdd9a7297b66b5911ff00479399c5976f1a669c8445b0694f74cd63538ff86a6f6902fb0d3d4365acc97b2532e2a5535
SSDEEP 12288:NLyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:NLMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T144D4235361C99036FD6832F45E39D52DA13A2E250F20D9FBF68072386C75662EC94B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ac87780821bb176f67b03315df97cd8683b1dcaca6fe76853549d2e45240f29a
MD5 9fc7de50bcf8122a5f44b59ce6485a1b
SHA1 5f2c24222573431161e73c0278454ce984bfb327
SHA512 85460844497da389dbc7f81112cf79bca4ebf7a774992611a1721f6a6230d12433a594a3a814969342fc14cfa37137db877a104b899bf88adc6ef99e5ad903be
SSDEEP 49152:Ka0h2GEkuAe73q3pp46zwwQxxu37BvdebQKl:Ka0hNYG4Jwpv8Ll
TLSH
T1DE85AF1E67DC82B5D0BAD278C9A6854BE6B2B4260B3156CF1190853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 f9b4cfaa578d9afcf1ee31c2d31d8b96aa4260df03794195fa1b5745b3d0c122
MD5 2fa3f7d9bdeab46dfe07c51e9a85aae3
SHA1 f11cd701e032b8aed9a4a4bd61beb379938cbcb5
SHA512 110fe8b6998c07e3057be4355b75665a3f0e03fdbde3a2d537abaaee3e8a8151ac1e23b908151065f89da7ee4a3fcd7a6da76204240de1a16062c99a40d0902c
SSDEEP 12288:hhbHjfXHyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:hhbHjPHMWuGMF36YKN4B1Jdi5hbKFlkl
TLSH
T1ECE4026E229C20A5F535A1BD8A65850AD331BC250B21A7FF63C0923C5F3BAE15C79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 39541e4e68d708ac58d82d3528edd263ddc109c0040cd48d0f483d7c58fecad7
MD5 2eab0a699bc0951ae603fcab5ac36d20
SHA1 f66595b56b02d3220ea466dc68b1e57b164d7402
SHA512 aecfe0e54b9a0b05493f552b2d27b811061c2c7c438a047282457126bc6ae2e35dc7880a09cf05f08e6f05c5fbfe3b018a5db8aa435da93cfc6673fea33b7f33
SSDEEP 24576:P3YgnJcRTk4yti+R5dBR/vMWuGMF36YKN4B1Jdi5hbKFlkJtx:PIgnaTk46pBR/vxu37BvdebQKl
TLSH
T15C45B02EF2B910B9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 baf3862589c34aa904b35b55f1902bda94ceeba7eea543b2bd8b8c02f5e93d83
MD5 b664cd4b997d8286c89e1223e6935cca
SHA1 774367f47528eec70f61b197725af8f74ccdbf2d
SHA512 626567140946acca8e44ecc761dcfbb75ac4ba9124976c784e0118be050a893037d63dfe4004273ebd96a54e511d45167c72e9d2325317069ba676339b097c52
SSDEEP 12288:t/yPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:t/MWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T166C423826086A035EE2832F95E79D91E90351F210F2199FBE59071387D767E3A8F4E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 0d282334fb4f3b35dfd6115bcaceadf88b2afc1b29c1a75608bbfadcb2091cfb
MD5 11172a9286315e38a598225a9bdd0181
SHA1 a60edfb14c8389a13e9a84da70eb6a710f762ad1
SHA512 a9552672b0c29f02417afaab3a426c19ccd432f936ac94dc1742188270bfd1fb426edb4f8032ff1291f9f1c214ec81accb76bccfddf68e55045f9bf1e94526bd
SSDEEP 24576:EAL3UTiMWuGMF36YKN4B1Jdi5hbKFlkJtx:EAL3UGxu37BvdebQKl
TLSH
T16925F155F69400F5ED6B917CC9768A16E272785D0720E7EF03A84B691F233E28E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 fb64c1dba02ec5d490b962891a56e0c089dbd6f953f933ce82eabb8b741b9048
MD5 f534561a957f92d84eb1a12328f850d9
SHA1 3ab7eae0a3afc248974cae2831dec79f738f369c
SHA512 986ce84c85aeb87e4f2db133880863557029a0ec64657be73fe382c3b188ed9c0836c9531474a9be7dc89b2b0261b43544e28a5694b889656bee112cdd09b1b6
SSDEEP 12288:OpFtvOmyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:yOmMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1EDE4021A32DD10F5E53961BD8AA6820ED3717C220B2297EF42D0817D5F63BF4AC79B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f9891291cf78d1d651e64aa031d29dbb9a7a2d6f8ab26c08dcde3a81e88f014e
MD5 90912fc2bbb7f2abb13fda9a32d6961e
SHA1 bcb64b51b6166889e9654340d87ffbda4f2b89d0
SHA512 ac59e2d1da35d19fefbefe8f701ca18b351b2b5fefc9abfef5a253083701cc567b9c58b8403e6782ee532b2e30aa00f19967df4c0d2f6115c97d6a89cfafdabd
SSDEEP 24576:Z7NM9YqZqmWMUkPjZM48Mv6bEhsbMWuGMF36YKN4B1Jdi5hbKFlkJtx:Z7cBWMpPjN8DbEhMxu37BvdebQKl
TLSH
T17365AE2E6BEC81E5D476D13DC9A28206F2B1B8611B318ADF5152833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 cb30a718a3cee4e37aa535df58a785fab49528e52acb53cfb7fa742cac6997ea
MD5 2e7906a7b3245641cbe8584fe7f287fb
SHA1 4a9dcf04f53b586825867717199755a6d80df310
SHA512 14ebe1eb86b7c997f4216e1bcb78c4976ebf43eebb3b95be63a9075dbea82d857efc5a9b6be0d4e0c4bcf7d5749decc28064bd429ca35f457050db423a9c1440
SSDEEP 49152:5F2YuHNETovAvNYf8km7xu37BvdebQKl:s6BCf8krv8Ll
TLSH
T1F3858E2927ED80A4E0BBD2BD45B7D246FAB2B8511B3055CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 d5ec65b9142106971b42655f209fd9dbb955830531b2627d6b78463a1d37b429
MD5 ce432a598e4dffd425860dd6e306f257
SHA1 c1a0ac38d1925c59619c3824784356dfcc265cca
SHA512 ce598cc4271d42b54bbb2ef888e1f674479c6de5dadbd433be439a3cfad4da6ae4a4800b0897c23d41efdaf74286bbce293c99e661e6b1e0d85313cde1c4fb12
SSDEEP 24576:pAFs06+Omlf8NXEbToKMWuGMF36YKN4B1Jdi5hbKFlkJtx:uFs060loXuRxu37BvdebQKl
TLSH
T15F65BF2F62EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 5ddc1f510e4b1bfbcb2e2763380cfd986cc7511d6f1d50e48b2007fc295afba7
MD5 29f4220b01a6b739ef79692405ebbb59
SHA1 802feef2c3d271bcd54c8b835deab9a2acb34ebf
SHA512 1c8693b5cf026f411b5dd6b3db3aac50a0a29e3ec9f066b223e6a4289cc09f1b321907ddc781b87e1052abf3ff3d67140874be018aeff240115ffb7993cd1999
SSDEEP 24576:jJnJ5D3WXRMWuGMF36YKN4B1Jdi5hbKFlkJtx:jJnJ5DGXRxu37BvdebQKl
TLSH
T12215D02DD2A810F4D4B7D2B4815A1B56FE72383D2F2269C728B4D5353F12EE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ec21eed3fe7212d68aecd4beaede37f9c18ddda699d70bb88d64012e44fcff09
MD5 96f2f89b75686ebb955f083a47b40d28
SHA1 4057a311d39f7fb9dd56c8e7b56c33ed42b1215b
SHA512 33f384e572e74c6a6e7b8822f06a4afaac344dcecfcb0b1f3993cd0254aa42880850a750ec59071a6def332aa48b6c32342977a5839c9c1b6f63d352d8cd01a3
SSDEEP 49152:bg06DIKdwc+eQnSt65aVnxu37BvdebQKl:Uyv8Ll
TLSH
T152955B16B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 9246d123e269ae15930a06ddefe06d731849b6d10665ee53a3e1a13ec3835733
MD5 c7995df1985552b1ffc8f0365e7b3685
SHA1 854615f3e7891545550b226a334eeae040eccd39
SHA512 234ed45c59b39d3c7cc708b86dadce9e5d3f903df6faaad434ae2e185df7f21e590d1129dc46bb0b966249094ec024aa327a23fb08650babed29d42cd982bc04
SSDEEP 12288:XEP3RnmyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:cnmMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T1BAE4125E229D70B5D529A1BD89A18609D372F8301B2267FF52D0D23C4E37AE66D3CF06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 96bbcf8710d907d6022916bd303496f76fca4432fa1069c11d85d0fdbcf18997
MD5 60be16ac99b7779ef63198c38c5dd367
SHA1 3e9c0054486654daadd843e15541063c0f39f82a
SHA512 326e91c8f7b8907c79a97407f466d01c60a94c6e60ee4981e193ff601520b38c324ac871823541a8f6b3b06281a52d1406e4f55940222bcf356b34855aca1f2a
SSDEEP 12288:njkycyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:nIycMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T198F4120163C860B5EA7922B89E7681599A357C301F2196EFA1C0F23D6E377D1AC74F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 02599ce8ab073d1544b597bd311391fc0e41e78da02798324ee8f352388bd377
MD5 ac3714372b951a7b535e7f73b33c5dd9
SHA1 d107d11c3ea2047d12faa8a8068c0037c3626403
SHA512 d993898c9c087310be35013e032197251e371820771b1bc9a0819da500a08ced9e958ac7e83a88095cf1d1739131c615ba5b423318aa459ed332bfca460e314a
SSDEEP 12288:DyWyPrGFTuGmPFm2xMYFR6XWkoIWynyBIUxJrhi5kIrvwnFfNkJtx:uWMWuGMF36YKN4B1Jdi5hbKFlkJtx
TLSH
T11CD423462186B035EE1831F95E399A5E91313D350F20A9FFA5D0B138AE763D2A4F5E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 59ef555e4933c5bf8137b6dd08388f5494dc3a9e9466751c4e99a3a68ebcdc07
MD5 1ec3585a463e3e173dd962fa2b879197
SHA1 93a10bf518d970a8ea6731455812e691da8fb9b1
SHA512 99da472f4cc6ac10039f767935600326a1080268ccbe1265b179e5aa733dd9374ac193796311d94d228fb666a8463cdbbf1c3217257508953e9d4e1806db3596
SSDEEP 24576:GQ9MxZKdcz9dw3DMWuGMF36YKN4B1Jdi5hbKFlkJtx:GVKZDxu37BvdebQKl
TLSH
T12D558C2DABE9059AE177D27995A250C3A633B4301B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 c76e2f4062bdd72114aa6bceec29032e31e3b3b8981960f7960c62f671e350fa
MD5 20286569ad4f8f87c2af0b655653fee5
SHA1 b00b5477002f29626baabb1ccc0ded93132fab12
SHA512 803181e4062a1f744b63696ab33cbae052e5169b03549a42f20aeef17110175c4184c6a1f314a20b0399ec5cc578e38615dac0644f4b03ab4165a9264e9d1392
SSDEEP 24576:zyocDApgMWuGMF36YKN4B1Jdi5hbKFlkJtx:WocDApgxu37BvdebQKl
TLSH
T130F4F01FB7AE40A2E136913C89858749E773B4301B2257DB6591C33D8E27AE9BD34B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 04bdfe44d02e5590bf9f67d4884b88b5739b53429757b5dc16f5d5e7155573ce
MD5 e909710cf5be91ccb1133e7eac70e7dd
SHA1 d2461563a9d15d7efa9ae522f4016ad751e5c474
SHA512 c53820d46967c2e938849ee64458a544d6496224636fa718a962435cf885fb9d937d933e9e810907b244808c8cdff56f1cb5c54cdcd85da753e622eb4f2beab3
SSDEEP 49152:iWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKgxu37BvdebQKl:U0zuNIvv8Ll
TLSH
T110A57C3DA2EC00A8D9AAC375C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 84e921c871df3e84bf13199e17631a09ff574453537a8faebdd663b85242e67b
MD5 6f4a6ae345a162022e91c67776dbcd14
SHA1 8adb51d2e45977654f4170eb45cbf68ac8ccea72
SHA512 ded12db3841e785f440fe1057f2f846c5eb612f767f70ec0f777148bea8c70f069abd55d6328401fd8b3157660bd748bfdb5f8cdcc6aaa8f6981478990ebfc16
SSDEEP 24576:a1QT7EcpfxR+N5AWAz3ooiYzjMqbmMWuGMF36YKN4B1Jdi5hbKFlkJtx:nTDxR+N5YzTBjMtxu37BvdebQKl
TLSH
T18E55B02EA7F815E9D17E85798A23C506FA727821033193CF42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/376-1082-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/376-955-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/624-1045-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/624-1077-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/624-1061-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/624-1006-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/624-1219-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2240-997-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2240-1168-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2392-1135-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2392-993-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2404-1169-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2404-1005-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2404-951-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3248-988-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3248-920-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3280-25-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3280-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3280-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3512-9-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3512-8-0x0000000140000000-0x0000000140101000-memory.dmp

Download

memory/3512-67-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3512-0-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3512-71-0x0000000140000000-0x0000000140101000-memory.dmp

Download

memory/3644-56-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3644-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3900-1084-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3900-976-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3900-970-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3900-978-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4228-81-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4228-89-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4228-558-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4228-87-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4244-477-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4244-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4304-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4304-554-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4304-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4304-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4704-996-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4704-944-0x00000000005B0000-0x0000000000616000-memory.dmp

Download

memory/4704-938-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4704-939-0x00000000005B0000-0x0000000000616000-memory.dmp

Download

memory/4740-58-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4740-75-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4740-73-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4740-66-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4740-64-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4784-40-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4784-553-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4784-34-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4784-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4840-1085-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4840-981-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4992-959-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4992-1083-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4992-958-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4992-965-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5024-1001-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5024-948-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5156-984-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5156-986-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5188-928-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5188-992-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5188-934-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/5188-924-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5204-989-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5204-1134-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5536-1002-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5536-1170-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/6108-1115-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1123-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1109-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1086-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1110-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1111-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1112-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1113-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1114-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1106-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1117-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1118-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1119-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1120-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1121-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1122-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1088-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1089-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1124-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1125-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1126-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1108-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1116-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1101-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1107-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1087-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1090-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1091-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1092-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1093-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1094-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1095-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1096-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1097-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1098-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1099-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1100-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1102-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1103-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1104-0x0000025375410000-0x0000025375420000-memory.dmp

Download

memory/6108-1105-0x0000025375410000-0x0000025375420000-memory.dmp

Download