3bf0c59087a8dfa1ae28048b5a4b0dd0d57aaff7b6e52b1f587e1a7cc42988c5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Size 1.7MB
Sample260825-etz29swgmd
SHA256 3bf0c59087a8dfa1ae28048b5a4b0dd0d57aaff7b6e52b1f587e1a7cc42988c5
MD5 ae9748efbaff594df074250eeaa0a17e
SHA1 1f1c0a0b427f170b9ac1577a67f1238fcf30b738
SHA512 a6cf9ca741c2be3c2ecaa959c4d6825f0d591a858b5a719835c1372bd5580ea5f8039b9b091d6ea932ec40e3c64c00fb12ba734b1c2ead704e5e9298b2f64b6d
SSDEEP 24576:HQ8n4ad5wpe9yxknw4FYnshx8OfVe247:HYpeox4x8EVep
TLSH
T11B850255F3DA10F5E16B81358A124516FA62BC564770A2CF33A47E8A3F33AE09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe

Executes dropped EXE 22 IoCs

pid	Process
756	alg.exe
1684	DiagnosticsHub.StandardCollector.Service.exe
1356	elevation_service.exe
1084	elevation_service.exe
4716	maintenanceservice.exe
2520	fxssvc.exe
3252	OSE.EXE
5804	msdtc.exe
5636	PerceptionSimulationService.exe
5940	perfhost.exe
6008	locator.exe
6036	SensorDataService.exe
6084	snmptrap.exe
6124	spectrum.exe
1772	ssh-agent.exe
5180	TieringEngineService.exe
5380	AgentService.exe
1368	vds.exe
3864	vssvc.exe
3456	wbengine.exe
1104	WmiApSrv.exe
5488	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\63add23379c0b0e8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006485e7c4834dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009431827c4834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c56eb7a4834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000becdda7a4834dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015d0f47a4834dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fb9127b4834dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8ccde7a4834dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086d75f7c4834dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000304c707c4834dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016836b7a4834dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1684	DiagnosticsHub.StandardCollector.Service.exe
1684	DiagnosticsHub.StandardCollector.Service.exe
1684	DiagnosticsHub.StandardCollector.Service.exe
1684	DiagnosticsHub.StandardCollector.Service.exe
1684	DiagnosticsHub.StandardCollector.Service.exe
1684	DiagnosticsHub.StandardCollector.Service.exe
1684	DiagnosticsHub.StandardCollector.Service.exe
1356	elevation_service.exe
1356	elevation_service.exe
1356	elevation_service.exe
1356	elevation_service.exe
1356	elevation_service.exe
1356	elevation_service.exe
1356	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4888	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
Token: SeAuditPrivilege	2520	fxssvc.exe
Token: SeDebugPrivilege	2220	firefox.exe
Token: SeDebugPrivilege	2220	firefox.exe
Token: SeDebugPrivilege	1684	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1356	elevation_service.exe
Token: SeRestorePrivilege	5180	TieringEngineService.exe
Token: SeManageVolumePrivilege	5180	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5380	AgentService.exe
Token: SeBackupPrivilege	3864	vssvc.exe
Token: SeRestorePrivilege	3864	vssvc.exe
Token: SeAuditPrivilege	3864	vssvc.exe
Token: SeBackupPrivilege	3456	wbengine.exe
Token: SeRestorePrivilege	3456	wbengine.exe
Token: SeSecurityPrivilege	3456	wbengine.exe
Token: 33	5488	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5488	SearchIndexer.exe
Token: SeDebugPrivilege	1356	elevation_service.exe
Token: SeDebugPrivilege	2220	firefox.exe
Token: SeDebugPrivilege	2220	firefox.exe
Token: SeDebugPrivilege	2220	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe
2220	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2220	firefox.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2968	4888	2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe	89
PID 2968 wrote to memory of 2220	2968	firefox.exe	91
PID 2968 wrote to memory of 2220	2968	firefox.exe	91
PID 2220 wrote to memory of 2452	2220	firefox.exe	93
PID 2220 wrote to memory of 2452	2220	firefox.exe	93
PID 2220 wrote to memory of 2452	2220	firefox.exe	93
PID 2220 wrote to memory of 696	2220	firefox.exe	99
PID 2220 wrote to memory of 696	2220	firefox.exe	99
PID 2220 wrote to memory of 696	2220	firefox.exe	99
PID 2220 wrote to memory of 696	2220	firefox.exe	99
PID 2220 wrote to memory of 828	2220	firefox.exe	100
PID 2220 wrote to memory of 828	2220	firefox.exe	100
PID 2220 wrote to memory of 828	2220	firefox.exe	100
PID 2220 wrote to memory of 828	2220	firefox.exe	100
PID 2220 wrote to memory of 4852	2220	firefox.exe	101
PID 2220 wrote to memory of 4852	2220	firefox.exe	101
PID 2220 wrote to memory of 4852	2220	firefox.exe	101
PID 2220 wrote to memory of 4432	2220	firefox.exe	102
PID 2220 wrote to memory of 4432	2220	firefox.exe	102
PID 2220 wrote to memory of 4432	2220	firefox.exe	102
PID 2220 wrote to memory of 4432	2220	firefox.exe	102
PID 2220 wrote to memory of 3284	2220	firefox.exe	103
PID 2220 wrote to memory of 3284	2220	firefox.exe	103
PID 2220 wrote to memory of 3284	2220	firefox.exe	103
PID 2220 wrote to memory of 3284	2220	firefox.exe	103
PID 2220 wrote to memory of 4804	2220	firefox.exe	104
PID 2220 wrote to memory of 4804	2220	firefox.exe	104
PID 2220 wrote to memory of 4804	2220	firefox.exe	104
PID 2220 wrote to memory of 4804	2220	firefox.exe	104
PID 2220 wrote to memory of 3772	2220	firefox.exe	105
PID 2220 wrote to memory of 3772	2220	firefox.exe	105
PID 2220 wrote to memory of 3772	2220	firefox.exe	105
PID 2220 wrote to memory of 3772	2220	firefox.exe	105
PID 2220 wrote to memory of 3312	2220	firefox.exe	106
PID 2220 wrote to memory of 3312	2220	firefox.exe	106
PID 2220 wrote to memory of 3312	2220	firefox.exe	106
PID 2220 wrote to memory of 3312	2220	firefox.exe	106
PID 5488 wrote to memory of 5616	5488	SearchIndexer.exe	134
PID 5488 wrote to memory of 5884	5488	SearchIndexer.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_ae9748efbaff594df074250eeaa0a17e_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2040 -prefsLen 27099 -prefMapHandle 2044 -prefMapSize 270279 -ipcHandle 2116 -initialChannelId {e67fc6fa-66cf-480d-91db-cc9b37589fac} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2452
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {c126b68e-0e73-40d5-acb9-a4fb3b1cba30} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:696
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3616 -prefsLen 27276 -prefMapHandle 3620 -prefMapSize 270279 -jsInitHandle 3624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3632 -initialChannelId {ea0cf70f-7376-4107-8c0a-d9ae08443909} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3808 -prefsLen 27276 -prefMapHandle 3812 -prefMapSize 270279 -ipcHandle 3820 -initialChannelId {7cb9e76d-b73c-49dd-88c6-771b9b400c80} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4852
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2848 -prefsLen 34775 -prefMapHandle 2764 -prefMapSize 270279 -jsInitHandle 2768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 904 -initialChannelId {f86058b7-4bda-4f9f-8b59-6e4cbc30ce39} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4928 -prefsLen 35012 -prefMapHandle 4940 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {9819f60b-5834-4040-8c81-941de2079bd4} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5096 -prefsLen 32952 -prefMapHandle 5100 -prefMapSize 270279 -jsInitHandle 5104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5112 -initialChannelId {8bb20bff-f661-4be5-84cc-7fa692cdcd7d} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2896 -prefsLen 32952 -prefMapHandle 4856 -prefMapSize 270279 -jsInitHandle 5128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5136 -initialChannelId {a460327f-22c9-4880-aa68-c05ce90a510d} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:3772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 32952 -prefMapHandle 5484 -prefMapSize 270279 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {5a6352e2-ddb7-404d-b63a-2c033df099a7} -parentPid 2220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:3312

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:756

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2520

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3252

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5804

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5636

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5940

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6008

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6036

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:6084

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:6124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1772

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5284

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5380

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1104

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5488
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5616
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7d00714881ddabfe0c8a12ae0092ff4f80be5cd816e42e57e8b81e51b6982c88
MD5 e101750588628315688ccf0b33398b9a
SHA1 3943955e40e3f7ff2808d7e416475be7d0f76d4e
SHA512 c7cf73f718a24916a0ff3cb0e045ca2e50faa85d80ece30553ac2d41d5e43a1870fb34d3b85b8717dd1cf71036eb41b3f970360b50a52968963b21528dfb9401
SSDEEP 49152:Db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnhx4x8EVep:h3q6HjB6ix8EVy
TLSH
T165D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 a20fde47f21d708c75f63e3ce1a9636be556a9e77a83eeb4c798b6a478848d10
MD5 3d3cdbd5080ecfc27bbcbfb2af558af0
SHA1 13643e821bb5d7f8878b5334581053db778772dd
SHA512 fdd97ffddf0c89b3a6f1ad1efdee5193e427d2e379cc7b3f663a9b44417bf24e40d7aea17c18635e2f607a2e5457c5f702f775ef9a9a895a9ba4a7c17031bf74
SSDEEP 12288:X1XLsswWkxy2lRq2czAT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:FXYfDtczATyxknw4FYnshx8OfVe247
TLSH
T11B75F12877D508F9EC6B8139CDB28512E633B8914770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 f25eb69477dbebb53d5092f6c2b413c1d606916aec2accef17337f567a4ce653
MD5 1ce18d1ba855b86ea6622f4b9505b177
SHA1 01d5c8b28ed9eafaff6e5655abf95d74f23a8279
SHA512 ccf7d5ef0c4462d3ad673faa1e072d278aaf4a520d7180eb06db6f2133b8301c3a1a7a0e210dd7f9da25a9df68269170ff39ae2f62f023ccfc1be38807d26205
SSDEEP 24576:W0Le5ji0hmx1rMGyxknw4FYnshx8OfVe247:WPji0A7gx4x8EVep
TLSH
T15195AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5ee6bc5a46a97b79cb53e94a10b41587cbf82f498d9875904face52499ae01e9
MD5 011ac5be46634a5040789ed7753c6faf
SHA1 25acd81b2530cb617e0692aa6a858be5457d2104
SHA512 1bb777f6cac94b46984b2e27410968b855cf2ac6b058846a38a6571b674bf6ec61aa0338ba99d0a18752bf8c1d7e94102dd291dc77441ecb6e5b350e57272af3
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyu8yxknw4FYnshx8OfVe247:9/ezSC6vUzPvxHjycx4x8EVep
TLSH
T15A756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c2471fdc237468d6525db76e7620b8285ca7b84b3fdc57470637a4bf282116b0
MD5 c67f3fd24181b5c90fcd45b9df0c0982
SHA1 f778d748f50e87c7726dce0355f79d62fe590c09
SHA512 73059063bac6bb18ca50f76c4c99c51fd2609d6221602526dd5a4088158bd2180fcb7298d6b5e500a478e804e1a2fe38b0af9274384559b24b67a43ce4448e63
SSDEEP 24576:+VbqPb88hv/l+6/yxknw4FYnshx8OfVe247:+VO88hXl+1x4x8EVep
TLSH
T1B8559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 95d83f12d437f6a6d9507c7d08fbb2ceacbd00f44ade4d6496b094b7aa10a974
MD5 52e645229ba56ade0b765c757c0f4d31
SHA1 0b8da1212548c0581aeb6ff8dfe40d4b656f765e
SHA512 ec398e0c8fe87a5a265cdc27dcc6f1df307fc6a1fa96161412e7e55c8695b3621d04f1652a7a763004a60fa903a98e7807bdf09148dd008dd42e8cc5946b1b74
SSDEEP 12288:tNC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tNCyxknw4FYnshx8OfVe247
TLSH
T1AC65237CA7DDA4E1FA5E15331B7572622616BDA4DA74C11BCB78B14EE0F0C60E06E213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 5daa2c27a4b21afed47aeb76e7f8a1a975c5e262a6aed08ca2bf5d5e1785c304
MD5 f25bd97991dfdbf1f07af374d4eeaa7d
SHA1 cd3196592f49e483337ee33cc1280ec0763427e6
SHA512 7f3b98d30ba915ff770d612dd75e52d18235ee67adf3ce40fae986de0b12df3723d95750ed6153edb303b90e3ccd6b933b6b806ae15fcd41586c3bbf0d9f8807
SSDEEP 12288:NeBNUbTVO86UX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NJIUXyxknw4FYnshx8OfVe247
TLSH
T10775CF7BEE28FCD2C27E4DB95B918600A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 13a27742ab5d02e003959863393c81d6b7cca4b5ddcff04d60c8d346775803b3
MD5 36d827c6a7cc270c304f06448c31b22e
SHA1 075a8ccdb9e28549eb5fe2c732ebdc2e753b6c76
SHA512 d24785395cacdaff53e0c3431c659a8fe58270fe19f3d3a770839cf08cf2a13b895fe6896f580d34a8bc9c99f3b73a5f2322e00ce35da93cc38d011965a5e871
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:lQvGAdlCEL8c/yRNw5CHix8EVy
TLSH
T115267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 dbceec8ee5deafdff206a634f79cc102f59c856661da541986725bdd1c147e3c
MD5 36d50f45333ca09e7ae0c6e1012aaca3
SHA1 d61a9709da46efe838975b403e06e0201af47ce3
SHA512 6d187775f4a7b3b59b963dce342444874ab8fb1f15ef07dc410318f2f62f9f5b468118d70fcf4b7566191a923b02e5d99656b16f38a05608eacf9180136fb14b
SSDEEP 12288:fAwSfxL/2Dc3LDLLmt0LDQewsAjF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:o6ewsAjFyxknw4FYnshx8OfVe247
TLSH
T15F85E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dac0f461e6fb08cea75389674eeb03e9db212a13b080a4b0527caadcf6277dbe
MD5 73bce8f9c1d4baaa0b5c49d1eb2c1f88
SHA1 7456d3907fa694608754e4022712a7020371324e
SHA512 371ed09e341a7ed1668d80c24ccf9e73d733b5a8f52bcaccf44504c42af5c67dea37c1ee92fc0591714ea64d289813d521274abb74be471456271b55f4b2c2ba
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHl:PUEtQevvqc2W1cpV2EI32
TLSH
T110474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cb92ae0d9bc2d4db36033a92b7e909efa6ac9a30216aadb2baa136fe2d0930c0
MD5 8150d8253faf2cd11c2c6f0b0e35e8dc
SHA1 f9e0c20ff12c9d2d6965c6aeaa49fc2451609eb8
SHA512 de523adb3b7b5ba56f9805cf225ef0b3e8122300c13159d2d55c9d2c4452189c38d72fae1db603545e18ba38731ed9725f831602dbd7c9cf6b284d4162170fc3
SSDEEP 49152:VCbRquA/m2yL5zQfFiV+XenmE3/zwx4x8EVep:CoqtVjnmjix8EVy
TLSH
T196D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6e41368375f5fc5b010de8ed41f0e1facfc6f53f2122cb4768e7922f2c43ce9b
MD5 7e6e1cd22c18ef95a316de17f75cb3dc
SHA1 5e9663e36b7c805f1109eec2f9a1a7ca3d6f31d3
SHA512 5df1caf9b91956647fe55a1a5bc075d256e179108118f2f77d1049c8fbe449e95667a869a7d4b594cc14fcbe200761476b835101b21dbe0503f446b779ae07b4
SSDEEP 24576:GAhGLJIFoiwtA5l7S53Ayxknw4FYnshx8OfVe247:GAMyFoiq5Tx4x8EVep
TLSH
T12635AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 4e10f85bcf85417897886210e6e0406fb6c6c8eb26767a64efb023a213e99bd5
MD5 6f013c730edae24975aa3df5eeb2bf91
SHA1 8a8439516216ea800126f4bdf9edb3771fd6b271
SHA512 192f9ddae6d2950966a299351facb6e06059c5712c82e55b47706e9140b457af181903e0c68b63062e66c49f9384687b04fc6b9e2d159c561381b86959e8ef86
SSDEEP 12288:Nmw5HEjsChN4BFgl0WDm+Cc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:owuVOW5yxknw4FYnshx8OfVe247
TLSH
T17C75F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 59aca2975f84f5f0b4bc41519e928606493a744fd53fd17363a01e82d51f94b6
MD5 15da7fcb530ce6f5c30c7da18a6e9332
SHA1 72c7888ebcaa6a710b259048f6be74e6ad6c6366
SHA512 76d207f7a518465c98d97ab950ccdaee775e0d22dc5550ad863bf3a00271f0725cc0f8b2b108de2dcf705f0d8738391c57937b57b7c815cbab07befb282787eb
SSDEEP 12288:gFZ1Iy1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KZueyxknw4FYnshx8OfVe247
TLSH
T1006512AC33E860F1E197113A89F15206E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b227a215a97de9e1e5ef500c5882c77b227b551df9c91282f84146a829af772c
MD5 9e1dbbad9704dde50f1691f3f7731ed1
SHA1 1d92ab170c42edaa261e79b0fe5a6e58bece5605
SHA512 0c6a8e134be2eaa377b605c7227a88baf70d905aa79679332b755b74cd084f6d4ff6a92f800206b5719b511d7254fd470aaee221eccdb722a0950c50de88f8af
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:FQRQyi36YOcPQLvw2gAf+PN3Oix8EVy
TLSH
T156667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fcfc657ebc5adbe15347250c27ff3bab6c89579b4ce3ec9201796b6b4307d92d
MD5 0fa42fe0d3cb769d985094218b79e252
SHA1 279dd3aac36994d071f7b8f26b47ca37ce987c56
SHA512 8d272b622bfc48a6020cab24e5d594fc399d2a9e9dfdfe1aef25060b006a7c7f1928698f745637f9930a9266eb74d7d1365a7bc8d9e45976277c90f10483de34
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:6QRQyi36YOcPQLvw2gAf+PN3Oix8EVy
TLSH
T1CB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a8fe47acda77824f506ec20a6a078b7718fa25047e12e17fc979f85f0b9799c9
MD5 d9a2fc5ae00c95ff13b083e112f4aa03
SHA1 e09261ecdffcdea6a51623f5a33b073205b3a520
SHA512 7740508d72e91be78c825ea476256806f2d0a4981a9945d6bf375063d4ac0052e0d4dcf0585ec2834ab1128578bbfae5a3ba198e00707d622d8a6a4e992f5183
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0uyxknw4FYnshx8Z:Z68Qg55nhheWu7PNU3/gx4x8EVep
TLSH
T1F6B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d8fc53ec9df9766766548a4b055979bde7b32dd1e0df3059c6b247086e284aa3
MD5 5f5dc7bacdbbdfd1b580476b8dfe0979
SHA1 80df8b94d37b56b971ce293685a061f1a4f04140
SHA512 1e7dd1c4db46e79b39d4b2ce0401c4536e2d9f4b21f2ee844e827f991fd170db665d630805e5ca8c1d9fff8a079bf360ae62722691e9a2ae2acc9e02d20004a2
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99e:5y5112gYy5azzVvL69nLKnhZ9ix8EVy
TLSH
T156167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8f32c24872f20922afcdbffd840a6c59f78240cecb70c6a31f4d0b077ad8bb64
MD5 490d87ad7c1782e374c87178475bc1c4
SHA1 fd9960d84b79ce31739c820ce97cd0a1072fcc41
SHA512 02baac80b8bfbead8a03693b8708da705898dc65f92d73aa408e687ef88c584d476785c5f519ddd4578db97fcdc89e0a0c31bb40002a3d119cd61b731411cc58
SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmx4x8EVep:nu6JmVxd2dmix8EVy
TLSH
T145D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 76955ba29ce34d1f4338aa375632d7c73bcbb9c499caf5b45eed9e76fd005e6d
MD5 d4d881ea79beee932d89055529c2dfe4
SHA1 9b15baca331208a276c463c255755009009fa5c0
SHA512 26a0a96f4afb4d53594d92225bc6fe04570ffff5b07f8ff74ac9f77e90ec1ea858408c7d11b77d5428ece495fa0dbde0ae7d7565e66ad2b651589201793f8c3f
SSDEEP 49152:V1hpsNoJpF1A6UU44CwH7R4xCx4x8EVep:VmifPbRjix8EVy
TLSH
T1AEB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3f256b969bdbd015fa1ed6d7fb9f2ba7bb6fdf7e9a87b727fc426208a5641c4c
MD5 e2b891d74436413ed884cc442428f7dc
SHA1 0f7f93ca87492c9474522729071cc9d8285f6ee0
SHA512 fae552ac190823420f305ea7f8495bef72b66f7a7993b7d99872dc28330b938af6afbffc21e3b40bd5cde3ddfbe3fff8c4380937b965a2007474063930771084
SSDEEP 49152:GSuZQIY0Be2KRRVtOnks6NMHqRx4x8EVep:I5dKTi61Rix8EVy
TLSH
T172C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3e2a6b5cc54ded97bc401870a574a332938c0f93b6bbebb1f9d9600b8c8fb0ea
MD5 0f075dc64f5ad47a9ac3bcf67b2185f3
SHA1 7236327cb72f729a6ba134eee2647a52d85cf8f4
SHA512 aedad6a790165a933f6eb496a1f0ec1586ae636727827fbe18c22ac8b64e6efd32b70314ba933dc52fafcc998f3d486040be6c725887023c2946a17b965884e0
SSDEEP 49152:6htSn8EApI0figngiDn0AP5wWx4x8EVep:7X2iyphvix8EVy
TLSH
T19595BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 997d83de9a0834f7be427dacd900cabfc93cbecb52522e9d24766112a21155ca
MD5 7b72b891fbf5bb9ba7c9e7257f89581b
SHA1 542132d2523152045e3efa1a714478ad631878b9
SHA512 e4fb6019979eb9da7cd21ae3633682a76bd92017ce87b04635b30dbb80d655091cdcf2d402b38c173fc6ccf1c61e3b1cea69e701f844133b1d35cd91c07610fd
SSDEEP 12288:va+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vayxknw4FYnshx8OfVe247
TLSH
T17D65237CBBDEA5E2F50D11734A7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 4de7cf823ef60415fb2532beaabd95684c31fd85c880154beb923447068eb706
MD5 fe1e899f698c7e4e1c1ccea410679d50
SHA1 00ae7e0e36b977b30351d9cd1d8a83e9f6863ca6
SHA512 de5343fb072708b04c634399e33b3bd85287358d29ec3dd54494178d39c26203f90132bcc181bad66b7a6790f996c587c6256134fe5a1275cccfbb567b206de1
SSDEEP 12288:Rh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Rhyxknw4FYnshx8OfVe247
TLSH
T1B365237CBADB95E2E50D11734B7172626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 77e62c172cab312de611f667816cd3ccd8af316bb0e456f78bddbc882223235e
MD5 b7b87b4109a550ec3f84ceab908c709e
SHA1 b8fb5fda2ac5a53d9b1c80fc829e65380c965501
SHA512 34ad575ae280560738f6f028f85222ea5978012c902e134316ce3237ec4495a76498a543ef588b411a269cd0669d5a5f7e3562a451e96c01feb685c92f5aa9fc
SSDEEP 12288:YP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:YPyxknw4FYnshx8OfVe247
TLSH
T13465237CBBDFA5D2E50D11734B7163626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 df63d20291aee7dae38c375cc0ecb13a0e1031bb0e3c9e987224317652cf3870
MD5 d7cb6a913ae86d5394fcfc21dd1b9673
SHA1 51057fb7091d56af127d39035e1a34c4eed28dbd
SHA512 fed224cfc16e85ee55fc22cac8af3ccd0c96473748652c895240fd003bc96c920ca0a079d90bc79473ba320d884bbf7e16b9fde6cc3083091853221b2abe1eb9
SSDEEP 12288:EVg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:byxknw4FYnshx8OfVe247
TLSH
T1A165236C77EE50D1E85A51738A726222B365B8E5E731C35FCB24710EE9B0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 37f4aeed40d601036879fdd4fa6df120b0c13e8e8c78f76c95270f718e16a022
MD5 6dcb3df538b8ae5d5fe67c2dfb482b46
SHA1 c8a995aa9a98d43e60395234e569112acc2575ed
SHA512 2685f14a283439f88d0c158fe5dcf054c2f2dc06f9b0b7d75bf3f807123e4561c9df4e3bee50088ccbb10a884223f97d75db3f83078402ed33bfca35a8d7d3ce
SSDEEP 12288:Co+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Coyxknw4FYnshx8OfVe247
TLSH
T1E665237CBBDFA5D2E50D11734B7163626609B5A5EB71811BCBADB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 c7c58a16a17441f325cc66cd93c02dc9eef966088e8aaf34c4b958e473e3cd3f
MD5 eb37d6db97e2a05ac80cceb104559ba2
SHA1 1d25f77cc0dfef70a9edf43b4de36a265f15f955
SHA512 12cb192f38361470824b2e89e08e7e024e66d55e2c8a490fd245993c07c45463199e397f23a82bdcbb70922f3dd556ca2f02a0f058c3e872dc0b450d5a0e93a9
SSDEEP 12288:jd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jdyxknw4FYnshx8OfVe247
TLSH
T14E6523BCBBDE95E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 3277f1c08c1955e09f859cabeda6cf59194e9c1e85687a0ce4fd7d3f901a717e
MD5 b15be016fe8c4b135428611ec02d8f87
SHA1 4b6f9ea41ee3ac38b2197af8fc3a5d4cbbfeadd1
SHA512 4a73b6415ab29f943ca19f062c8f6417734b03cc714bd4f097d4de5202458d768f4298528fdea36cffb6069d738fbd8e042767bef07dcc271e7a7a68822cae4a
SSDEEP 12288:qJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qJyxknw4FYnshx8OfVe247
TLSH
T1A165237CBBDB95D2E50D01734B7173626609B5A5EAB5821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 c9866bf381830e706ff46353e9eefee03677ae8bb9ff4ab73d2c376ce0ec26ef
MD5 99d790c4d1f3a53b137dc852a14a52e2
SHA1 88d696c7dbb77186b44b5b0dfd86281b0a05b7db
SHA512 3c2a3e7f0e6b9f9c13ca68c5a48b88725b7943b7b54b6d7f3dd11d83bdf03db01904806acad22f3713f503a844a0cf806fd2e1a4a09c91d94e3aa77e2d46b855
SSDEEP 12288:4iZwbZzzFEoS2cPvyB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7ZMdzFVSOByxknw4FYnshx8OfVe247
TLSH
T10E7502A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 da0da999caf97429bdeb8c5a345c1a02aefab9c263f0239d67ae0747652fc529
MD5 84f538d61393ef3f08f7e64c71d3f1ee
SHA1 59d8517e990ad099f46eeaf763be92e2b868e674
SHA512 2c1be4b8ebb9595876b21c136cd3a308a6d718b2ae4e379c0b51fcf80192ee146d5be5a0ba3cae80b044c1c19b8ac5acc2a1ee7782b02f6eb4b86426f2dd459e
SSDEEP 12288:1O+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1Oyxknw4FYnshx8OfVe247
TLSH
T13665237CB7DAA4D2F50D11734B7163626609B5E5EBB1811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 edacc2e61fcd4c0a0e2489224cb53057d49b4318d8febfc147364c30d534335e
MD5 13be9a228d40667463a894bbf9f31e38
SHA1 1f6e857963138f2a468d05b1fce9228dae398478
SHA512 c7347eab7b43a4e3dee9c01659407e6e1c6d1a42cd480ecefdef88d50cd58938e38b7efa5abb0bb4c2aeda1aab914ffe3a79bd08f184e54e2b0cc5b8ff3f3662
SSDEEP 12288:qy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qyyxknw4FYnshx8OfVe247
TLSH
T1A265237CBBDA95D2E50D11734B7173626609B6A5EA72811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 e360860b2427888d984964ee559cdb105c68b1d223fb9dffdd0a98516ce34f84
MD5 9e1b95791197a2a49a4a2b0fa07d0202
SHA1 8e396b3c66d6d72a7f2e3e00a572a51b7691f77e
SHA512 9936ea51e46865c7e97ac3dde06e0648e16096c2e79eb703966dea21cd1d8df6cbd2a191d15a2d9dea526732623852966b02c19b3dfba200b0d6251d0b137068
SSDEEP 12288:ryPz5L81+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Gzy1yxknw4FYnshx8OfVe247
TLSH
T19575125B73E530F5D12A4236C9621A12F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 a7ec5ecffd9842b7f250d5859702ba7670b311df72c9a94272dacb470c85dd16
MD5 c7b2973d70d89e71c7ff2693b82f4273
SHA1 befaf2e21ce4b883d0b5dcb70836150997de14a0
SHA512 3223dbdb8ec17ca7dd66f26e250f9e5cc57839e3d62d1904198cb617aed78eacba22279aa75da78684194c1c9342920c583596fdc14cb87535df7bd1ffb99f4a
SSDEEP 12288:CO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:COyxknw4FYnshx8OfVe247
TLSH
T1026523BCB6DAA5D2F50D11734B7163626609B5A5EAB1811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 e453b599a2169b1bf623dcd2d79c4eb2326815191c77f53a770b5caa293aca7c
MD5 94ab40cb1c2690e47c8b2d7d9ef38053
SHA1 717a14b75f40ee415e4dda8b1992dcec38cfee87
SHA512 110cfab897775949cd8b78e43f1e3851a09575c1409439ac92de6527dc0e69920b60dd4ca1b06f4c6db17e06d8ec354227907a789326a0fe75c409a641ff6523
SSDEEP 12288:IO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:IOyxknw4FYnshx8OfVe247
TLSH
T18C6523BCB7DEA4D2F50D11734B7163626609B5A5EAB1811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 ae2a4192e5e21872394e0b7aedce3c437793786634f3273a9d9df9b6cac347a3
MD5 7c6d53111d3789921872cb5d74e8269e
SHA1 fd28544cd09a41763642ce21ffbe3803403791ed
SHA512 cf98731e309c171f5c70ecb40a9d44608b8c0b1329ec7c18c00954171680e4b5e81d7f5e54134154b74211336dac58ee905c89d9db2658c26d01226a5af71eb7
SSDEEP 12288:eyPz5L81+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Dzy1yxknw4FYnshx8OfVe247
TLSH
T1AC75125B73E530F5D12A4236C9621A12F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 01b271da6a3dbef086ac8e21a5369adf487a562ff84e9e7bccadd47b63e4f900
MD5 00724351e24c1ac2194bc6d4a8175ad6
SHA1 7801f679a63048c2f5cd65ddbd67d224d28f3eb4
SHA512 5131172ede37d8439149b3ea153c1947ff1f165b2a889f704cba3dfdd3120b64860537118a171a8fe769260809601d34120685c7c15e464150a94c7235e9098b
SSDEEP 24576:1TGaLl3z0zDfyxknw4FYnshx8OfVe247:1TFLljXx4x8EVep
TLSH
T18C7501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 b91e513ddea1ecb22c2d84b9ecefee95adb6453acf1899320d7e28754bd017bd
MD5 007daf50d1e8acf34445664c23f522d4
SHA1 8e16725f27099bde5baa99075bac481eb42dcb5c
SHA512 3b9d30789bb68ead5ed90b767db4a9f98791f1d9e098e34316e0f2a7b5543215fdc7276f7546a2c8fc6a58c8bdf4eaa7e07685e21c73cc48360f752186a26b4b
SSDEEP 24576:r3Xd9CHKy7GZLyxknw4FYnshx8OfVe247:LXd9CHKya4x4x8EVep
TLSH
T1A395DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 c739a96620606f7824bd16d69843dbda040abee2cba9d702cf8c052c87252a40
MD5 3ec6a9611f23bb28f8955de429ac5a42
SHA1 d97d92dcfa06d5f89e65fa41db8f4630bd9b0b8d
SHA512 b311e9ac96b8e3e622339ec926fc6fb329c57e0fa065ec0b9449751c2942ee9ad7840ec1d743d66db45f9026ed7261dfca5852224e17ce99ed3f20e490cd1d20
SSDEEP 12288:yv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yvyxknw4FYnshx8OfVe247
TLSH
T1B465237CBBDFA5D2E50D11734B7173626609B5A5EAB1811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 e9888b447b85cf100eff3f57a69ecd5422daeed7a4a2729b19719c4706ef60a8
MD5 fe5ff51202ad567c52d1c580acb41708
SHA1 8269b722aa647b2087846067c90fd6adf1d4e848
SHA512 c17a616a5f0b0ed30cab8083df459b7d5e3a3fa1ec623f4c0b8df418bea240a038bd42e5702f9f8a06cc4c87e5bbc07822f05e464e1f08f8b33c0ac08657096c
SSDEEP 12288:BV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BVyxknw4FYnshx8OfVe247
TLSH
T17565237CBBDA95E2F50D11734B7163627609B5A5EA71821BCBBDB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 b695e7da988ac165984643630135a6c15716f47d76406f8a7ced69838ac4e5d7
MD5 24b6a94d2c1bdb7342478eeb4f5571f7
SHA1 24352040d333fdc01c009398c7084c1bbbc44aa0
SHA512 92291cad81050231310fc5badfaa428fe8de24c5d16f118f381c08d1e9f412acedf173de51a66258b93ff447502e8d27a81c9d3f6461670f71a7546b13b408f8
SSDEEP 12288:XE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:XEyxknw4FYnshx8OfVe247
TLSH
T15365237CBBDF95D2E50D10734B7163626509B5E5EAB2811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 3d790ce4c166b67a2cf6075cd067329c6aa49086c34476b14b952b46779b7452
MD5 251a2f6623576f18fcf1a56eccd0d4ec
SHA1 87a3efe47d3d0c8beeb8df2333d6111412ccad5f
SHA512 86c38492d9988f9d5d4785b9998924ad7785bb69116bcbc88db811220c3591bf0de45c20f0f99ffb28b148ca95615a25880af2ccae27fc5ded9a6e13f5962cc5
SSDEEP 12288:++sfe+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:meyxknw4FYnshx8OfVe247
TLSH
T1E275F028E29842E4D06E2276CB625641B3237C6597F1D3CB97D0F13E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6apqb380.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 8282247aee9928371dc8d044dedc01fe047430ee1e3e60f902eb5d9dc2b75893
MD5 7c265be86db50f853e698692434e04ef
SHA1 cd5104c9aa6e095a65abbd8772da5dd9e757081a
SHA512 7db8d5ffd7e87963ed1be850be7ce0bbe573cc52c2e210103fd966f0ec67bf9b05b978ad47934f4a2e3910ecf7e06a2bdf6f4091169bebaf966194698bfae878
SSDEEP 384:HXkRyiO024YeDL84KKDL849B7SOEAd9KVRaAcP+AWRMAvEF:3mZYeDL8lKDL8CB7S/AmVAf+hRMyEF
TLSH
T1EF728D3D5F003CAC15A780F8C5E982AA4D18B7A7DFE6C0AD21583D0DCB98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 3b67e632c64d92f1827b57f2f253a73d1775cd3476199d2d602f60a38cc3a21f
MD5 e46cf140fd86b1ef62972b1df552bcc4
SHA1 da3f4b571a7f92b5f05359d09cc4cd8d8a528491
SHA512 6fa36f39029ceaf857e12210c60eda8333bf961ae3d574a6ce5388b97df924639b935e62cd7b5363d8052d00a36b5c52b4676c5376ef7adc6a1bf155a4a5b199
SSDEEP 192:+I1d66JozGzgCl6mc0d/Ov5zbowbDLyj1xYI:+id66JozGzgC1j6bowbDLyjX
TLSH
T10FD1BB64FA394A3BC458023BCCA61F400F75389B988E3F1532DC64592D562DEBB8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 805d842c0395fcf64ea40237d97708e2b09d7ddc7a4337e1b4f2e24c3e6cbdfa
MD5 0a6247edea8a5ef6f1631768330315a5
SHA1 2b3ec9bb6fa2415b6d51727482473d782371e643
SHA512 c81e861489565921bfafd70755cf395de4185a145503e7e9d2bb2e11189e9b90fedf69d3fc89b33e8f52c19313d22c40848311a1062eac091dd66567c95e7d0a
SSDEEP 192:+I1d66JozGzgCl6mc0dwOv5zbopbDLyj1xI:+id66JozGzgC1jFbopbDLyjA
TLSH
T144D1AB64EA39463BC858023BCCA61F410F75389B984E3F1532DC64592D562DEBB8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 488afcff109c0136a427f077471d46a964d46faf5196c24899d64f21a455eb9d
MD5 f67adc0445328d86cce1e557ce5a4080
SHA1 d47a48eedfa37fc2a1bb59b6eac3ffed44b51b78
SHA512 4491af2b25bc2919dd22e93ff9d7a55cd7ccedd1617738c1e0abcc446c7093df6aa206c99197bfb8894b2d4ec798f8ebce8037f9bf7a1e25f0f9e8bd23701768
SSDEEP 192:+I1d66JozGzgCl6mc0dYOv5zboPwZDLyjlR:+id66JozGzgC1jRbooZDLyj
TLSH
T160E1DC64EA28863BC418037BCCA61F410F39389AD84E3F19359D65582D572DE7BCE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\events\events
Size 1KB
SHA256 691fe7b83e4a8e6869b42eb419763543a6e313a90a92f3792b518ea0e2b683ed
MD5 ab253d3b7ca37c6d9287e051f210e919
SHA1 e0e26fcfb9a84fc1657a7f8667ba847f58407a71
SHA512 858f373efe79cda11eb171514a3d5ca32bec216a60c7639acee0084ee312df8a0645e788ff286d199bb81d4881f5a132f2842fefb183bdb52c4736953c036b89
TLSH
T1DC21679C3ABD8DABA88FF2A87441428F53158A4309471D434D42FE8DCEC1ADD327E479
MD5 SHA1 SHA512 TLSH

Submit Download

106cc282-e3ec-49d0-bc8c-7de95cdc4c3b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\106cc282-e3ec-49d0-bc8c-7de95cdc4c3b
Size 886B
SHA256 d306b2b87ed3e46f381099bd1cc1247b60ae8082bc0ee0a0a5558492ce8588bc
MD5 47d40c0a98557ee3801ebcddf39e0549
SHA1 0dece02ea489982b13ab3f3d730826adf7e7adbc
SHA512 75fe606fa50c1cf8837a8df8531079fc0129ce85a146c87e0f6c9dcdfad5eb747c503a180e0fb7cc56f52d5ca978b58eb9fc7990edd6f038a3cbc8df65021c51
TLSH
T100110441897875B1CC78928B88A1B7825BF4342380C55D047E914A180DFB51EE3EB71B
MD5 SHA1 SHA512 TLSH

Submit Download

234b4135-c9af-48d6-bc2d-057ae3e4349b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\234b4135-c9af-48d6-bc2d-057ae3e4349b
Size 235B
SHA256 27300fc2a0dd54686807e6845d053f363710044e53c65b67958a227fc60a5c3c
MD5 b356f15f818403dbd22c643b700ef1bb
SHA1 115a655daecdc83dd136b53a6dc2b3307de07f15
SHA512 e914b0c7f9451075fb7d33e9f4d0b800f84072ca277880f4353e539238e0c8258b5625630ec31f700b2b8d1860a7a2ca1ec047b0c2ee7fcaabcaad5dce62ec4a
TLSH
T104D0978828D8676D08100F13B0A03EC63244CC3310B4A810CA704A76A9BA9C8021381F
MD5 SHA1 SHA512 TLSH

Submit Download

2a35f53e-2e80-4130-a94d-d947b1b7622f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\2a35f53e-2e80-4130-a94d-d947b1b7622f
Size 16KB
SHA256 fb7e17d5d6e8a26b034f1cf3655e7360d26f3cd4664e4dc12605f22346ed289f
MD5 54516fbb01b314a87b17eb2849294f33
SHA1 a2fb734cf1801c906416e77f36c663467aaf2a0a
SHA512 83c466b8d883e3609894172004a3f425453ef30360c68f64e11b4a30628ebe6c6be6b0669d5a5b092b5b5e637333fba9b7766be368d7382d3c8c5a2e49e87d96
SSDEEP 192:q4jNOYzxy1Kc6sX1K/HOKgxksdV2e07xpVkhFSvS+8VT5AGUKruiRIDG2BH1Dgk+:q4joYly1Kc6sFMthCui32TrQVAC
TLSH
T1FD72C916246055BE8651E36998FCBFC3E5F628CF4C019FCADBF47D0869DA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52481371-b6c0-458a-a9bc-abbb2d7cf7c1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\52481371-b6c0-458a-a9bc-abbb2d7cf7c1
Size 235B
SHA256 353872008d29e386e783ac996df8a965c1d9841d5a551c47b31720d53007abb8
MD5 73cab30c2a81249ea6ce2d792b624c8c
SHA1 da4607ea26e52a139cf8d880b55cd2dd51c8f996
SHA512 f9fa1a4fe12a19411d562b622a545533ddae33e82a78bc288f84c60d6045d053b2278dc3f8d448ee1ff147e24bade72f42c8d0261771f0cc447cdcd48f4f16d4
TLSH
T1DAD0978428E867AC28000F02F0E038DA35844C3310A05860AA95C0B4AABEDC84111817
MD5 SHA1 SHA512 TLSH

Submit Download

5a45562e-9e33-43ee-8998-694fac1987ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\5a45562e-9e33-43ee-8998-694fac1987ef
Size 883B
SHA256 ad8ca252343c16716bf25bd1ed558ed672f64ce0acf8d938169e796d17611916
MD5 3b79c406ded33ef46abc0baa697905f9
SHA1 742f97d80e4ee3936f100c9599dc195c4cf66d08
SHA512 8b4c0003a4f433c6004852868ac91a9d954fc0ba94897cd33979e9aa02c9124fa9ef6490c1921dcdfbcbf74984e2bb37408eb015460e117ccf00bae97006fe53
TLSH
T1C711278195387972CC7CC24FC8517B425BF43523C0C695047DE24A140DBE61ED7A721B
MD5 SHA1 SHA512 TLSH

Submit Download

b9102ff9-e868-49ea-8c5c-a767fdd5ca1d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\datareporting\glean\pending_pings\b9102ff9-e868-49ea-8c5c-a767fdd5ca1d
Size 2KB
SHA256 21da851bc7ddb635bf18446c510f6f0d711e8d4883d1204b50fdb00a57f2ffd3
MD5 3b7ede6ed9b6e677735b13f7761bf8b0
SHA1 1306e4155e8750a44dbfa35deaa6821439bb7543
SHA512 7d47c4d191619f79c779c266eb626d04dca1a8feab14ce23adeb15ad7be8425a35e2769b1b6d5ac0df3c41aea8a7353f5dc515b8bad10f645a82fd1abef6ccf0
TLSH
T15841565C367C4CB68DDAF29DD892274E57B08D0340C12C83AD62DE0D8C9679D336A53B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\extensions.json
Size 16KB
SHA256 7c7de88b8fa79b78d03b881e8d2ea0d104d522b75c22a4ef58a5dbccd00dce8c
MD5 ffb2c802c90b6f5df70c89f94c160b5b
SHA1 a69021cbb33fc95aac857d6880032cb04b5e0ca7
SHA512 ac33d66469161dbce7d41479200889902b5a498f501d1f0e52adba108c432b27fae47c4e2d98f9a2fbdc19358a731d061bf946de278c75177e97c9bc53de7901
SSDEEP 384:B4kI4vuUmldvB8dhW694z396onL4HyL4PLL4HcL4HpL4HyJ4h8:BvI42RfiXb4p6Y4g4P4W4h4e4y
TLSH
T1F672531545049EB8298E978AAA36BE01C37D473B70845C78F4DD8FC842FB5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 ad45df58f35867ce74aba501e65f1b88d0c0255218a255868cab9d7aeb107170
MD5 2f9127c35bfba821bc97b160e7d7c303
SHA1 ef19fae5f52ea91305e94482227901ed0161fafc
SHA512 d72f2fe6673ac2754f0517d3ef523df6a3c2d92459d5f68a4023ff11c31bada4e7ad5c8f1c528b607cf65df3fdb231ef995971083e77064a3e338260f9116047
SSDEEP 96:xH07wUTUzqGqvf8nm1zSozSSladv9juNn/5H1Bw88n8L4cnDOT:acORvf8nmtzSS3D1Bw88L
TLSH
T1A8E11F7895488B7F64B677ACAC6888716AB2013BB7BF2CC750B654C4005CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 a8c06593063f6b1d0e4ca8ce5a8ee015f5cac617554e53c69f93c4b11eb08dae
MD5 84f624c9fb008e83755ebfb60b0de9d7
SHA1 3235fec3a21a2cd88efc14443055949e97335ab5
SHA512 75352f2a06c4d6a9035e8e86bdf72f11462bf4e943ad7cf22ce7b81f1f19d810541fb1ff9a80f79ac50fa7c80cf78da086efc2b8b4852ace928dc7590f94b038
SSDEEP 96:xH07wUTUzqGqvf8bBObzS8SSladv9jJWfn/5H1Bw88n8L4cnDOT:acORvf8bBSSSFl1Bw88L
TLSH
T15FE1207895188B7F64B6776CAC6488316AB2013B77BF2CC710B954C4015CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 8KB
SHA256 2d539cc76fa66ed8edb1c503ef90e6d25ceea2320db4fe9819ed3be33afb73ae
MD5 ff05e1c5919cb2f7fb56902e619917e1
SHA1 661369f0ac5c3bf4ae69e27cd6d37d260a72913e
SHA512 8cd6a2bd1911a14bde4edad713e00672725dcd7dd4ea5a9243347c5163d6be36033fc3a5c16923743a17da3b2059bb6e201d025912b517b1e30cfe4aa9a66455
SSDEEP 96:xH07wpTUzqGqvfMbBObzS8SSladv9jJWfn/5WR5oVBw88/Axj8L4cnDOT:ac/RvfMbBSSSFURmVBw886P
TLSH
T16A02FE38A0088B7F74B6766CAC2449715AA2013BB7BF6CC714B95484054CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\prefs.js
Size 6KB
SHA256 f982a8655d8399848ca279e4fc3307f17500348a48c9bd6b684d341369bfc09f
MD5 dc083a3de2f1dcecab27a41c62755d5e
SHA1 b50c1e731f3ad0e1d22d6320a95f66b041b645c1
SHA512 d24385d731ca1017e03aa6f491912297bb2f4d335eaa3853c5f70504daaa95687500f41518cb86daf8c8454d9310b4dbf35cf4d674eb2b8cbf20178d9b4296c8
SSDEEP 96:xH07wUTUzqGqvf8bB1zS8SSladv9jJWfn/5H1Bw88n8L4cnDOT:acORvf8bBRSSFl1Bw88L
TLSH
T1A1E12F7894188B7F64B677ACAC6888716AB2013B77BF28C750BA54C4015CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 50fb0a74bd88cbc5092f0fb587ea01d8ec1cdc2921e4757c6af5bcfd746bcafe
MD5 f1ac3806b83c17f47e1272b5e370042f
SHA1 5e9847a1d452c20cebd543b28324adc5a932bd3a
SHA512 36056606b435622a3da59be84df4466d8c2c48b666dabc3054015bdc25b9d74ff5032a00ecbd83b5f3f50b5e95da45337bf07c4df88938b1702877b7cdadd94f
SSDEEP 49152:PDmgkuOjA5lUT2loecNeaKvgmRBbFOYLg/:7mpuO856T2KzeaKvgmk/
TLSH
T18A1639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ebbfcc7692dd48e5487784bd554c4a64b97fe82ed84f1d0e5ff72cbd8120cd07
MD5 12b3e878f0a395f3b4845a93412b3b91
SHA1 8b4d86e6dd9081b67ca0c05ab23634a1eb1c2ef0
SHA512 a0b52267a968819fab3c8e78510b0b30bc47d103fb31b723649f8c9e25afb06ade23c3703a4f0d6c9c5df288e23fcde94576cea5e1a719ebc8b5ac42efa8213a
SSDEEP 12288:wc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wcyxknw4FYnshx8OfVe247
TLSH
T11065237CA7DDA992F56D15730A31A231361AB2B4DF70C14BD768B11EE0B0CA0E83E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 39e178ffca2f139cfaa9b645bbad1256375a56bb4b83e56703622cf9bf4422e2
MD5 3b8b9af8c20cea1c6829fd24da8d5802
SHA1 6b2ca3098874418b33242013065ddc1f004681d3
SHA512 99d741be16e19868fbbd7be7592be14ccb6bb5a0aea39f49c92bcdb752f6286f14b378d166137c357e22833a6972ec9157d199a95ffa63f47e4c087b5dbe9000
SSDEEP 49152:1a0h2GEkuAe73q3pp46zwwQxx4x8EVep:1a0hNYG4Jwuix8EVy
TLSH
T17885AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1150853D7F37DE48E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 97caad19034a64a161d91c07d031812331707893a64fa2adbab8f9d133577539
MD5 58c925138df5a5310de6c3ae4764735f
SHA1 5bc207eb3674858d8ec2c31a104ce303b338a31f
SHA512 83f2af5d88d89bc364ab65a19bcfd588ae01f29b7c91e04f3b9240b52cd85b06233f93f4b0ed56762bf03d0285c841d8953663353c41ddaad1ec8ad8f58f4af0
SSDEEP 12288:phbHjfXCV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:phbHjPCVyxknw4FYnshx8OfVe247
TLSH
T1D165017C27EC20D1F175A17A86A28206D331B8651B3193EF9395923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 a2ff3da1905dc11144347fdde8a51b901920feb19100d1e849ea20c0afa9a0cd
MD5 3a3f73ecc03acf89d1a96ad2344252a5
SHA1 438ff6db14abc43034e468380e4d874d303671b3
SHA512 d9dcb845f5ec5390e47b1aae092e5b259c02e0cea09c7169e45fef03cc40c47d63ba2b07eb764dcca41c17703d89ff678d27dfecd2fd311baad0766cc35daed9
SSDEEP 12288:Pg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Pgyxknw4FYnshx8OfVe247
TLSH
T1586523BC67DEA4D2E55D15730A7262263605B2A0EB7182DBC77DB10EF1B0CE4A03E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 78518c9e9380e798926365dd32205cebbf4cb67a0b7a88a1f09cc22a7f78d3ce
MD5 2a8d289b22e56cf8d5874b11a871ced1
SHA1 618a1268090a8450e9705b288b62e88dc10f67ce
SHA512 66220ba33fc1a2de446dc4df497429c4748eb53f4aaabcb14172267c1d142cff398731022f7f7a94f6031dd89699f334f70b566cc6b4d36cc1a5eb1b1af9bdcb
SSDEEP 12288:COb6A4LWOsvAYFT5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zCL3UT5yxknw4FYnshx8OfVe247
TLSH
T196850158F7D400F5E86B813DC9729612E272B49D0774E3DF43A88A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7d58832717e22f79a7a5bcf66072d4bd2c12e5550a29f61785adc31e34d64e1c
MD5 7eba4fcc15eab26db8ab9b451b625ad7
SHA1 45e7b2f3e850c6d1f0203713fa2b0035f2eae985
SHA512 8c507b32d9b39c9e57bd03fe2251670bc25702c4b3cdf893103150248975617ef8fac4ea22f134b5ccf9504ec84c661ae58413052c54cab9295b2b68b8ad7603
SSDEEP 12288:RpFtkON+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:MONyxknw4FYnshx8OfVe247
TLSH
T10765022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DF8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3f0d233a4548913af4e1ca391f886c74b2e0028ed4febb3a054016e939510de7
MD5 249f53d0f492b76cabd5da5ae30f2393
SHA1 4f9ca25cfe6d2f0abbe1f2f98299cf2fca02d9e0
SHA512 6fdd3cf8ae5a26b5544664373b79ca16825df6b3e6043e6a873afd207117e79b480fcea4cac618c1b1cdce301974537217096d4256019ff1c5f397f66914631a
SSDEEP 24576:37NM9YqZqmWMUkPjZM48Mv6bEhssyxknw4FYnshx8OfVe247:37cBWMpPjN8DbEhax4x8EVep
TLSH
T1CE659E2D6BEC81E5D476D13DC9A28205F6B2B4611B318ACF5162833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 dadbced3c1de1199df88f1f93bf0991409950c86a2f0e1888c31124de24884cc
MD5 335dccafd1c3481d0e57bc0788e07037
SHA1 71b6b3b48d6fe4fdb9ac57601275b6db54dbbce4
SHA512 12ae1f1ce29057bb291b71e56a0e9484c8702b3b4b107a02b1e6010bdd4d8ff1fc45b9bd7eade98b8d9710887d51d3954efd08a7520307c9b8f1947cc720faa4
SSDEEP 24576:GW6BApg2YuyuNDYTabvcdvNYf8km1Kyxknw4FYnshx8OfVe247:GF2YuHNETovAvNYf8kmnx4x8EVep
TLSH
T163858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 031fa1128409adcc978d3d3c1f302b98bd4d1c6c068f13cec4aaaa11e59bd326
MD5 94ed4d9969b2da2872c5a004ecc12da1
SHA1 e199ddd009a9f38b0336672da472aacaa81b585c
SHA512 1b8ea1051a13978d030740ae18fbf873dc4517d66809aaf5dc5717c827e0d28e648827ca83e9aaeb48f338a516c5a62d94155ce32b8d43fec3467437600aa40c
SSDEEP 24576:0AFs06+Omlf3NXEbToxyxknw4FYnshx8OfVe247:5Fs060lVXuRx4x8EVep
TLSH
T1B465AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 ee5c0dbbd27b392a0c070a2dc97d0ce8ec64ed94515669917d8bedf9164dbfa6
MD5 b2f054c812cf7befeb0bcf8ae2400998
SHA1 ff27ad8accf1023ff1e6003174a0dc201f6bc014
SHA512 2c2e61d55658aa4b08d4579a530db16db8b8e4a7a46ca0e72c60a5e660e27c5a5161a1eaedf2540913385602d334cb803b51aefd362430df2fd4279420e24e94
SSDEEP 12288:fCJnJ5D3Vkr8zxM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aJnJ5D3Woeyxknw4FYnshx8OfVe247
TLSH
T16D85D03CD2A810E4D4B7C274825A2756FE72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3b9423350b76ef852516bc7affbe2a0ea0ca0fb2bad174f87c5463d16cfc98a3
MD5 76cf55e44f6a5899df126591836bfda3
SHA1 167efcda62827c73cb412b9c1cf44ba0c0834dd8
SHA512 2164f76ef7c1ec519d9d8709e8ead601baa359e2167bdb877017978672c64db180eb310962419752420acf3e5f444295990f80d4dcec187c4ea04e9959ca8af6
SSDEEP 24576:6EPghm6/7IIXdwcXrif7qQncjlP65i3VuXyxknw4FYnshx8OfVe247:tg06DIKdwc+eQnSt65aVbx4x8EVep
TLSH
T1A2955C15B7EA5294E8B3CAB1CA72A1169B327C509B34F7DF0AC0C92E1D33AD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 5bfaee0039c44e44438422cc04e61351836945e24177d65f700e155dd8091178
MD5 998455ee7fbe4b8844c566ef6de6758e
SHA1 bb43b2981f04ad06ac3e4cee148dc8049cadf376
SHA512 086fae3d27413da85fff2aaea766ffe21357e0f22023ff52ba2dfc87a0b2556fb1b26e9367ef43ec1036e997a925c3c461566b5e8a673ded4b0c9d9bfbf46401
SSDEEP 12288:CEP3RM/V+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BM/Vyxknw4FYnshx8OfVe247
TLSH
T15665126C67DD70E1E52A503A86A18205E372F0706B6263EF87E5D13E8E72CE46D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 5abefb1705770987dcbb2a8470ca22129e31307d65a5d0ea7cab54895574f63c
MD5 93b362f5cf550927a28bb14c35d1bb83
SHA1 6c56a81db3f5984939b85bd853cdce587a664ce8
SHA512 57937eac48d50e6aac4059a579f1cc59542ec76529723e59ed9d1d1793242adbf94f4f5106410689b654933705f14f4477785a9916fc219260bc9d66c3512e24
SSDEEP 12288:qjky/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qIy/yxknw4FYnshx8OfVe247
TLSH
T10675121C63D8A0D1E5B905369A7352A15A35BC709F3193DFD290F23EAE71ED0A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 1d5df03e1101029da658321c5e58f14e9e10123d1a3388f7444be6012f86411a
MD5 ff0f645124960496997865891292461f
SHA1 23875ba5aab416dd942ee8298ec2ebd44eb41878
SHA512 8cc0f6f89dadfb509c7cb4308a24614b7127c4c93e667c617da79bc49140d1af4316abbee1b3f0a52f78af482fc77db53c1248adc46be78b4c84af21c9eaac28
SSDEEP 12288:eG9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:z9yxknw4FYnshx8OfVe247
TLSH
T1FD65237C67EAB4D1E9191173063163626225B1B4AB7191EFC6F8F13EE6B0CD0A03E953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 71bf54d41c0483d843ef3015f30a7713a26781aa052055f4d96eb3854a436768
MD5 c28294687eb8e208126b4769af8eecd9
SHA1 974911fc6fc4bc35e54ad4822aa8ad86248a51bb
SHA512 7f807551f3d0b8c1003eb5296fece6e0b63721601be07687bd125fb76bcb5f98e6599fc3e986088fafd9036f9b0f6505fade5111e127ddf3e6ae9b6523d5f423
SSDEEP 24576:pQ9MxZKdcz9dw3Eyxknw4FYnshx8OfVe247:pVKZfx4x8EVep
TLSH
T18B558C2DABE905DAE177D27595B250C3A633B4301B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 33094267723a2b478d78b80dc78a7b818a06f477d8878adb9cb8b5baa5b975dc
MD5 49101e9c589d11f5096f64b412f82081
SHA1 e86dd03b879989ee39469c90699ef7a1bf829f53
SHA512 84473855b5e3217cb83f6b755d31f339c701617f4e7cf7ea96ea280f9fd535749387f8aaa4f85ee151e97ccb655a2dd38d252e74050daaff5eb8eb45aaf306cf
SSDEEP 12288:7yoKo2SRple9pj+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7yocgApjyxknw4FYnshx8OfVe247
TLSH
T1D175E01FB7AE40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e497f56b6bc4ccec21ccd7bb41e97a295109bb1eaada5d8f23c63b87fd440c0d
MD5 4af2d06b950eab3b1ef7e052302aa5af
SHA1 7793e9fa0ef8514050b6bdd5697e85c5f419c252
SHA512 86a045170f1585e86b1b84b0ea0ab244e592ddaff3f3e2d4b7633fdab3fd3bfc330d3145cd5d489dc855fc8a24f39c47298407e6a06c5ddf78d7b9b04a0ba34f
SSDEEP 49152:LWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKmx4x8EVep:70zuNI8ix8EVy
TLSH
T1F0A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8f69505ccdd0981813dd430b8a274e07a863f5dd5a23bef2c961fabb83dd1dbe
MD5 4216ef24854b3488c21573d4ab9b9cc6
SHA1 bbcdd90335fbd936a56b7fb442fb7a948a0f4039
SHA512 93d21a3f9dcf0f1c897573311d76f3dbb2e0d5c5e6d0aab1fc9167bbd2c2133b4df5af149759603e0bbca67f82d08dbdbe662328e3fed81e75b411e15639be75
SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYtjMqb/Vyxknw4FYnshx8OfVe247:OTDxR+N5YzTfjMhx4x8EVep
TLSH
T10E55B02EA7F815E9D1BE85798B23C512FA727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 a8bcf2304fdefa47af5032448eef94d1c14cb30bd6abc3ea50e5fd03364f84cf
MD5 d483e5b7bd00c398e83ae0aefe585984
SHA1 dfbb3fabf59435deb0fe83aa451a23ed4eeb2573
SHA512 e858d07b697452f5011da84ea4092f8b07e958b6770b86191519ff43cdaa595aa04dcbfcb94c67010151861e0eed4b1ceaf7e8ced9255fbb4bd2d4817d0af00c
SSDEEP 24576:N3YgnJcRTk4yti+R5dBR/6Vyxknw4FYnshx8OfVe247:NIgnaTk46pBR/zx4x8EVep
TLSH
T1CB45BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-309-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/756-13-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1084-62-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1084-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1084-554-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1084-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1104-1159-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/1104-988-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/1356-39-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1356-553-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1356-51-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1356-45-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1368-1091-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1368-976-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1684-17-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1684-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1684-25-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1772-964-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1772-958-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1772-1073-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/1772-957-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/2520-74-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2520-107-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3252-86-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3252-84-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3252-78-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3252-558-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3456-1157-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3456-985-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3864-1156-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3864-980-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4716-89-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4716-87-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4716-73-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4716-70-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4716-64-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/4888-9-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4888-36-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/4888-35-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4888-0-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4888-8-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/5180-968-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/5180-1090-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/5380-974-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5380-971-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5488-1160-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5488-1034-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5488-994-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5488-1050-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5488-1066-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5488-1071-0x000000000C990000-0x000000000C998000-memory.dmp

Download

memory/5636-921-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5636-979-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/5636-915-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5636-911-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/5804-975-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/5804-907-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/5884-1087-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1075-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1094-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1095-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1096-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1097-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1098-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1099-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1100-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1101-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1102-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1103-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1104-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1105-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1106-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1108-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1111-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1109-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1110-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1112-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1114-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1115-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1116-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1113-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1107-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1093-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1089-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1074-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1092-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1088-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1086-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1076-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1077-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1078-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1085-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1079-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1080-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1081-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1082-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1083-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5884-1084-0x00000214CD2B0000-0x00000214CD2C0000-memory.dmp

Download

memory/5940-984-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5940-925-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5940-926-0x0000000000730000-0x0000000000796000-memory.dmp

Download

memory/5940-931-0x0000000000730000-0x0000000000796000-memory.dmp

Download

memory/6008-935-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/6008-987-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/6036-992-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/6036-1158-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/6036-938-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/6084-993-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/6084-952-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/6124-1070-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6124-944-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6124-950-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6124-953-0x0000000140000000-0x0000000140169000-memory.dmp

Download