5f7f807466699da3ca55646bf53dc41abbfa35f6dec54d581079198ceaeefab4

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_b95fafe61dfc0c250ff60197c4fba4c5_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Size 3.6MB
Sample261006-tsbeva1s8j
SHA256 5f7f807466699da3ca55646bf53dc41abbfa35f6dec54d581079198ceaeefab4
MD5 b95fafe61dfc0c250ff60197c4fba4c5
SHA1 9613076952f50d5d329b1fa4c6dc23d4f0e58142
SHA512 77cb186cb0c66b2ec1fad18b82d11f0a9930d4c7c2ccf82831aec8bbda23278f6de4b0cf6e034431b6f4850a80148052db02580e25f4847da47d52194f2ebc95
SSDEEP 49152:VurJ+ffbhvJGjQpZc+U7cpHnfBZ6BSH6F/mV8x4x8EVep:GgLRk4GSI/mKix8EVy
TLSH
T173065B23F2E600D8C05DD1759B4A8332A6E1BCA58F70A3DF465176161FB6ED06B3E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
668	alg.exe
1268	DiagnosticsHub.StandardCollector.Service.exe
1100	elevation_service.exe
1408	elevation_service.exe
5848	maintenanceservice.exe
4428	OSE.EXE
732	fxssvc.exe
4440	msdtc.exe
4952	PerceptionSimulationService.exe
844	perfhost.exe
5472	locator.exe
3712	SensorDataService.exe
1016	snmptrap.exe
3912	spectrum.exe
2628	ssh-agent.exe
5216	TieringEngineService.exe
5540	AgentService.exe
748	vds.exe
2056	vssvc.exe
5584	wbengine.exe
2244	WmiApSrv.exe
4600	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	elevation_service.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-05_b95fafe61dfc0c250ff60197c4fba4c5_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-05_b95fafe61dfc0c250ff60197c4fba4c5_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-05_b95fafe61dfc0c250ff60197c4fba4c5_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-05_b95fafe61dfc0c250ff60197c4fba4c5_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f7fa5c874bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c51919cae55dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004070529dae55dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009960e29cae55dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd53539cae55dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f72149dae55dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff00a29cae55dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff00a29cae55dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8da9a9cae55dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e5c3f9dae55dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1268	DiagnosticsHub.StandardCollector.Service.exe
1268	DiagnosticsHub.StandardCollector.Service.exe
1268	DiagnosticsHub.StandardCollector.Service.exe
1268	DiagnosticsHub.StandardCollector.Service.exe
1268	DiagnosticsHub.StandardCollector.Service.exe
1268	DiagnosticsHub.StandardCollector.Service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe
1100	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5180	2026-10-05_b95fafe61dfc0c250ff60197c4fba4c5_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Token: SeDebugPrivilege	1268	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1100	elevation_service.exe
Token: SeAuditPrivilege	732	fxssvc.exe
Token: SeRestorePrivilege	5216	TieringEngineService.exe
Token: SeManageVolumePrivilege	5216	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5540	AgentService.exe
Token: SeBackupPrivilege	2056	vssvc.exe
Token: SeRestorePrivilege	2056	vssvc.exe
Token: SeAuditPrivilege	2056	vssvc.exe
Token: SeBackupPrivilege	5584	wbengine.exe
Token: SeRestorePrivilege	5584	wbengine.exe
Token: SeSecurityPrivilege	5584	wbengine.exe
Token: 33	4600	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4600	SearchIndexer.exe
Token: SeDebugPrivilege	1100	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 5988	4600	SearchIndexer.exe	140
PID 4600 wrote to memory of 5728	4600	SearchIndexer.exe	141

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-05_b95fafe61dfc0c250ff60197c4fba4c5_cobalt-strike_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_b95fafe61dfc0c250ff60197c4fba4c5_cobalt-strike_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:668

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5848

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4520

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4440

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4952

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:844

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5472

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3712

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1016

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3912

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5168

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5216

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5584

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2244

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5988
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 71b4c28a6ead5abbbf6be0a5d41178268841db9b578588985d0d0f9e7d7b03b8
MD5 02d6ef35efd768f93626fff324e66336
SHA1 3afddfcd7e76e78b82bad8f045e8dfbe99a245d4
SHA512 d453bff7e4e2cec52a6cc17440d035f3fef4f0778e622f742ed921810803dc3236a2d8e487e443aaacb70a6a65ddc63cc71a114e13512c4db41bbee3eef0487c
SSDEEP 49152:rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnox4x8EVep:53q6HjBHix8EVy
TLSH
T1AAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 6822c62a7984eb860454abaf316d150ed472d08bac344b8185de8eaa8c9d6164
MD5 0fbc0f89b554b9f15ca468693124a084
SHA1 fe68d096cc05774fa707bf405979aa41dcf36374
SHA512 d0582e1eb59260306f0025c30163ef25ccd6bfedd86c4246224c2b6a068570b093fbe22d4b9f0db2d3dfb8c75efd651da4706af8707bf3b19933a9dfa737fc5e
SSDEEP 12288:m1XLsswWkxy2lRq2czAI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:EXYfDtczAIyxknw4FYnshx8OfVe247
TLSH
T14175F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 0898e01f90b38afcc7e1a294f5a582a8f05c1de2b9994f4f7fe4e3d323bbf898
MD5 6e1262ddfaf5a849b07acbda51107dcc
SHA1 83e79bb6cb4c16f85fa66a90c6804a72cad9d549
SHA512 bc5a4cc252cff2ed24f3265f6c4bb61c946c26540b33f4afc761df13ae6cbf059a038c9886499be9c032a94e6798720470803beb706a96258972255b46d1f011
SSDEEP 24576:e0Le5ji0hmxFrMFyxknw4FYnshx8OfVe247:ePji0ArNx4x8EVep
TLSH
T13B95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4418c10d0c0107eca83ed43f74d6844cd9764d3f5ac0bf4d15d811514c481c6b
MD5 2b3252580463399d45880548c7e662fc
SHA1 114694745fc4f4a0ae05f92410bdd6f5146702c8
SHA512 4f2cda663a5ea9ec2d422dbfabf006d62aeb4d66ae9a168187c5376000b8c1b2f490673ba26f52e2c60df85c25ae0a448aa3939c179351342238cc21aa985778
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyuTyxknw4FYnshx8OfVe247:G/ezSC6vUzPvxHjyhx4x8EVep
TLSH
T14F756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7b34a24d29f6242dfe37f9711f2f780f4b34a25a2cc10c14e6c405ea8bcaec63
MD5 4d6a02c2d341bc7f476a373ea1b3e114
SHA1 0b673c3e7212de72b555a4aac11e369d25dfd4da
SHA512 59051fff3ac070cdcb8da2aa3fada6f82c9069a30a580fc9456d5ac5b9ffe1fa12506cb4f407a9719c3cc9cf02a1793befd0b3ab6bd53801d15640a3f2198a32
SSDEEP 24576:BVbqPb88hv/l+68yxknw4FYnshx8OfVe247:BVO88hXl+Ux4x8EVep
TLSH
T1EA559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ec696f183a08605cb1ea3d37bcdb5590edbfd6e669d43c6e8ec2fbadffe88064
MD5 12089a5159e7c45c1736fd8acf152106
SHA1 57ed4215ce5582a7a7a878e3de044d6259389c4c
SHA512 1cb548267e1d24221b671729e3fe5851938076612affe54b427e720ed5dcbca52f9fc3bd3ac6a612bf236c39a87394c77f599a1e10dd51e2cf72d4b181658a1d
SSDEEP 12288:zNJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zNJyxknw4FYnshx8OfVe247
TLSH
T1C465237CA7DDA4E1FA5E15331B7172623616B9A4DA74C11BCB78B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 6b7e7e50d19cdf649d1d6b19214ec9773a5aaa00f42923e332d46f9b5c9c6363
MD5 be318759d46ea2903ef021677c936c44
SHA1 01dae27b31675b97a41f424f641dbf5ab79cc759
SHA512 50e4f5cbc681b4dc57e252ae3d33c458de407b28ee507a22ef551d0b584cb59fd89aa239c9983ee24c58285b3ddca0701812d5775855db82736460efa64364a6
SSDEEP 12288:VeBNUbTVO86Uk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VJIUkyxknw4FYnshx8OfVe247
TLSH
T14475CF7BEE28FCD2C27E5DB95B918200A76274704F6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f084bc71d975f5b37629a5c41f4bfece7f3c3e5c31498dfa98575c9e3933a9bf
MD5 23ebba6ce8d64dcb97412ec0bc9f88c7
SHA1 d24a7166bdc75c2ecfa2936b644a2ba0b422e8ae
SHA512 c5dfa84a41bc345bce6320e472a6ed17018290eab0efe429efca8eb2eb3ba9d24c340864d62ede287f4f9e36e74f05d2a32e929396a439d7d079e271a9e29049
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THf:cQvGAdlCEL8c/yRNw5Cmix8EVy
TLSH
T16D267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 e07d3dd8cc381f31282be7f4feba92c3bd90349c431fbca9f06649c077ca72b2
MD5 7874800794ae1219bce80f2f89297446
SHA1 5c72e68f96fbb07529e242aa93c5b77f12a5fb53
SHA512 b19959b7dd6d3cc17119fb6d234a346f5dff19e80a47b43263de3d3ca97b0433c7b1c9c484cd03c972a9dab4a122f59d9b39f24749a011fda2629d86b779c3bb
SSDEEP 12288:WAwSfxL/2Dc3LDLLmt0LDQewsAji+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:r6ewsAjiyxknw4FYnshx8OfVe247
TLSH
T17E85E030FE74E032C6BF0DB21B36D716142DB9604F611AC3E3A89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 050939e052654011b32e5883992041d9fe862165fed9dd799c55fa171e6cc51c
MD5 b2e05ec01bc964258e9a40940091c2b5
SHA1 9bb5bf0239a9b8890539b16d199bb68eb3dd0e30
SHA512 4a8ee2b5c47e3345d983c2fdbcbf4e076c90ccb33b20ac482a3dc0e67a68640e24fe7d22b4822aef4e391f8b00f3d3aad16050b46b745d85df101cd2c5092151
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHY:4UEtQevvqc2W1cpV2EI32
TLSH
T1F5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e2d381db989110691ca46895343b7646c39145e64e8883518e14f617914742fa
MD5 0f3701ec5ebdbaba2ebaa2a8c2f820be
SHA1 0beecd1a711b024f6dd4de0f611750eb62c1b4b1
SHA512 6ccb30f0e7f7a81c34084520d410589422890be5c5823097f0333fe31d18471b92234e12af9a42fb39b8ff369f429270a7a95628b146c4b2725d89272a6ef912
SSDEEP 49152:bCbRquA/m2yL5zQfFiV+XenmE3/z9x4x8EVep:EoqtVjnmqix8EVy
TLSH
T11FD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 76e8eab3ba5f004404717eb2907a99f3d585db3fd1aca4f648e998539d2520b7
MD5 b260d9002c57c7ce43100c61bb381a40
SHA1 7b3db758c3e71329027972d7d50608cfd7b6523b
SHA512 366e55c59b95f961511a2dc9abd2ba288cf134c664ecc2343864c48c2dcc6b5dd2abdbff36b4e8b275f0525802747441e73c6686947775c2acb9420af8c1c519
SSDEEP 24576:CAhGLJIFoiwtA5l7S53fyxknw4FYnshx8OfVe247:CAMyFoiq56x4x8EVep
TLSH
T1EB35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 c2f064e530903d0735eea8f3bd7f3906ab13533faa8e9029505bec4501205dd8
MD5 1901dd7dd3fd0ce25868f7c3dc2c6aec
SHA1 4f3a3b8cf986d7cec13dc3ff15c07cb8d9e3bb17
SHA512 d3ae1e0a07a8ff0731c2161cc8f50f2ab8023b83ca74408101710dbb2db48434f04a9701cb2f4b8a420253a5a66b60405473b7cb8045dfefe0bf345759e68289
SSDEEP 12288:mmw5HEjsChNoBFgl0WDm+Cz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:/wuFOWOyxknw4FYnshx8OfVe247
TLSH
T1FF75F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 d6bbfa374bcd96fb83a12bc60b91560f4b1caa217be31ec76fb79872e714bb6d
MD5 06fe6ca568649558dc109c14f7b305ae
SHA1 187c4ab0cd8e9abeb061fe4c0b780476f2f9a937
SHA512 da230d72a0039d2f22d292eafa1a85e45c588f5455bd4fc8af9249c461d606f318a111d444038e83e6b8fe5999b72c6a3dba26f616969d37018f4401f8c548ca
SSDEEP 12288:vFZ1Iyy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NZuNyxknw4FYnshx8OfVe247
TLSH
T1DF6512AC33E860F1E1A7113A89F15205E76274A2677183CF4764A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ef8089ca7da73701a5b39badf0e83a4f528998a8f2d717b8a9a6ca934343a377
MD5 a9aa184812445a9c39cb5be337b827cc
SHA1 c7a6ca5ef6d518588d6aaa54e6fb72535a59e2b8
SHA512 79114819f2167a8734e06506ef8e53e42097174c1f0d0eb2e094212489eefd4df33a32075d1847c9e4894b67b56f65dc6c955448810cd620db1a0e4039288bbd
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:+QRQyi36YOcPQLvw2gAf+PN3zix8EVy
TLSH
T18D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 522b177c6c15e5a13ff9ea6e1164ac81c4b1e3cc4d4c05ccdcf349ce540a4d58
MD5 ef9dcfc9a9957785a244fbbafa0b444c
SHA1 4e08738e1553d6ab80c5783dc9c17554152b0ed2
SHA512 e99660512813394d0afdb7b9db0ff41255aa3471d12ac08582a3be1161141426ff38bb816ab1028acdb85d9b094a98fd7b532202c51a868c3f23d50432fa7320
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:pQRQyi36YOcPQLvw2gAf+PN3zix8EVy
TLSH
T14D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b1e1223bd3961bfae76d61f3da53ae439f73398eeafd54ec3ca33ddf7aad3788
MD5 11e4f49c2ca0e1179b0176652574d633
SHA1 912eba90a9a76f91a536949ca6500222c1badcb9
SHA512 febb26d403763e3cdd117d6e0bd32c570e0cad888c87198b9f44d9ad5ca9b632df6add4f508d5ead74801f1339e7fe7fbb79bebf2151016fb49ff9c827eb68a6
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL09yxknw4FYnshx8Z:S68Qg55nhheWu7PNU3/Nx4x8EVep
TLSH
T158B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ab4f15e479dfa0f794d5380500ddf8c8aaf1db5db08c9bacfdd28b6eb2ea9b6a
MD5 783aa2bf9dc95ca2a446f52096e4e7e4
SHA1 054006b42b145225e95c46c1a9c947b419c675f7
SHA512 2ab242a0694615924ee0dc4224abdab91dd01566a3d3b68d3cfe037b1b4133f1127417e845506c3bb94a9670397a9161a224b795e7ef53219d9ec98b7454c0a5
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99F:/y5112gYy5azzVvL69nLKnhZMix8EVy
TLSH
T139167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 408a2fab787cc69c2d613510561588c0f65e33711f21844a1a743cf725a2b4c3
MD5 ad74626ce147f9fbc0b0101fa456b940
SHA1 6510e7a86499d9d57c5dba0d3ed786513f1bb99e
SHA512 065fb1fd4ae271548380dfd0965434fc7ce2208735830233434681681ca92e0bbd2a7a51399df6b1f847d678625671aa51c563d8bc70e7df48a42791711c5335
SSDEEP 49152:3B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glbx4x8EVep:Zu6JmVxd2dbix8EVy
TLSH
T14BD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dac9f34e7548c81b5ceac9ddbdb6c0f54c71ffcc69de94be1d2cb973894af9a1
MD5 4b5e6b198bd4bd7d267b8247c3243dbc
SHA1 b0dabde6b53fbceae5ba392886eb08f3d3a8522d
SHA512 4ce95381e01adf8c767e867a36b75ff8c8f4cd626093490afb9be642b1f3f2783b286ad130fa2dcf0bd925e308e02bbaa65b6d022b68317fce49258cb3ed301b
SSDEEP 49152:m1hpsNoJpF1A6UU44CwH7R4xfx4x8EVep:mmifPbRqix8EVy
TLSH
T163B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6e67b1521e7d0785d307f180e50f875dcb7414bf7c65dc86786dc21860475d9a
MD5 8cf6b48b91dd51986f09eb54eb20c6fe
SHA1 7ab44b238785a892eeafa2add5921f566608408f
SHA512 1e1e9a8dca267f0666e3b61ecd27e8e02f765b919a82ff1882f6d1c0ac7e7c6165366abb8ca423eea68f4077555561d96d57bf7513328c35b73e0561a8078b98
SSDEEP 49152:fSuZQIY0Be2KRRVtOnks6NMHq4x4x8EVep:l5dKTi614ix8EVy
TLSH
T133C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 131f1cda4a2fbfe4c9ea7b34df4a90ce82737cba41cd7be5fcb927d01e851903
MD5 206797a221b55465fdfbb0179bb8cb9a
SHA1 de49e93902f346ead1ec74bf25c0d64aee3bc70d
SHA512 e6ef5c04492b5ac975fbcee3201d82a70c8330fba3350fc9848fc5a3da0bbe7d75cf285f191753259fa50e905ad0f96bf39a1c03afcbf0f9b0cc56ff4d2c96d3
SSDEEP 49152:ShtSn8EApI0figngiDn0AP5wrx4x8EVep:TX2iypheix8EVy
TLSH
T1A595BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 f2382479d357f69fb1fe26fed1e8576579115fe3f991f60131d082e920353e7a
MD5 59b7bdbdbf75c83d389a7415eabc6c8a
SHA1 84a2e8ce5302d0fe74bb608d4801fca5694b639d
SHA512 ed2339d8cc9c15a22bd885812d5ff951e54577b559e2702a84836fdfc5c99c84770878996c88ad3a2a1d26411553a23903ad9935cc46c0489d50c2b9f46f2a32
SSDEEP 12288:tR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tRyxknw4FYnshx8OfVe247
TLSH
T1B765237CBBDE95E2F50D11734B7172626609B5A5EB71811BCB6DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 302680e9f0ff1b1b328b38057d88816a7365a2afc155d7ff68e1e65489d63eb5
MD5 32041f1afbe51f0199a5851971d23720
SHA1 3d45ad0e285e6e14e29af00f8b86948584341f42
SHA512 11c1ec65a6f21b729edd97a6b115dd9d03a8c160f462ac914a3de5e0c7c2113433363fa6791f8f179a0b3e5499d348a8095e3648a345df0741dc6a167c9e6843
SSDEEP 12288:qG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qGyxknw4FYnshx8OfVe247
TLSH
T1D265237CBBDE95E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 7b9560f819f124abcca6617497ffd200f89add057932d1c96f4305b48d2f487e
MD5 b5d2fea7eac560ce35d0ade0bb17d024
SHA1 f7b3516987d5cb976af6246c131ffec3184d970d
SHA512 7c44acc8c3f06d9a292d94d5aa4f91f23714e0a89024d89e27da4d6385e9b183fc21d75dbe69103292c7a8e17132a8b0c0b2a973dfadacf2435bfbc7f2aae58a
SSDEEP 12288:6s+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6syxknw4FYnshx8OfVe247
TLSH
T1B665237CBBDE95D2E54D10734B7273626609B5A5EB71811BCB6DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 cbc4630ce7e89668ebaeffa77e7f94d0300159f828faab1cb8a91f4f3f6142d8
MD5 d6380b53132830eaba46c8bf22e9463d
SHA1 206b44585abf3c1d82a76cf86f64804eaad25499
SHA512 a026b17d2dfb8206ecbae276a2022aa3d12fc311147595ad420d04303f985e5fab636f5b96bb10092b274bafad20c16c18753d9e5834fa7d27eee7d44bae742d
SSDEEP 12288:sV/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4yxknw4FYnshx8OfVe247
TLSH
T10465237C77EE50D1E85A51738A726222B365B8E5E731835FCB24710EE9B0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 763f04273b78ee65c50753394906422cfdb967a11ea8f2ccbd7a23f8848efe0b
MD5 82126229b107d9580a74068e6bc82a53
SHA1 50fd803f9c0c716e6e6bed8db3877e9d471b2232
SHA512 7d4e6b3a2832f8aa8e79f58fb3ea6294ff2e05b7b54f4d42fd31111d8379108692d98987f9649e5ec8f215e8c33398845400c1ac592c52e80906f79df4dc7e46
SSDEEP 12288:eX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eXyxknw4FYnshx8OfVe247
TLSH
T1956523BCBBDE95D2E50D10734B7263626609B5A5EB71811BCB6DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 057ad3527a853e82804dc7229488a9e8538f4797f8cc3159ad8ea284c9b6d632
MD5 9a921aed529b62e5d498be9030cbc6d5
SHA1 7c7fe62847b18aa8545e4de26f1f258fa6395956
SHA512 8184d474c0b5fd8e1be1610ae331868882f42acec55d0a298cb6189e4cbcdee3aa1667dc070d21a6134cab91893ec186efd98000d498456a8bf4b3e6eda4ee65
SSDEEP 12288:Vq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Vqyxknw4FYnshx8OfVe247
TLSH
T12165237CBBDE95E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 350f0e53501a7d28cbe7c36b39cf3122db1cf1089d20285497ea309487e835f7
MD5 fc08199048d4def694952011ad9bb853
SHA1 d5c146ac524bd5eac6c8494aab1404b744d90d6c
SHA512 80f0fae62ed4ae40b65a1e28fe14c381130b3ee6423dccd31e9485a838378ea2c52a5c222574e4dad38bfe370128378716dfbc0335a133288cacb3d00b3e7be1
SSDEEP 12288:A++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:A+yxknw4FYnshx8OfVe247
TLSH
T12C65237CBBDA95D2F50D11734B7172626609B5A5EAB1811BCB7DF00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 f746143492cee29382f517a195c5254d4b997cd91eb32f79cb96c24f9ddfb6f6
MD5 2835e5db30c2a4ca655c9f4e15298475
SHA1 561453e8e501f779576ed5303f69f8cbd1ad0abc
SHA512 5284abcc3f8f3063f4008b507ab8a8731b3e79fc20a0ec627294f2a45d2ce80664076f68813d7366dc1b3832e7f362a0a950840bbd038ca33cd6f515d4e70e6c
SSDEEP 12288:MiZwbZzzFEoS2cPvym+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vZMdzFVSOmyxknw4FYnshx8OfVe247
TLSH
T1457502A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 832193d5eb568dddd539da33781f69a0b7c3661841fd63088cd69b4edfb809e0
MD5 f48a5cb5f4666e4cd6336ed75c54eed4
SHA1 4130628b5eeaefcf5a40a3bb9bb164c5f87cacf7
SHA512 19fe51edc877565fd07eb22086eae3921845a678f4867903d76f1648eab5b8b5c3c392eb1aa5bf570f7c0a4cff7cd80b3ff5595054a9cb50f51fcee8c4bbec44
SSDEEP 12288:Cd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Cdyxknw4FYnshx8OfVe247
TLSH
T1636523BCB7DEA5D2F50D11734B7173626609B5A5EAB1811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 aebe99dadc5a16c21f72511275d1eda79a296ac230db4a82b6bb2f93a15910aa
MD5 97a24a1ecc0070e4b26576d389af30c3
SHA1 b9ed2f50d37fd99e4b65b91ec4871ba6498d51cc
SHA512 93dff41e63c61f6a942baebb9a1c6aabb7111200c423c041ada14fbeecaa75a9681cd1784bd538ef10517b3979417ae3b7dd4b632ffb38b08505bf39b748a29d
SSDEEP 12288:eZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eZyxknw4FYnshx8OfVe247
TLSH
T1CE65237CB7DA95E2E50D10734B7172666609B6A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 a10493523e7d3b98ec25609610514224cb8174415d865b4ddc181edce3132e47
MD5 75717cae35b9871ccb09d5b050882da1
SHA1 008aeebfd6f8e57d4617d63efc388420315dfa4a
SHA512 9a2a754fbbf7c915c0b65a0c447524ee9eba0b6df5e8dcc96502d30575440cfacae8c305ded8c7ac225d3ca08b2c31a10c8be37f0d64c0bb5f675bfa1d3fa999
SSDEEP 12288:nyPz5L8y+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Kzyyyxknw4FYnshx8OfVe247
TLSH
T13A75125B73E530F5D12A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 571f85e9fea7b548debb0d794b2f21e1cc7be354b11cbae93083a77c61ee406f
MD5 77b939bdc9f24bfa7bc241974af21cc7
SHA1 4bd1237cab62f78e3308f877348ac3212e947320
SHA512 5ab69bd34d0fedb375f3c1a428397697121062e424bda1c6981d6ed2f2912e261c99bbc261c0433a6d9bc5f153adb89fe2feebc120d020c5ac5483a5a576d812
SSDEEP 12288:gd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gdyxknw4FYnshx8OfVe247
TLSH
T1C66523BCB7DEA5D2F50D11734B7163626609B5A5EAB1811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 acd10057b7417eb0e6b699bd6e98a674693c71cb1a6e483e7733303b9e8df94a
MD5 560778f56456cb9c8546e7f52d8e9235
SHA1 90b4ae2b562e1ad17d93bdbe6d9b8e34e8b75571
SHA512 8c322dc67572e9bfbf52601b7ea2310ed8d56ef2229f7c82910a97943fee852acc9969341b6303c4579fcf8bec4581c7019ae7fd67e591369910b0cff05beef5
SSDEEP 12288:ld+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ldyxknw4FYnshx8OfVe247
TLSH
T1F86523BCB7DEA5D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 22aa9d2ef110586537e022cd84997f882936ad5c3eb235afb8df99c984091337
MD5 81f7c7ef51d63709af392d46ddea3e72
SHA1 9a08ce7c17762aa0bad98f7e3b6896458f6df506
SHA512 095ef7713de9216e7403c16c218d8cedea8068ce4b88d5ddcf328a14c3363061dd6734fb6bc3ca8df3e657251bf2f1772f39679753782fff46ac126cc220a74b
SSDEEP 12288:ZyPz5L8y+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Yzyyyxknw4FYnshx8OfVe247
TLSH
T10175125B73E530F5D13A4236C9621612F372B872473086AF87A4527A6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 5fa6b48a7d3171e148d5750da5d57f27cfa7978cd0c94c186d58903141360ad8
MD5 818537269546da7d621703dd4ea47cf4
SHA1 6048e5914b96dd5aecd837f78572a9c2022058ef
SHA512 5620fd5c745646ade8894d0815a39dfc6d65d2017c73e56ae396d375aa147790022ebea34bd72154d8dc2c1d9e9ad81094b6299046687f955ad815f965fe8def
SSDEEP 24576:TTGaLl3z0zDcyxknw4FYnshx8OfVe247:TTFLljWx4x8EVep
TLSH
T10B7501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 b535cd929d5de9d163b0f05768da53bbd2c5626befbabd200dc12cc96afa934d
MD5 4a1a9933120981ba43c76d1f44b99b67
SHA1 3c8ef144ac29b993300acdc664e1786e71edf31e
SHA512 31c34a4ce772861acd651fccd641abe6a1c4df856642dd773ea3fe92ea42274563a493c3b711f323cddedaadffe0ece1d7bec117b52e016c37b4ac8633cf35ca
SSDEEP 24576:c3nd9CHKy7GZQyxknw4FYnshx8OfVe247:Gnd9CHKyaVx4x8EVep
TLSH
T1BC95DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 ff46c43447a08614cd9187b914c685d96bf5fb9c1849d0eb96d612b4449388d0
MD5 94a2a1e4fe7ab64a4a4b85cd2dc43583
SHA1 10020eee8484f97d930988ee69b121c1b791ef64
SHA512 df0ebc71ee11c16e27b08ab1d31edba1c66b410dd542ef287ac08aa91935adc2fc7196a665faf3d6779e600b08957e7ae540380ceb51d791c323b4173db980bc
SSDEEP 12288:/M+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/Myxknw4FYnshx8OfVe247
TLSH
T12265237CBBDEA5D2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 fece6093f9154d95f666f239494db3b76bf0c51993ef207e5709a4256f7145c9
MD5 310da0664345b2aaf8343773bc723b3f
SHA1 c9845bfb8db330d5410a9db814a8205277c3de33
SHA512 90dffe4a86686de3399fc56412dc9625223b5c529f930cd97a4fe527a20c422c0b8c3c6c45f414ea51effba1ce1d4e83c05a4b077aa38d613c5f5fba0634980e
SSDEEP 12288:2S+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2Syxknw4FYnshx8OfVe247
TLSH
T1B165237CBBDE95E2F50D11734B7163626609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 eda7da9c62cb71ff4d870664042550a35a00559acb19041749e1d4774fe9c5b4
MD5 4812cefff409ac081e7fc31e0ae50854
SHA1 79bf93f827001d4c45840c6fbbed5ce72495b4e3
SHA512 26bd285f85ae31150350de5df6c5c814024b9824ca8f5a0e30d45738e83a68611f08f77b89f83f355abf836511bb78ea36af4bbf4567572b5e649060337f012a
SSDEEP 12288:dL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dLyxknw4FYnshx8OfVe247
TLSH
T1C26523BCB7DEA5D2E50D10734B7173626609B5A5EAB1811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 08d20636c5e8ab4f2f5d2404c4c6ef8fbd1f1e42c4a5a5464ec28ad65d65825d
MD5 38cb43ddd7dcbbed347a903754ca2e2f
SHA1 131c3ebcee7c3811b06e0c8e7083831c68a426e7
SHA512 28108e0269e2c7a1ed1bf4019aafa826a5988709f696ae531158486a64ffe17e35bd16ae7ad4cb14d300df2ef99d979efb0e9470b22805b007e557bcf24fedf4
SSDEEP 12288:2d+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2dyxknw4FYnshx8OfVe247
TLSH
T1806523BCB7DEA5D2F50D10734B7163626609B5A5EAB1811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 d358c0933e06b13b7092cbdf4590eec8bbdbe1cbb3713b09fc9560486affe616
MD5 87c9a6efa08a44dba3778e74e31f3bb1
SHA1 8fdd732454a5d09fc759249445d7cd25bd0556cc
SHA512 297ca1f3079cd8219458a9b102f343c97483feebd0a67eec44e73819391bdcd794641fbdaafed9635e6f8689e46f662886a2fcfb72c2345ecea0a1e7bb571aac
SSDEEP 12288:Y+sfN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4Nyxknw4FYnshx8OfVe247
TLSH
T1C175F028E29802E4D06E2176CB625641B3237C6597F1D3CB97E0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 6f8dc65434532a6ca23f2fe2f21f85a183ee910c0150197380f1eb4d30889d5c
MD5 0c78b1ce398f7ced6a4e82a4e24e801c
SHA1 d2821857f39ca170ec5fa7040eeb92ab2aa004e5
SHA512 53f196003fdf89c46e8dac742dd257666d7874d6a8a97acf3ef1b76c9fcbdc069842a4158329627baeed1efb448425917d9cfd8ca0726516f8c6ab7d1430f2ae
SSDEEP 12288:z9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:z9yxknw4FYnshx8OfVe247
TLSH
T11965237CA7DDA992F56D15730A31A231361AB2B4DF70C14BD768B11EE4B0CA0E83E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 80c63e879182c49f8814b1112154ed2d4620a56d3b1a5fe45058d19f85f7b975
MD5 e1704d515ca5a158bcbab74c2d018923
SHA1 dd6f4a9c7eda5e6fe65092d7ac0542411d499ac6
SHA512 aca0ac697198de0d9b96ed0120a6b10f9de246ca4a5fb34e649c8c66797c66359211c25dbee3f8ef667116a2f87903739713418edbf9e6bd8602727c36257632
SSDEEP 49152:da0h2GEkuAe73q3pp46zwwQux4x8EVep:da0hNYG4JwZix8EVy
TLSH
T13885AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1150853D7F37DE48E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 a95ac03d3e99e4ae82e064651ffacf151f00654315e052cf7f40c58189ff2dcc
MD5 ed5ea4ddaf600ecd7827a20ef7f07218
SHA1 4e41df6b51124f28daa133d7d47dbbf888468dc8
SHA512 ec95d571337dced9c536ada8351ff747169e81871d1527801e479b418c6ae6412489652bd9699f1ac631343153274165454f3bda96d6623183de3e4de3138cc4
SSDEEP 12288:fhbHjfXe+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fhbHjPeyxknw4FYnshx8OfVe247
TLSH
T11465117C27EC20D1F175A17A86A28206D331B8651B3193EF93A5923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ef43f6b791a2cefa5a4c216a1bf9fdb635ba0179bea231f271e858b4c8371e4e
MD5 2c5fd53b8e6bedb8da10b4a82a5be1df
SHA1 dfa6b2e169141839bd09dce990f126ae5abd6e1b
SHA512 e84081d28d6fe5192a680828a5d140179d0098b1b0b692bee41e9155e138e255077e7b3d2a2f2111f14dcf936ad0b0ad716d87513900267603c1d62492bc1e71
SSDEEP 24576:y3YgnJcRTk4yti+R5dBR/Cyxknw4FYnshx8OfVe247:yIgnaTk46pBR/9x4x8EVep
TLSH
T17845BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 ac4825db0ad704acd7519da77173170631834d333de07f38b03d5e04625e83d0
MD5 bf2b11f24ff53ea01b003c98d6c0819f
SHA1 df634974e9edf5d754e8d1692a8c08a702787c98
SHA512 600ba5fe3cfd9818ccd49b24d2c71fd144381d06de9dc465c18b1c51b8566612fb24db53c144052acb221c30d40681386bad61269f38d3d43730b20f242c45fc
SSDEEP 12288:6h+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6hyxknw4FYnshx8OfVe247
TLSH
T16F6523BC67DEA5D2E55D11730A7262263605B2A0AB7182DBC77DB10EF1F0CE4A03E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 6988c698b69bb73d1ea5521fbfa77a44fbadff9559dd375cb61cb3b15f4163d6
MD5 f2c1317e3bdae11a58c28f0e5fbb2c9c
SHA1 fcf9cd15c6139d697be44cc3d4f6d74baf8d35c5
SHA512 05e39a0269563d072ca352fdbe1bb3f964f0db6b23b053ba80e3248a6e033d9dc90db48ab26054a0c01824b44f38a9b129011ae504092e3157633d4c93b107a9
SSDEEP 12288:IOb6A4LWOsvAYFTw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7d:lCL3UTwyxknw4FYnshx8OfVe247d
TLSH
T1BC850158F7E400F5E86B813DC9729612E272B49D0774E3DF43A84A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 e9aaa4fa19369ddea641657c3be80f2c2ca4ab4c96fea15c127cb832e2f66a0e
MD5 9f821ae727b26182ad0ef488948440b4
SHA1 2123caced354cbb83c4df996da4c2c150309a412
SHA512 31c00a89dc0c00773b70c9a5b8d21be05606429a3b0d335ccdb93b7477b5a21583e78bb47bf0b9e1fc952ba92da5990c2f6b5806a5a01f2bdc710aadcd0db738
SSDEEP 12288:8pFtkO0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nO0yxknw4FYnshx8OfVe247
TLSH
T13765022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DF8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3ad713b016e7e67e4566392fff68b52d73e8a2fddc41833a781da9463463d1be
MD5 fe6afd7b2f46863fad40d70276c77500
SHA1 47298bfd5db37d4c278883eaf7b68598a2897052
SHA512 d26143abafeb4c44657b8ade06be004bf2511d65bae94a93223c4155f61aa8aa9c6e78f84453e9cbb1a8a7f3959bfc58ae818b7f83f7ab165ab7ef1968acdd0d
SSDEEP 24576:s7NM9YqZqmWMUkPjZM48Mv6bEhstyxknw4FYnshx8OfVe247:s7cBWMpPjN8DbEhFx4x8EVep
TLSH
T132659E2D6BEC81E5D476D13DC9A28205F6B2B4611B318ACF5162833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 de566c237813fec184cb5050342b196d7d6736879242081afd79cd485f8b550d
MD5 5bb1d52fe3411a70122ae4172dae5bda
SHA1 c808db8755f6f00b15460f10c81f6f5bb6bea24d
SHA512 3bc7ac4d094f0d39e8e9d52c333d95a997811886ca592c268974237ea507299da2eb9c09ddf1771512b77f1b23c2a9b42f9f6b91923e5ee0ffe251367ae56e59
SSDEEP 24576:TW6BApg2YuyuNDYTabvcdvNYf8km1Hyxknw4FYnshx8OfVe247:TF2YuHNETovAvNYf8km4x4x8EVep
TLSH
T1AC858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7a6ddb94e0a19671f27c9269aa95f304f8f5b2ab19a225dda680e201933a2fbf
MD5 9b9635a43a66d9df470b5f718f9a7e60
SHA1 bd6daabcb74806e7fd9806a652f6dc60bccee121
SHA512 2aa9275e1a4f80b266624bbaf10455416b951971614e2a155eaee133dc5796a2da34579d8117a165c7be84a7cddfdfef1f8adc11eb9413197585a4fc0064d48e
SSDEEP 24576:oAFs06+Omlf3NXEbTo4yxknw4FYnshx8OfVe247:tFs060lVXuOx4x8EVep
TLSH
T14765AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 71c2c0d38fc8a3671cd06753da412437a94cb710e2352b483ddce090150b3920
MD5 185d01bf98a2c34b4993e3b3e67f0569
SHA1 7d125d0edb64c3893e7cd7ad6f724567d8456eb3
SHA512 6454dc9b82f6a0c7476e4d0096eba27fde89e56658ee91e014026d5cee49b3002eba3d2515e9406a86a98c52ba8eacb290ca263a34abb0dd4c8aae2ddbc882e6
SSDEEP 12288:bCJnJ5D3Vkr8zxN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WJnJ5D3Woryxknw4FYnshx8OfVe247
TLSH
T11785D03CD2A810E4D4B7C274825A2756FE72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ab076717c3b6ca198e698f5af64eb19830e8c447a918a2a0cb3f20bb1a954a6e
MD5 63cfbc8261560d545fbe8fe3e32eeb93
SHA1 8a66f5a1f51c87d181ec6f30c9fd74db7e7bad23
SHA512 1d8c9f022d9dc5deac6b73e0ae987a8e2749d048d4e2aca42ecc48ce351c1773500844124224481243c704875b8810f7a6a24a501c32e6d41c2d827a2b4869e0
SSDEEP 24576:aEPghm6/7IIXdwcXrif7qQncjlP65i3VuCyxknw4FYnshx8OfVe247:Ng06DIKdwc+eQnSt65aVsx4x8EVep
TLSH
T118955C15B7EA5294E8B3CAB1CA72A1169B327C509B34F7DF0AC0C92E1D33AD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 5483704c3b77b474e14b14a79afd1d000b131f890bbe81436228dca580e4ac74
MD5 82897c76bf69239157e8dffeedfa672f
SHA1 9c711ee5ee4fd6b2ca7ec961b06957b5bf9cb62d
SHA512 11e718527ba771afab9be2b6df7447647927813de5d5199cf7bad4d233a0e3afbccc8d7f6c7254a27fc25cd1f2d38c07674fcd6828855d4ebc231ff94364221b
SSDEEP 12288:gEP3RMn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7Mnyxknw4FYnshx8OfVe247
TLSH
T1BD65126C37DD70E5E52A503A86A18205E372F0706B6253EF87A5D23E8E72CE46D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 680eff8461392d0d663eb4fdeb06916086306ec557df1832a5e4b961383d1b22
MD5 3d75abc0d78a0099646265ab346ff6c7
SHA1 d1ab3a413c8ecf756f3b8ae5014ee8767437278d
SHA512 673934d5446986953e324db0638e7c4d9c44eed112d30cda82020f0c3bc8f2f7115250b9d09d4f72259eee3c13498a11384df6ec7ce1164c937eeb692c7a7cf3
SSDEEP 12288:7jkya+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7Iyayxknw4FYnshx8OfVe247
TLSH
T13275121C63D8A0D1E5B905369A7352A15A35BC709F3193DFD290F23EAE71ED0A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 635c9309141d581ec766fffc4039356d16301b9b2631fbef44018aa93a2bfca7
MD5 bb30f20fe1507970e86726c640e32dcd
SHA1 7fa2e71bbf65b02d5e7605ef1ce22550142b796b
SHA512 78fa7f45f1407e48eab01e5f0a409909cabc79473850349b3f1f2d797011e749814a90a3d9825378a77b3f73e4174f5ba1f8d97360b68aec6208a3efa1056af8
SSDEEP 12288:QGE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xEyxknw4FYnshx8OfVe247
TLSH
T1AD65237C67EAB4D1E9191173063163626225B1B4AB7191EFC6F8F13EE6B0CD0A03E953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 50b58fb6a14e5ed7b30202f4a12399a9654a6cd6ebe4adda8eb8f9cfecceae5d
MD5 7c143a9d5e993cef1299d55f581e6a2f
SHA1 78dcbb6545ae6a919f6eba9638c10209f66b5dde
SHA512 992c316e0c26d5c08247d5c30f6c5932c7f05f73c7cfed4f21aee54c6cc0cf7bb77700d8ef43e25a209398d74f380cd8915a3b605944e36a3848fa03cf2724d2
SSDEEP 24576:0Q9MxZKdcz9dw31yxknw4FYnshx8OfVe247:0VKZAx4x8EVep
TLSH
T13D558C2DABE905DAE177D23595B250C3A633B4311B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 46f3084a814242127a3ac6f2d2dec466012bb7e7573c41f5c75f29ca6e1ed2e7
MD5 1351c7102a4ca16b04687771f06371d6
SHA1 6ef07e8a8ac9b3f080fa18861cfb1763f27be41b
SHA512 1a8c365786ebdec5682172cb7e3baa8a5b33ffb67b67fe603126e8e1c9b64f682521f275a2730e8661f6cd98b71a4aad6a3b88c343cc4a2720a88a9ed92a2f28
SSDEEP 12288:SyoKo2SRple9pO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:SyocgApOyxknw4FYnshx8OfVe247
TLSH
T12775E01FB7AE40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 19b40ad439b9cd0b4426ccc705dbb9e74cef3ddc30055852ea8bb808542a3d20
MD5 60297eedd03eb6079b17fbdb04c339bc
SHA1 cab07af249a42be844789f50c72e8a924c5baed9
SHA512 d353e82a2a1b16075b6cfb2d84962f5ed0561493e22d1aca7f5889626e31535feabf0360903c6f605b27a253fb4c6413b123b772bfd4a5b2b029f456403852a9
SSDEEP 49152:mWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKBx4x8EVep:w0zuNIzix8EVy
TLSH
T1DDA57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5ccb578def0a4072e3010278f44198d2ff7dafaf84f6a634c78f1eb4542c1a80
MD5 bd2ffce29a4d42e5c9478fb38c5ade31
SHA1 f13777fd6e3ef42f7aa13795dc602ee30fcf52d4
SHA512 626eca62ac394e09284063dab3456e3b3a407d40fc25006528367bc26b5520c8461774a34b0308462d3651f0fd7fde9350c7197643122f57337ed542955da72b
SSDEEP 24576:j1QT7EcpfxR+N5AWAz3ooiYtjMqbnyxknw4FYnshx8OfVe247:+TDxR+N5YzTfjMbx4x8EVep
TLSH
T19755B02EA7F815E9D1BE85798B23C512FA727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/668-211-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/668-14-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/732-242-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/732-244-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/748-467-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/748-316-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/844-266-0x0000000000640000-0x00000000006A6000-memory.dmp

Download

memory/844-265-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/844-323-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/844-271-0x0000000000640000-0x00000000006A6000-memory.dmp

Download

memory/1016-283-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/1016-407-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/1100-233-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1100-34-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1100-43-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1100-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1268-29-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1268-21-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1268-231-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1268-17-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1408-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1408-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1408-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1408-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2056-320-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2056-484-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2244-328-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/2244-486-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/2628-305-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/2628-303-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2628-297-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2628-412-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/3712-411-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3712-278-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3712-332-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3912-285-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3912-292-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3912-286-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3912-410-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4428-235-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/4428-81-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/4428-79-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4428-73-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4440-315-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4440-247-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/4600-405-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4600-416-0x000000000CD60000-0x000000000CD68000-memory.dmp

Download

memory/4600-487-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4600-333-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4600-389-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4600-373-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4952-258-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4952-319-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4952-251-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/5180-0-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5180-9-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5180-20-0x0000000140000000-0x00000001403C6000-memory.dmp

Download

memory/5180-8-0x0000000140000000-0x00000001403C6000-memory.dmp

Download

memory/5216-418-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/5216-308-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/5472-275-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/5472-327-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/5540-313-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5540-311-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5584-485-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5584-324-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5728-450-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-441-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-434-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-433-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-432-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-431-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-430-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-429-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-428-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-427-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-426-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-425-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-424-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-423-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-422-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-421-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-419-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-449-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-448-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-447-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-446-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-445-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-444-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-443-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-442-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-420-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-440-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-439-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-438-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-437-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-436-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-435-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-452-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-462-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-461-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-460-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-459-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-458-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-457-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-456-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-455-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-454-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-453-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5728-451-0x00000155E45C0000-0x00000155E45D0000-memory.dmp

Download

memory/5848-69-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5848-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5848-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5848-66-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5848-71-0x0000000140000000-0x00000001401A1000-memory.dmp

Download