97793ae6afe744d1df40b3d9be843a32b4615652746878bae477f8c079f96ef0

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Size 4.4MB
Sample261020-yc375sda49
SHA256 97793ae6afe744d1df40b3d9be843a32b4615652746878bae477f8c079f96ef0
MD5 594f3c0e64e57cd946b77e003686f7fc
SHA1 c27a9f7bc08767cfd53aaf7ee0a98e91a00caf18
SHA512 e491d1b9b7795516da3b863f811f1efa20aef83b2aa8b7840b69bb618bcd752ef7f9925f2e52c353091bc768faaedd227030945184ca0125327fa2c84bc4bb37
SSDEEP 49152:wDp8IIX/b3BkiZfFfRIKLZfr5KsyboJd6pYhf00qshIMiag2/ZHsZelmOvJvt/wc:xSil3X7da8yaZqimOBV/wJTy
TLSH
T1A0268C23F2E600E8C05DD1759B469332AAE17CA58F70A3DF465173161FB6AD06B3E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
2284	elevation_service.exe
1940	elevation_service.exe
2312	maintenanceservice.exe
3872	msdtc.exe
3988	OSE.EXE
1220	PerceptionSimulationService.exe
976	perfhost.exe
4576	locator.exe
2524	SensorDataService.exe
3060	snmptrap.exe
3540	spectrum.exe
4764	ssh-agent.exe
4960	TieringEngineService.exe
4208	AgentService.exe
2240	vds.exe
3712	vssvc.exe
3704	wbengine.exe
412	WmiApSrv.exe
4520	SearchIndexer.exe
696	alg.exe
4484	DiagnosticsHub.StandardCollector.Service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\63fd8c84c665fbf6.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017010-105.dat	upx
behavioral1/files/0x0001000000017bd3-107.dat	upx
behavioral1/files/0x0001000000017066-106.dat	upx
behavioral1/files/0x0001000000017010-590.dat	upx
behavioral1/memory/696-591-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/files/0x0001000000017066-612.dat	upx
behavioral1/memory/4484-630-0x0000000140000000-0x0000000140166000-memory.dmp	upx
behavioral1/files/0x0001000000017bd3-614.dat	upx
behavioral1/memory/696-671-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097313bc1ca60dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6a731c1ca60dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee97e0c0ca60dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cf0bbc1ca60dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a47e68c1ca60dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061f8a7c2ca60dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d93fabc1ca60dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2284	elevation_service.exe
2284	elevation_service.exe
2284	elevation_service.exe
2284	elevation_service.exe
2284	elevation_service.exe
2284	elevation_service.exe
2284	elevation_service.exe
1940	elevation_service.exe
1940	elevation_service.exe
1940	elevation_service.exe
1940	elevation_service.exe
1940	elevation_service.exe
1940	elevation_service.exe
1940	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2084	2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Token: SeTakeOwnershipPrivilege	2284	elevation_service.exe
Token: SeRestorePrivilege	4960	TieringEngineService.exe
Token: SeManageVolumePrivilege	4960	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4208	AgentService.exe
Token: SeBackupPrivilege	3712	vssvc.exe
Token: SeRestorePrivilege	3712	vssvc.exe
Token: SeAuditPrivilege	3712	vssvc.exe
Token: SeBackupPrivilege	3704	wbengine.exe
Token: SeRestorePrivilege	3704	wbengine.exe
Token: SeSecurityPrivilege	3704	wbengine.exe
Token: 33	4520	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe
Token: SeDebugPrivilege	2284	elevation_service.exe
Token: SeDebugPrivilege	1940	elevation_service.exe
Token: SeDebugPrivilege	696	alg.exe
Token: SeDebugPrivilege	696	alg.exe
Token: SeDebugPrivilege	696	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 2136	4520	SearchIndexer.exe	113
PID 4520 wrote to memory of 2032	4520	SearchIndexer.exe	114
PID 4520 wrote to memory of 2648	4520	SearchIndexer.exe	125
PID 4520 wrote to memory of 1772	4520	SearchIndexer.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_594f3c0e64e57cd946b77e003686f7fc_cobalt-strike_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2312

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3872

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3988

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1220

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:976

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2524

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3060

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1916

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:412

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2136
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2032
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2648
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  PID:1772

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:696

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aa13a81d9dd4161f21b956d36923d3d5139813af57f2bce7c6486f177d6a96f7
MD5 306e1f6af0c0b144dc955ca67991d525
SHA1 82a094e1f16e73cdb418e94eae6f03952e8702ea
SHA512 7d57238abf422144ef52c76d22b9a146f67026f5fbe65b5c7e7ce02bbc25d26b49cb9ed5b08a489ea412b2ba454b6f312f64e06d994b8f4b27a77f904ad21c86
SSDEEP 49152:8b+632BuPkFKRrdE6ohQstBhuXjfS4LWxnkHsZelmOvJvt/:m3q6tjB8imOBV/
TLSH
T166D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 884df21819edc8a3e0cbae0b0dc3d5e415a8bf054de9f40fd573281305d19894
MD5 83b8c75d1bb94b867bd738f477bdfdf7
SHA1 06cedbd7dbef172c93876862b3fbc73094bd1d5d
SHA512 d5ff900720c64fa7d43b6924d392513967451cd5ae7f5930c66c1f23ed6e87fe11bc8c574708f7a15cbcaaf034daea1e69b31e9f00064f6f1861e7fdd30b2bd3
SSDEEP 24576:zXYfDtczAzGssZel8Ad6OOnNO5JG7e/t/:Wtc6HsZelmOvJvt/
TLSH
T1EC05012963E008F9ED67827DC9B18511EA33B8554760E6CB03F49A691F337E46E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ed8486ada1d4524afac1b2c3788f030adeaa47576f2fb2b73adca1ad06ccb8da
MD5 d283bc48066ce33f4cdf9f6fe0ba13ba
SHA1 099f4b2f3ff30551a78197f725a275c2342df65d
SHA512 ffd07b0b53edbc8342270c6f42e6dc7e320d1255e16832a40f68d8cb0865627c013b03708b1e712f77a0f2fc6931b9b82d5079b5cd16897d1df75cb0149cacab
SSDEEP 24576:+0Le5ji0hmxnrMdGssZel8Ad6OOnNO5JG7e/t/GSaKngL2jdshRTdG1YxITqvfPH:+Pji0AxgHsZelmOvJvt/barSj8RoTCCW
TLSH
T14695D016F6748331D073C1B9C5D2A68AED7230865B3089CB4296D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.2MB
SHA256 325c5797245d5378c74b6699b09251c0b530d42491e069bb06ef42de22522c8b
MD5 fbbcc34c596c4fcb7c203c89de312551
SHA1 a196f461695907df96067f0e3c905380cd035753
SHA512 21c70ccf5a6ccdb9a90f296b39336c27de4f4c433341a141dfe9d09ec165713a00603a0c065d116e469aabf8f44ac1ff0f5b940de39921ca033da0befa4ebf71
SSDEEP 49152:B/ezSC6vURPvuHjyUHsZelmOvJvt/NarSj8RoTCCW:BezSC6vwXuHuimOBV/NJTy
TLSH
T1EAB5AE25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.0MB
SHA256 0b59fc49d23241eab7c726e404aef80fa18f8c454e80ffc4cd1044210e84884c
MD5 57c837ae9348aa3b6512a295f06aacb1
SHA1 3d8ad66fbd781dc082139316ff199e89de640039
SHA512 7492c3bed38c610cbaff645a5d008a8ca7902122e7de6483f81e8ce5aaaff8e14034ab8feaca07e43492defc1cef516e60c89faf93c8c922f6c52d9173fbb52a
SSDEEP 49152:+VO88hXlV0HsZelmOvJvt/XarSj8RoTCCW:Z/h1VdimOBV/XJTy
TLSH
T131A5D066F5748331D073C1BAC5D2AA9AEE3234414B31CACB0246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 778e505aff9b9aad39dee62d3940d98c750faa1f31288ad3ab332c581a388073
MD5 fd9f0909582da9d7159003ab27456334
SHA1 e29c5b433694fa9dbb593f0cdd665c98a9bcf111
SHA512 65ecf42080f62b95475985d7296bb22b31e02103b6f158f9867490cddb01f369995f55554315f455be6706c2a5f38e176a9f4a6c2a44923c2bce4841403a3d04
SSDEEP 24576:nGJGssZel8Ad6OOnNO5JG7e/t/zaKngL2jdshRTdG1YxITqvfPkbIcbjLm:QHsZelmOvJvt/zarSj8RoTCCW
TLSH
T1965533AB878545B4E28B3B713AB56A483CA3BF9D890BC50D85F17A9C25797F2F53D000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 2e747e119e7640634cf87f3adb7a1a1f3bde735549057c5dafcbfffffad324e5
MD5 472500f165c6048522ae81c86afcd549
SHA1 8198d410539802d1f51cdb0b400d9a5960344244
SHA512 be2aa9c0f70c75526e163374583016dc3d39a5c11e3b5102a06f59184d91e5671862b2ce68db86b04bdad12d5d8da7e9eafd5e4168dd87c88bce51a0b639993f
SSDEEP 24576:hJIUmGssZel8Ad6OOnNO5JG7e/t/zaKngL2jdshRTdG1YxITqvfPkbIcbjLm:hJIUmHsZelmOvJvt/zarSj8RoTCCW
TLSH
T1FA75017BEE28ECE1C27E5EB95B918600A77278704F1293CBD175830E9E236E15E79C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 5.4MB
SHA256 e6d75490251ce172c5e9a212743d360143b417d2947a19fc3a50448dbd8aa453
MD5 c851abf868ea9badae52753fb78a4672
SHA1 ffe72eebd91c152cf589178a193fd7b1465ed4f4
SHA512 b385e7ad2af7d65b5756b43a866785c4dab786560203ab30b0aae1af441a3e73973d6f0ff58d5e3a5fb5e86a6ff664a4682cb868c08558993b95470c0aaedd9f
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJz9DN5JmNRV3THS:JQvGAdlCEL8c/zRNC5CkimOBV/aJTy
TLSH
T146468E656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 69d600e09ec9a131104b2c7279ede1c7b2d282f60928b28cce32b3f919635c87
MD5 a283060ea016d252877615404b32932f
SHA1 231c6304ff073261e59ee54dd32ee10eacf9b7d7
SHA512 f8fbcd84cc734dd9ea7c3076898e31466f9201f606df330565eb86302fdb0d55b08d98e1844203f3ae5c10d60f61afffc719e387be18bf6287076ea84c3b8f91
SSDEEP 24576:gwewsAjQGssZel8Ad6OOnNO5JG7e/t/qaKngL2jdshRTdG1YxITqvfPkbIcbjLm:ZljQHsZelmOvJvt/qarSj8RoTCCW
TLSH
T15C850231EA74D436C3BF0EB22B35D70628797A604F4209C7E3F85E9D59302D2677AA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.7MB
SHA256 a92bfa71183b140fc8f1a2f5121513d91946d2bc2ff4dbb232d0513d5bd7512e
MD5 e27c94085cdea2e4a47ffe50fdd7bce3
SHA1 d6c9e9919cc32a4c3ce9642db8e9efeb6b2d0376
SHA512 9a0a4949997779106699a579b0f7c964d978ff450559888331e3ec89ec9da10493cd8d5f8166782884f3ff2834d2617804b8b6a615cddb4ecaf22ce5130e9ea1
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLy9XldPlbuJHILBl1J:kUEtQevvqc2W1cpV29X32ILBb
TLSH
T165475B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 3.4MB
SHA256 d965d6175d3db12559d9acd31e6c0727d0d7f4ff12c82ad9d9a9a1f4730c1058
MD5 472a61adeb0c141e0ff876ae8ebc785a
SHA1 e526d8d92e5850dbb66595295f9775f4842ca8bd
SHA512 7e9693581eb43647f1752376f4a3bf5eb740f6c76e39d168778e336a19fb9cf0d6dfdcb9ca0e79fca5335141468e120391f3441e6d8125a603c84b1a6466bfe6
SSDEEP 49152:rCbRquA/m2yL5zVfFiV+XenmE3/zwHsZelmOvJvt/KarSj8RoTCCW:0oqUVjnmIimOBV/KJTy
TLSH
T12AF5AE0976B882E4D1F6C77886A2C647F37178154B3197EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d169da834009e80d52f1ab5824fd879be1f82c1a20063162e9b99bdb672b5a3c
MD5 8452c18691b6d95e8c37704b35744b69
SHA1 03de30affc48388b3d059654323ea9b30c4b3f5b
SHA512 aa378ea856ce555e74343f8057607b445318ae3756f8ea2878d1cbd2b9ea3b7329b69a04f0cd00e170708d1834a4e674e12abf7770f01d48602b38d96fdb5738
SSDEEP 24576:qAhGLmIFoiwtA5l7S53DGssZel8Ad6OOnNO5JG7e/t/:qAM1Foiq5THsZelmOvJvt/
TLSH
T1A2359D81E7F945D4F5B3AA7899B68170EA76BCA65E31C20F2160D21F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 61b5c3ca658fb86a063d181bc8f2a8c4003298a9a690b80487cd5d80a10b8b14
MD5 5d4a9e6984c334e3ed7d6c192b8ca3ba
SHA1 02f31553112f96f1be0eee87f19bc4e4adbc1bd3
SHA512 b49a278c0dd92292b805e49ad4bc1418beb103e8f22f788ee48468e56d635f632a72f16e52fb57d3948e8b31f6ab0641e7fb9882b8a3050219089bbb52092214
SSDEEP 12288:Rmw5HEjsChNOBFgl0WDm+C/ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy08:MwuXOWBGssZel8Ad6OOnNO5JG7e/t/
TLSH
T10305F14622A50CF9E6A7563986978536F7B2B8122A21C70F17B0C75B6F33361BD3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 ee2192847112045245d200203843a9a97d43446044f09a819400adbc8dfae9af
MD5 c5ad87c367e3007ec428ff61363bcf25
SHA1 9befd917ce9b75b8ecb5711619a7834405da875c
SHA512 fd96d509603c4e5abcb291f9312557e8bad23cbf246a632ada62454e693e2d7c502655ef9102525dd481e318c3222c06c2884093af79bf264ce80562f3f18318
SSDEEP 12288:lbZ1Iy5ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:BZuVGssZel8Ad6OOnNO5JG7e/t/
TLSH
T181E4135A13E420FAE297537999F00705E772B4661B3183CF12B557A92F33BE2AD39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 478c49ab192db29d71f6d106ed3bf1a1d9312a55f78e85fbe1c0bf80739d6675
MD5 2e58570f1fae67e4c6c8b21ec5e90235
SHA1 29d852141993f9f8f67fb06af435052f442d410a
SHA512 e965591379ba5dd33b65155d16dd43ae61e67386c5efbcc05479cdef9374f8120f14202db37a49ff5e66d75478d89088af0a3a1319c4a58620d6abc4bdaa18a7
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UK:nQRQyi36YOcPuLvw2gAf+PN3vimOBV/
TLSH
T1B7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 170d81263eb7adbef1f5f95a20ad6b4d65184f80b72a00a75a6fd9ac6660b0cf
MD5 8ae3cec4ac87737c1aebdbe8cfc1bba2
SHA1 63fdc860bce66e9bc47f5af0987c19ca3548d192
SHA512 a1e4b7674b40588a6ffaac08f177b193929fbe05ae85fe06178b65c6e2df073d001050089242a7f5a070a836a1ace376623a06921cd80b5c3a5e16d5c99ff832
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23UK:kQRQyi36YOcPuLvw2gAf+PN3vimOBV/
TLSH
T10D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.0MB
SHA256 5de13c1433842d9cba1cbdd9b1422ffe3df8d7cc68d22483703473f9bd8ade98
MD5 5ad954e309546ab1ee7b3b66e3e412f3
SHA1 b40a199d0c03a8e714e87dd18664f7878e62804a
SHA512 5bbfb0f1a68771bd854eaea7781ba69f80f54d7462dc8cde64a1de2eb903ab20e3a6842111e28cb2c58380c58f751c3934266b05c64fb63de9c40d6e27e3264e
SSDEEP 49152:Q68Qg55nhxeWu7PNU3/gHsZelmOvJvt/varSj8RoTCCW:KthGRc/JimOBV/vJTy
TLSH
T1E3E58C33B2F200A9C44DE1769F4A872196D27C75CFE1D3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.7MB
SHA256 0d97f7325ab72f2dd7bada2acc6b7fd9c5e827510dedcbb2071793255bb2ac57
MD5 ea2a09d91b1119c42a00386190e1e2bc
SHA1 55b0bdaa5ba83826dfb8b7b0819ae5cce0edf643
SHA512 3d9607e88be8373dd9fede5b1eca0a8b553a0c7f7a29192871a9812e766c79b4470cae00ae2d90b44b7f1b45bfc156a41fc9fe5d3220940a32d676c51c5a2503
SSDEEP 98304:Uy5112gYy5azzVvD69nLKnhZyimOBV/MJTy:VLIH+Wh1LBlMJ+
TLSH
T13736AD13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f56d905e46a5e4b519873429b4eaa16bc9c07447d3c7e1c109b75f68112da892
MD5 c2335bea8c16e104c57ffafb81c46ce3
SHA1 14f22ed3fc5cd9fac1692a2f5ee6bb275bc409c2
SHA512 74f159d3099c92f057921d4f74d6827263f162f5855c42e5409b664b68fa36745df78e9b633964317f6b121d84984eeea1d5fb24db9b492ca976029a28e8e0ba
SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glDHsZelmOvJvt/:mu6JmQxd2doimOBV/
TLSH
T18FD59D13F1DA01E8D05ED578974A9233FA62BC490B34B6DF0A9073562A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 df0833d97352999f8f9b1fd7dc12e0327c0369740ad6f35e4fe0f319c8291e20
MD5 b2abe5f295ee46968550610cc2962e3b
SHA1 546f8e4cc3344e504467273de67102bd6776838c
SHA512 c0b670ca48e2500975df143ba166696075312835be44ec1f3cd0b0d546a5b730b75a362f027809a62ca364503ae43a71842ad8c732be6ff6ee991e14a3e1a652
SSDEEP 49152:o1hpsNoJpF1A6yU44CwH7R4xGHsZelmOvJvt/:omifPVRIimOBV/
TLSH
T115B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 02eaf6202d099afddea3b37a07f610fb03c4a843911964a4d73609c48fb40700
MD5 4bbaa7b30c83905d5340dfdd1c3f6d5d
SHA1 9ee78b02ad914e12bcb228a2a63a53746ccb642b
SHA512 6926cb410d23f1224a3f2d367dc72b3e76a48218b884521e0bdc6a54676bbd06f931357fce208df5e270a76eb7fd1abc15f9d7116ab68dc0c8045ae2a3acd180
SSDEEP 49152:PSuZQIY0Be2KIRVtOnks6NMHqVHsZelmOvJvt/:15dKOi61+imOBV/
TLSH
T1BCC5BE13F2E940E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4b50b122323b2930d79ea0e9a5d2be3c42af7bd0de78b49dd7c0a091251f4d82
MD5 4ca0d1553dc2d5b2a102588ef8d7a40b
SHA1 83e83df66a1d1efef31f6d8377c80f18450300ca
SHA512 b29f3621671c3c6f74c51a4640067c36eba1d1c9dd146381e8f14c464f0db7ab2f5ef4ab2bd66910b030b0cbe1937dcc521ce209767deccef0ddc2e5241b8cf7
SSDEEP 49152:whtSn8EApI0figGgiDn0AP5wCHsZelmOvJvt/:hX2i/phsimOBV/
TLSH
T12495BE13F2D900E8D05ED178C7568632E962BC160B35AADF0A90B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3539a824baae862914f465882e4771e3ba3f70a32a3f758e8847d30859dc40e9
MD5 7105e26b99f3ba21fffb92c6f347da04
SHA1 688441a26adf61584e455bc4ddca30cc2da5e565
SHA512 83c055a660d07b15a6fcabdb43d0ca2f9927bc4595fc5126ca5a4314881417b3643027ca4dea94b4e36bf71b45e5e15676e5c5c65f634bb67aab88b0b33245f8
SSDEEP 12288:LEywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:LBGssZel8Ad6OOnNO5JG7e/t/
TLSH
T137C42397019600FFE38617B3567017147562F9ABAF06C04BB2FBB6592631BF2F97A042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 6c73fd4e191ecc6993e4e43f62c8e9e5f3fce8a6e816a8bcabf7b198762f1d1d
MD5 037aa61c5b7d5766d4a0626f4c7b0d3d
SHA1 ed16049afaa2892821822e74b6c70d133fb3ab9f
SHA512 2de8de137cda57798390c8006623935a954a695809d7bdb0696852f1c4f33c74017efd46c1a15fc7674286aa44c2e33a970f4ca5e4146748f6f0056b2dd34afa
SSDEEP 12288:U1ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:U8GssZel8Ad6OOnNO5JG7e/t/
TLSH
T1DCC42397055604FFE38627B3567017147521F96BAF06C04BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 5e3d9acd1d7be73ef9070e838fa0fcacab883d4ae1bbabcb003046bde02e2d93
MD5 fab9598fe0ef6ee55899a59ea1d491b0
SHA1 68dca76f45d6c3df6cc4e65c9fa70f943ee3a42b
SHA512 a667465d09d89bb9488fe220317d187f7265595092537c4139b7ccd10afa710b41ccfc7e638d9d94bb5a1f498db610ca91fc97ea9d011f8681fe8add0e1b2b29
SSDEEP 12288:fTywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:f+GssZel8Ad6OOnNO5JG7e/t/
TLSH
T174C42397015604FFE38617B3566017147461F9ABAF06C08BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 dccaf1160e9bae2715bea5f7383905a7be057f5efab7e75c3d95f3801999fe2f
MD5 dd544f5a3530b7b1501502bf7434958c
SHA1 ad05b13d2f0cd0ae7c67a67270e184e3f167d005
SHA512 2d6f53f014163900240acc0adc36194b90fd4b413b751f449d075f8117a7a4815ecc417bda3ada776382d9d743d01cb2265a7a1f0e92528316a16edbb343c970
SSDEEP 12288:RV6ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:PGssZel8Ad6OOnNO5JG7e/t/
TLSH
T181D4235702A600EBE287A77696700710B572FDAA9F12C1CFA3B26A9D1E317F1FC39541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 14f4850f8a0a06c843f886f8f20b2602c0e5df491f38ef805f74a6f869a0de58
MD5 da29e140f92086137650196b51710dc8
SHA1 888dd1f7c228ea04da3530f08be13ad33c3d584b
SHA512 cbea5539f58419fb77391b2f16637408eea86d292925e25d424b8f531c1df3485bb19d9d6b4e78adf0f2f1d31422a163bd8dd32e265531660a40fa99348dc4ef
SSDEEP 12288:aiywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:aLGssZel8Ad6OOnNO5JG7e/t/
TLSH
T129C42397415600FFE38617B3567017147461F9ABAF06C08BB2FBB6592631BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 89e966c31bdf20f37b394b84239cc1e4611159fc14f7dbe02ba91456a9c21d8b
MD5 12e33f54440c6b24c09cdd1bc5c1a911
SHA1 78bd7f2eff2ed077bae147ddc3fca30fa48dfe8e
SHA512 adfe013f74525e0e64dd3e44a1de6d2d2176e8b0623654c2a26cf6c6d43360b39a67a3085a239d4862e0d780631c4215e6879452edd3e08cf495f3d03776ee18
SSDEEP 12288:aBywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:aIGssZel8Ad6OOnNO5JG7e/t/
TLSH
T115C42397055604FFE38627B3567017147521F9ABAF06C04BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3efa6a17a6ac65fe2e9b3df0a4fafd631610f9677eff549a5156637021e63163
MD5 e51d393b4ee0d76228f324767e8d3f65
SHA1 f3202d1736bdeed3047efb3c9ed0109196adf2dd
SHA512 3c1fc33bd01ba6d5afa490de0c8de9b88e2aebc70b2f0626702e2ccab792899a638974e981a208866a0016776b03ad1592384235d24b7063a5956f1360830a4b
SSDEEP 12288:y9ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:yEGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1D8C42357415604FFE38617B3576017247521F9ABAF06C04BB2FBB6992630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e4241d0253b96e41a40ed089507c37853cbf9dc1f51699c29c55bd08d7ac478d
MD5 9d7d029012d6365eb49e33d51f15d94c
SHA1 27ef6107856a26554664963b557653227d43225c
SHA512 e3940ed23a137dc38e697432019ae420f73e6df68149b16e85ab01521f17712b1ca9c82818784684c629f24600e2d40da4e7160ad780c76dd6f3742d0c6d493b
SSDEEP 24576:dZMJzFVSOcGssZel8Ad6OOnNO5JG7e/t/:dZMJzf4HsZelmOvJvt/
TLSH
T143050295739008F9EDA7423EC9614915E6B2BC5A0B60C60F13F5366B1F333A16C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 990b65e6e45314e3d885f9e76edd73538d3387166d47be32522736ce88383b20
MD5 137a19f3d64f2ed685545ffc9baf2b95
SHA1 6f3cd5eb07841a4d8dffee64871bb21a9622dc8a
SHA512 f05b0514866dc407133c2e46a4cd78e706e6d119c873b87fe1f765cd3576c13a2d4fee705d76974404a4f2eeca71725eef7bb9816ce7afdb159cf950f5c5c0b8
SSDEEP 12288:Y4ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:YFGssZel8Ad6OOnNO5JG7e/t/
TLSH
T11AC42397015604FFE38617B3576007147461F9ABAF46C08BB2FBB6592631BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 dbe65669ca57bbc52fceef4ea4cf1f556a1771f25fca1bfc1c5acb0cd0ac174f
MD5 682d866865ad064e8c9d52a2e834bd7c
SHA1 a568073ffb29881765b67464b619f44fc6371a7f
SHA512 c5f66583fd5b2da70aecc0d44469325329c34cea972c4d4d74d4661667fda2b16c1610e672d47dcdbf3ccf4a592774a9f35cda7e20ea14a79406a16ca4a4e4e9
SSDEEP 12288:ycywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:y5GssZel8Ad6OOnNO5JG7e/t/
TLSH
T116C42397055604FFE38617B3576017147521FAABAF06C08BB2FBB6592630BF2F97A042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 9bfed66551843ea8b33e2a092c89d0020a9f0d10079588f8358a85297a4c1974
MD5 bd9a000ceef07702833831fe4a806523
SHA1 de1572ac00729cc7a81524a05a724c353d92b4f0
SHA512 951e2b2a3ecffc72b18c960429f65613d0a82f626e6ddcf4bdafa43806062485fd6cbf605a4280b360dfc8de95a77c2597b459df4ae9f814acf3a987a38856c6
SSDEEP 12288:zyPz5L85ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:+zyAGssZel8Ad6OOnNO5JG7e/t/
TLSH
T16FF4125723A120FED167923589A10A01F772B8364B10CA9F63B4577A2F337E1AD3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 7281b9b433c871a5ab58d1536a0e95aca889249827aced53b5274557ec0a8cef
MD5 11c53d5dc698df02ae1f4f7c0801bf08
SHA1 bcec6b299482c86803ab1105da27c3fb9a67c92e
SHA512 c7ad2c0dd524d58f4e87152d28c777b7233ce7588eb67c130e077a94545e2a56eeb7092ce3a2e91e942cefb1766c8231df79fa8c42bf30fa31235e4d129492cd
SSDEEP 49152:oP4m4IpOO67/8KfHsZelmOvJvt/earSj8RoTCCW:AppOOiyimOBV/eJTy
TLSH
T1F5B5DF2DABDC0096D0BA927486658A49FAB1742E1F3286CF1160937C3F77EE15E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 3bdd219ec8ddc9d50ea2d12cfc3e5c4fe2b1df2aa70b5b03c7dcaf3511281051
MD5 7cde26f8f3e9c07ad8d4dfba156aea92
SHA1 1d9ee9d64b97ee5ae8d2b111a3c5666afa306d50
SHA512 49d60b12f948c66ddd28ffefb8716791e7743e6148514b3fb1d5c03a4e32482b8e6829724efb4f9cb22a34b824d118eaecd53266ba4a3e333a33e2b0c96d96d9
SSDEEP 12288:KksfoywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:QVGssZel8Ad6OOnNO5JG7e/t/
TLSH
T15CE4F15AC29801E9D19E6276C7514A00B3337C6587E1C3CB62E1F57E1F356E1ADFA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 62e0cd01ebe0be5752ab614d19de26ebbcac7e08a937b633f85509571f34b20a
MD5 03d259223adeeb744262b6a983f06387
SHA1 a97dbdd99022161d5bb186221e542102d4d5cfb0
SHA512 d159ba6f11ae74501f886b7b87da91338e95f5cfb5b743aa50ade0e48a0f7c5fb6778a57b1b3f49a31740cac6f6e0985f217e9281976ca747cfcb8c78bb468bf
SSDEEP 12288:RIywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:R1GssZel8Ad6OOnNO5JG7e/t/
TLSH
T1BCD4235742A904AFF2DA6BB2267047343526FA795F05C08BB1A677AD2530BF2FD79003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e9b6e463009ac9a33a6cbdc7a81275c21444ac91c728bc4484fd4f2f4f00bbaf
MD5 e3774595a02a41e9f41989727e4fd383
SHA1 3b34d2becc19988f4e87d214e85dd1425d8c6f1d
SHA512 b6d3b0fc33dccf3e25ca39015b548e00d6cab1bf22ea9e15d61ad4d0785c8f84f1ea8af24fa677bf511bc7c9e59fbce535c4e35f338ca06da6a4254d33f83360
SSDEEP 49152:fa0h2GEkuAe73q3pp46zwwQLHsZelmOvJvt/:fa0hNYG4JwBimOBV/
TLSH
T1F585AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 b046dbbd0d519570646793367b61a43876a2f900f3614f9da6f1b6e6fd964049
MD5 6861d8bc8cb1ef87257ee87d6f923339
SHA1 97038a0f536063f2def7a2d91663986aaa3260df
SHA512 b08bd37ae5bddccdf743d4c3602c5c33dcef53fe2c52205235cfff478529559ffca1f9fae93aaa4c32f229a8c151624385185a7a2f77e567f97384b7dd71f2fd
SSDEEP 24576:ghbHjPbaKngL2jdshRTdG1YxITqvfPkbIcbjLbGssZel8Ad6OOnNO5JG7e/t/:ghbHjTarSj8RoTCCrHsZelmOvJvt/
TLSH
T17B6523BF47DC01E8E166B77D66A14909E672B9691B0283CF52E1827D0F37BF16C39940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 c1c5ea15f778e5bacfc3f12395a9099763e4fd5a3dd6e523c48ef27a82eaabe3
MD5 1d784c43e36e859593f45cade0373b31
SHA1 3e0505d8e229d0ac2105f1e25d90d0319d9479ba
SHA512 fcd482080e2214173ad918ee5ec0fe3fd5cf1f42a230a3baed851a964f2a17b3ba86f2959067748fbb950a1609f833035c57ce7b15aec5eb5751aa3990a25fbf
SSDEEP 12288:ysywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:ypGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1C4C42396015604FFE3866BB626600B243521F6665F06C0CBB1FBB79D2631BF3F97A042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 4d303935cd7b0aa204db814de080225a08a5ac70b2bdd73a4521871a8ce0222f
MD5 3ad584f491bb39cb2851b6675285e8bc
SHA1 70d77ec3f1dc65cb9f78a0e8215762a1690926cb
SHA512 fe151640a77f9d0513ccb8f2bc645eef88f555686b5fe04b28cf54f896e7f193c45bc6ab0e037161e64292b8afb6a54aa14893946c541867c4a89c0b42fb99bd
SSDEEP 12288:zObZA4LWOsvAYFTXywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:ctL3UTCGssZel8Ad6OOnNO5JG7e/t/
TLSH
T114250255E7A400F9E96B923CC9B28A12E272B45D0714D7CF03A94B691F237F29E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 981fc79314f1a3ca9614023f98113210c99b2b6d0b521a5dec27eb740186f609
MD5 e51839c2248ac59b1553f88cfb5e5522
SHA1 f6db4eb84e231f7556e4b5cee98d8cd274410db8
SHA512 2db50dab32d61818fbf75e689eabd803b1f1f4485bf31eb5ecc403b3724dff52edaf6c85b6cfcb63dc3c3f102c79d8f44a59156b41453f21cdc35a5711749cf4
SSDEEP 12288:ZpFtUO2ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:EOfGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1AAE4025A22ED10F9E166627D4A924309E371F8661B1287CF42E181BE1F73FF4BC3A651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 120b123ae8dfc3656ce22ca6ad112835992b7ad5c6c0ef57d59bc4ea5ebc3bea
MD5 9902686eb4a53d7d67d1a8fd089001b7
SHA1 c564dd70cea26bbdcba1a408df69e966296d06fc
SHA512 6ef6da7b9d4cd9874de34284beb2994b2adb8c0c7e762fde2d9a7cc1198ec88c27f3765397bdec4d53d2be29e0f42f541c08cb82ecc72fa56fd82a15fa91256a
SSDEEP 24576:Q7NM9YmZqmWMUkPjZM48Mv6bEhsFGssZel8Ad6OOnNO5JG7e/t/:Q7cBWMpPjN8DbEhsHsZelmOvJvt/
TLSH
T1FE65AE2E5BAC81E5D577D13DC9A28205F2B2B4611B318ACF1162833E6F37AF45E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d19002e55588896fba238c4147cd038ab19a306afc7f7e1f762256cb9e2437a0
MD5 ba92e0252f4b8b130398c1c0f812e0bb
SHA1 4030614dd8ef821d5f5a2e786b1a12a309a2ce7b
SHA512 ed28a1df515522ba7bf19a8cf4848b9477e84ff4e2224ace65add96662e37d88b54e8e5ad4c97fe1c6c0780f882e1fdec9d2a984b913f288a5e913e3782e378d
SSDEEP 49152:hF2YuHNETovcvNYf8kmlHsZelmOvJvt/:k6tCf8k7imOBV/
TLSH
T148858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 2.5MB
SHA256 3ece83a71131e4a4f4d1bcfecdf8d626755eec88eacf21739308e6479cb24c9d
MD5 fb1f9a9589d54c0273e9094d4ba58fdb
SHA1 fff261eb52c1bfd6f0151413661c15ce3c34426e
SHA512 7bb6491ab5aaf45c13511d51f8bd74ff9fce5a85c35c2922256536c3d99b999f8005ff2dd7bd9f24265a58b3e7d7d4536145ded98bba9f5330e68a057a4c4d1f
SSDEEP 49152:hF2YuHNETovcvNYf8kmlHsZelmOvJvt/earSj8RoTCCW:k6tCf8k7imOBV/eJTy
TLSH
T102C5BF2A27ED80A4E0BBD2BD45B7D246F9B2B8551B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c58d503e39f38a22e2b95996f7cbd815bf4b4f790b4fe375f4071aaf653ab3cd
MD5 b7a6cad3e48f735aa887cbf42f89e6e6
SHA1 c30a3c476752f0563ae21531c75c0e7da43bf9da
SHA512 e35da333ae4ac2c8ea839df3f042ef6220e98d43722cce955f49aea8def68364057db47b6afdc1368baa9dc405486c5c4574fbbebf29ade75d2865ecefe4a81e
SSDEEP 24576:qAFs06+Omlf8NXEbToaGssZel8Ad6OOnNO5JG7e/t/:zFs060lYXurHsZelmOvJvt/
TLSH
T16165BF2F62AC00D5D07ED17E8A96C91AF6B1746307215ACB0260867E7F6BEF45E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 ca80ea7c3937a0c50648f61cc7c4de2c64084e77be8be221fbc2d939972f1263
MD5 445f5d769637bdc248afe8b71e6b3044
SHA1 dab8e880be43b9ae3f952b13af7b4004bb42266e
SHA512 132f661bdab7baf41b878ada0077c7045ffca6c78d564f602d2729c84c060e042c13fc191e17f1bd32510373a0339afe054eaffe3046ce430ee6a3f8b46c1a29
SSDEEP 24576:kJnJ5D3WtrGssZel8Ad6OOnNO5JG7e/t/:kJnJ5DGtrHsZelmOvJvt/
TLSH
T15215D02DD2A810F9D4B7C2B4825A1B55BE72387D2F2269C724B4D5353F22FE0A979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 bf1eee94767844c4540eafedcfe11f51e09c936fb3ee5e6abce5726c2d7ce26f
MD5 b9a9ba00661105e4462f6e7710f06360
SHA1 76255ee4c828554ca10981b5ada6cd1600581848
SHA512 90607ab75f8cfb7b1ffee8be0a28c4285b1bbcd72e9d0d5401e1af54550053c5af09581f7e0f7ef70a5610d75231cc4a87e1f3e8ce7ef86ef20dd53843536d1f
SSDEEP 49152:lo06DIKdwc+eQnSt65aVBHsZelmOvJvt/:ycimOBV/
TLSH
T1C8956C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 7f33c00108d52146b0dc45bfc23d8b1af46eba96e4607d48509adbfb0a4d128a
MD5 1b726467a6358c3d5b54d45807f062e9
SHA1 6b98a592f04b4155bb1cf099e5139bec8fc2f271
SHA512 667e1d4f4c0c463f7985738b0307de72b6510b23ff22d0d192f40425c3d7c32e4cd6bc160e3ecb3bbe515a6c5538ddbacd1f134ba46612d3b638e0d50f7f64a5
SSDEEP 24576:PilaKngL2jdshRTdG1YxITqvfPkbIcbjLm:PilarSj8RoTCCW
TLSH
T17A05226EABCC61E4D12AA27C69A18549E7B3F178570317DF45E0827D0E77BE52E3CA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 b431f216c0e0806dfc4dc64b6d1e0c3e33eadcdeb44a2a721c1780d1fc560496
MD5 8e209aa5efd5ddd60b51f80e989aba92
SHA1 9da4cb6b697f759f278559a5cf903d7caa264661
SHA512 479a78b2ca4cc113ba4c99db844137b8e88d872b758e05f2b49901d0115dca9cf9c0cc31f5e18dbceed9202506d1fc991384dcb604292eb32d2324c4e9a92f5b
SSDEEP 24576:dtlaKngL2jdshRTdG1YxITqvfPkbIcbjLbGssZel8Ad6OOnNO5JG7e/t/:dtlarSj8RoTCCrHsZelmOvJvt/
TLSH
T1346523AE57CC50E9D16A637966A18A08A7B3F1A95B0343CF85E1D27D0E37BF16D3C900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 5409907049aee363124749ab8027c8c7bd438f0e8e97bae49cab24b102700c0d
MD5 dc95e1d02b5c6ca7bb5c6d502ca8e2ff
SHA1 4c2766b1262f3cf65fae8a2c2d9112d710685595
SHA512 b34e160a3ccc2f325d4a0a739b2a6144cab1570d2442d77bb1ce3bf7c7f2c04c9ade99551ead207a92bf2f615c43fbd49f9f357fc088b2bd5a0e8c83522b1b2b
SSDEEP 12288:DjkyMywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/z:DIyJGssZel8Ad6OOnNO5JG7e/t/
TLSH
T190F41245439850EAE6AA17799A7242606A31FC315F1182CF61E1F73E6F32BE1FC35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 01adb59e036ff4ce5c7fdd77d9c63079866fdb2f324888d18d7abad9d4937d1f
MD5 0cc42a44d9256a8f7fd2d755050b8c58
SHA1 168808ce1cefc4e990f656ab8ecf697602f7a742
SHA512 308fa8ef0c1c8ca865e164dbd91b7529c1703e1c0d0c0a062f6be5019a3726b8d88307570a0c6041cea72a2a9c8515d26df98951b8badf103d3ba061cc7bb51c
SSDEEP 12288:cFrywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:q2GssZel8Ad6OOnNO5JG7e/t/
TLSH
T163D4235A026610FFE28627B616700B202532F57A5F0584CF71F6F6B96B31BF2F97A442
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a8066c37e46180f10fcd67ed0325b3a0760aa7dd438d4e69e8440bc286a34883
MD5 89defa9cd523f5e93c06738500b171bb
SHA1 4d81e3a43cce11c3814220aeb93dde9d680bc6f6
SHA512 f2e974ad0735703ee58d629f076032f89a50e344d17100fe7d2854a3e85dbd3a412c2224e6cfd225ba768629613d50e6974ee0d9444dc7736f8e82226c71d3c1
SSDEEP 24576:mQ9MxZKdcz97w39GssZel8Ad6OOnNO5JG7e/t/:mVKX9HsZelmOvJvt/
TLSH
T172558C2DABE9059AE177D27595A250C3A633B4311B31C6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 1c55be5d02ed44d1bd63a755f0119962d33c8454268a6eecab04e2400f863541
MD5 58cb6c20564387386e73cb177b332fb8
SHA1 193a58e817d51d3220c3b3de304558f789b9b87f
SHA512 03fed17488401e57bc5d41badfebd522d638dbadf556ef404244ce869ee1e4438beea53481e374520424bea3239be035fa8a5094df5b8f27f72ca9ad6b66114f
SSDEEP 12288:JyoKo2HRple9ppywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:JyocxApQGssZel8Ad6OOnNO5JG7e/t/
TLSH
T161F4E01FB76A40E2E166923C89858745E773B0705F5293CB6592C33D4F33AE9BD38A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9598b0bba4d8a75dc381a7420ea56b8beef714652f3af3eadc5ccd7dd2c12004
MD5 5c16b876cf9f38105c6def73065552cd
SHA1 a6e9155b96a2083cc4afe851a859a26b2ddbe36d
SHA512 e3f555aa5b888a411ff1a90b6b8ca1a2aa3f063a3b88bd57286f657ddb7f8cb1d2097a38b116540e18899eb01fd84b84decdfd41b0118234104b3aae9727d506
SSDEEP 49152:1WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKQHsZelmOvJvt/:l0zuNINimOBV/
TLSH
T197A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 285e0415b5f8973164daf0594e17c8ce174589b1aa5bf0e55fbac398711b3f72
MD5 620ce4cf26479953cb3d1e9caf1da8fe
SHA1 918c49a40b27c1f12e945fbcbb30768cf42ba1c1
SHA512 41858f0343aff7f40269c693ba133c88fa350f747fe10f2880d82ca12b4c4455805d2c0c921d46e17c209578388258e6e3d344e7acdb8bb9ce4cd6e00299a399
SSDEEP 49152:fa0h2GEkuAe73q3ppj6zwwQLHsZelmOvJvt/JarSj8RoTCCW:fa0hNYGjJwBimOBV/JJTy
TLSH
T189C5D01E67DC82B5D0BAD278C9A6854BE6B2B4260B3156CF1190853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 a146100d7042106d0012fab44e3ce2d027bdadf06e215a5675c1910112682574
MD5 7e79e8d20bcacb5f6c5eb7da89593f24
SHA1 06641b41ea268095f057d6f9412115c8ce291d19
SHA512 9cb862f61a7be1daccd24438ef8ccffc0aee3667c08fed64f469f70ba24a33a0cd7ec08d266f44b2caa30f9ed69ce57e02de90cd6763faf9ebff40c79766ec5a
SSDEEP 24576:91QT7EcpfxR+N5AWAz3ooiYhjMqbfaKngL2jdshRTdG1YxITqvfPkbIcbjLm:ITDxR+N5YzTTjMmarSj8RoTCCW
TLSH
T1EF75C12EA7F815E9D17E86799B23C506FA727821033193CF42A0C17E1E6B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 8b0f4b9cda4e5587752174df82f8d83a82c97f82ae9d1f4a9563ba241769174b
MD5 6a38442008ebaa77aafe2ba806ce425d
SHA1 d60c70fa6e0ebc488c29e07042194f8b82ce1830
SHA512 d86bfc9e977caa5614e9deaf7ae52bcd920fb3b1eaf5be36cbb03c26557ca3131364d50629458d2af1c4fc3ba12ceb6404b5fec566e37c4bbb405c66863cb1e2
SSDEEP 49152:DTDxR+N5YzTujMmarSj8RoTCCrHsZelmOvJvt/:Lu5jJTEimOBV/
TLSH
T16FA5E12EA7E805E9D17E86799B23C506FA727821073193CF42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 8c8b62246be5d5f11c9277ec732dd79ca4b91a27ed3e912c1f997815a4c8a7de
MD5 bc3eacaebb166ffbff58c73e91b98d2a
SHA1 47d3767d82cf5131ad6fe0ca4a05af8baa1fce14
SHA512 e3b22a1115f2175088b50eb73433df37cc89ed7a9c2e5345f038247b82ed4c88d3b39fd80283200e74f135ec6a06fb0e39e386cef80f2f709d9135638188acbf
SSDEEP 24576:OhbHjPbaKngL2jdshRTdG1YxITqvfPkbIcbjLm:OhbHjTarSj8RoTCCW
TLSH
T13505127E57DC12D4E176B37C6AA6894AEA727929170683DF46D0827D0F3BBE41C38B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 db1116a5aeb2e461dbdc6b89dd17f1312422a052b3cdb76e1d9287df9283cece
MD5 14f275da492d0f5ca5fa994b17e923b4
SHA1 ca853c7a51543c70d8b3b3dc2d866497895d88b8
SHA512 301e0c940051163b92c20c211e02f921c64da8fce0e1af7ac7c1c623df98395c25bb6addf6a75a9ed88d5d6f1046abfec0734eaccacc5b77530e7fececcb28d6
SSDEEP 49152:Q0K+vmSLjHsZelmOvJvt/XarSj8RoTCCW:rYimOBV/XJTy
TLSH
T1CA75027E939D04E4E57BD27D9A538906F97234660312A6CB06E0C1B92F6BFE0793DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63fd8c84c665fbf6.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\63fd8c84c665fbf6.bin
Size 12KB
SHA256 11721ed32b3d3181addd1d4c392e48ae41966894c0fe18e5df7ee0dfe1126d89
MD5 f2529611a70e49d6e0b90899a3d2bf92
SHA1 ca9abf0c5a230fe190d1d8e40512c9d0e20cc613
SHA512 34e773171e22e4791fb94776e21dcd9d82eca41ec266167f8f1be59dda6b0d55b9292cab491c7868e0f63461043c2ad24e7358d49df59adecc955d975fa2d599
SSDEEP 192:LhZMtjm4+5Nf4NW7Eucs3iP2kpzSaBoyp7sR7pER7yiWJ6qVXUmL7pV5L:LhGd+zLZhkp7WyBsR7pER7ynJtHV5L
TLSH
T1FC42BF0CE4F282CAFDD3E3E34E8FF60D860199DB00687422E545C80D4AAFB756DDA815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 90da43c1e3785d46858e8f0d2f29b39cb6a6467b77d3d3c2acd09b65d1740c84
MD5 717aa7fe2ec0ff729a20d8aad8b5f4d6
SHA1 ace1c6fee56e843d2d71fba13d72bf2a4b4420c4
SHA512 c390a45b29bbebadbc7245b0b755a2f30242c2b7c69fbd331f44a48ed6f442b203ac474cafe54ab42260ed17a6e9496afe40a9fd51fb6444b49f35d4520bb8c2
SSDEEP 49152:WIgnaTk46ppR/zHsZelmOvJvt/7arSj8RoTCCW:W32imOBV/7JTy
TLSH
T1D895E12EF3B910B9D4AAD236450147B5BB71782D1F219ACB01B0C538AF1AFE45E39F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 90aa808dd07100b8b36f5b746707d989f49b7a6ce2299b9d5a4f06cff06c6795
MD5 d468e7ca473ef0ee658392d01636181c
SHA1 0b3a2589d5c2b2d3f74a1d341da6e12d8486a868
SHA512 8e35d6053731452707efba5ac93f012f255ef52f282e7f72ee2c897460303e7a96531773d876f68b87b674ff551c2ff31b46791b43d8e58bfa412c74087b12fb
SSDEEP 12288:I47qywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:/zGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1CBD4125E03E820E9F1A267759A710215A631F8761B1185EF31F1DABE1F32BF1E939702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-262-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/412-254-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/412-492-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/412-260-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/696-671-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/696-591-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/976-122-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/976-128-0x0000000000570000-0x00000000005D6000-memory.dmp

Download

memory/976-123-0x0000000000570000-0x00000000005D6000-memory.dmp

Download

memory/976-219-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1220-218-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1220-121-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1220-113-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1220-119-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/1940-153-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1940-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1940-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1940-57-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2032-491-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-486-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-477-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-488-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-482-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-476-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-483-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-484-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-490-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-481-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-480-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-479-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-489-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-485-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-487-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2032-478-0x0000014250120000-0x0000014250130000-memory.dmp

Download

memory/2084-0-0x0000000001F00000-0x0000000002094000-memory.dmp

Download

memory/2084-14-0x0000000002D20000-0x0000000002D80000-memory.dmp

Download

memory/2084-9-0x0000000140000000-0x0000000140C1E000-memory.dmp

Download

memory/2084-1-0x0000000002210000-0x0000000002293000-memory.dmp

Download

memory/2084-22-0x0000000002D20000-0x0000000002D80000-memory.dmp

Download

memory/2084-82-0x0000000140000000-0x0000000140C1E000-memory.dmp

Download

memory/2084-7-0x0000000002210000-0x0000000002293000-memory.dmp

Download

memory/2084-130-0x0000000140000000-0x0000000140C1E000-memory.dmp

Download

memory/2240-468-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2240-220-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2240-227-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2240-221-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2284-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2284-141-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2284-35-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2284-44-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2312-72-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2312-70-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2312-66-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2312-60-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2524-154-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2524-471-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2524-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2524-145-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2524-151-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2524-469-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3060-326-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3060-166-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3060-164-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3540-433-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3540-170-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/3540-176-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/3540-169-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3704-249-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3704-250-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3704-473-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3704-243-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3712-231-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3712-472-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3712-238-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3712-232-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3872-83-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3872-80-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3872-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3988-203-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3988-97-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3988-90-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3988-96-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4208-211-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4208-210-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4208-204-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4208-213-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4208-215-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4484-630-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4520-295-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/4520-475-0x000000000D690000-0x000000000D698000-memory.dmp

Download

memory/4520-275-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4520-272-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4520-266-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4520-493-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4520-311-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/4520-279-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/4520-474-0x000000000D690000-0x000000000D698000-memory.dmp

Download

memory/4520-466-0x000000000D170000-0x000000000D178000-memory.dmp

Download

memory/4576-139-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4576-242-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4576-133-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4576-142-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4764-191-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4764-187-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4764-181-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4960-462-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4960-199-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4960-193-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4960-192-0x0000000140000000-0x00000001400E2000-memory.dmp

Download