b98af347c2e7f4169d52cbaca3eab17a90c8acb427961a988330a882be915073

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Size 1.2MB
Sample261024-1cldfaes9j
SHA256 b98af347c2e7f4169d52cbaca3eab17a90c8acb427961a988330a882be915073
MD5 1096026ac80d1ac23d990e6dc4918268
SHA1 56aaf7485905592372651b39a48ec1b7a110c31e
SHA512 9a491e9de76bacb0b97a4cd50146e19c63fa4bdc60cf66b8add3a7b278c5a4c0872a9f5e43e6bdd35434b163ce9c4596172d7d1d338e84d8291858a019ec8ef2
SSDEEP 24576:Fm+GnKuKvV6+CtEVXXC8Ac2YV3swxhZPegenZPwC7:hGnKZsAWh4sCdegmZz
TLSH
T1C445BF43F94685DCDA6EC07D871681326632B88947306AFB21946F3C3E6BDD61E7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1648	alg.exe
2264	DiagnosticsHub.StandardCollector.Service.exe
1720	fxssvc.exe
4924	elevation_service.exe
2412	elevation_service.exe
3088	maintenanceservice.exe
1828	msdtc.exe
3336	OSE.EXE
1556	PerceptionSimulationService.exe
1116	perfhost.exe
3152	locator.exe
3836	SensorDataService.exe
1696	snmptrap.exe
3888	spectrum.exe
3988	ssh-agent.exe
3580	TieringEngineService.exe
1952	AgentService.exe
4904	vds.exe
4752	vssvc.exe
3904	wbengine.exe
1280	WmiApSrv.exe
4300	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4217d97ca26b1277.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053a511e7fe63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e1946e7fe63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002428b6e7fe63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b17b48e7fe63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000f949e8fe63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
2264	DiagnosticsHub.StandardCollector.Service.exe
2264	DiagnosticsHub.StandardCollector.Service.exe
2264	DiagnosticsHub.StandardCollector.Service.exe
2264	DiagnosticsHub.StandardCollector.Service.exe
2264	DiagnosticsHub.StandardCollector.Service.exe
2264	DiagnosticsHub.StandardCollector.Service.exe
2264	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Token: SeAuditPrivilege	1720	fxssvc.exe
Token: SeRestorePrivilege	3580	TieringEngineService.exe
Token: SeManageVolumePrivilege	3580	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1952	AgentService.exe
Token: SeBackupPrivilege	4752	vssvc.exe
Token: SeRestorePrivilege	4752	vssvc.exe
Token: SeAuditPrivilege	4752	vssvc.exe
Token: SeBackupPrivilege	3904	wbengine.exe
Token: SeRestorePrivilege	3904	wbengine.exe
Token: SeSecurityPrivilege	3904	wbengine.exe
Token: 33	4300	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeDebugPrivilege	3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3012	2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	2264	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 5004	4300	SearchIndexer.exe	111
PID 4300 wrote to memory of 1128	4300	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_1096026ac80d1ac23d990e6dc4918268_akira_cobalt-strike_rusty-stealer_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2388

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2412

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3088

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1828

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3336

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1556

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1116

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3152

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3836

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1696

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3888

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3988

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2168

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1280

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5004
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d814bcf515b757e3bffcdb56f50d9d8687ce73ab6ceb10ecac3fa51c03e67a21
MD5 b410d90fe044fb822470b98705e34a78
SHA1 f122783adabcb196ebb810026bc10cd28dcb6efc
SHA512 155a3d420e26243749d0f6b57cb2046facfc26c2c2c6713f58da1f27648b9d8c4520da1ad1122524d4aae70396ca4400f1fd0cfa0cbbf7d8d914d35df9f0a9d0
SSDEEP 49152:Wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxneWh4sCdegmZz:I3q6HjBjWIURZz
TLSH
T1D4D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 498bf77e10c90cc53221f20c2a3de8eb82b8cc2fadf5f3b78235976e29f44262
MD5 059baf1723b9cbb8b37d51318a0f90ce
SHA1 9e461cb21daede13d77d2bd20a6d8a4c12be92f0
SHA512 0bc7641c8054453daf60c9028dc60cf60acd25e4e4194cac521c49b90aa2136238d0aecdbcbfd8f9329a999d10415dfbe59d6e631c77a292d648a21591b2f5fb
SSDEEP 24576:nXYfDtczA1VXXC8Ac2YV3swxhZPegenZPwC7:ytcYWh4sCdegmZz
TLSH
T114050228A79508F9ED7B827CCCA1C515E633BC544360EB9B03E09A261F376D85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1a6c31f3e0f1d24669441599fdcc5bad5a346e88645a9b89d95746e6e70317fc
MD5 dea6d16175ed8593c558a7d6cd97d0bd
SHA1 63ffe040c32791d43129738c0762f34af256b989
SHA512 8831e585e62a25b9d40feeaa102199b7bbc0ea92e186cc2871d68569a1ce28c8d354abcddc9ca4dfb344ddb5c367afa0c27c81a16ba6612bd2d3bf7cd2aab7c8
SSDEEP 24576:E0Le5ji0hmxirMoVXXC8Ac2YV3swxhZPegenZPwC7:EPji0AcNWh4sCdegmZz
TLSH
T1EE35AE26F6748335D073C0B9C5D2A68EED71348257308ACB4286D77C7E6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fba897f5af72c5b88c3582599fb4066ec67c89a0467a0fb2a38df869daebe461
MD5 e2f0e3f29cbe6364bf66796925063706
SHA1 fbb4e7bcb4b4ee0ac24eda54f3d4fc39e30392d8
SHA512 16e35936eaf81629ef8e8e75ac76524ddc90a0c00938877918d46010fbd01d2df717cd1d205794faf31b8f5b65dd9139b1ff0fca43fcf253c808ce4a605b167b
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWE6q8wyuGVXXC8Ac2YV3swxhZPegenZPwC7:q/ezSC6vUzPvxHjypWh4sCdegmZz
TLSH
T1D9756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 358576bc2bd512597cc75bb022b1d25ae2460669b8deb485998503be46a69060
MD5 8fb1f90a532eaca421becd39a4326ff0
SHA1 176608073654cb9654a3e08a07724196f1c4f842
SHA512 955e59024f7dd04f386cf47de26cc88ab638beafb231bedd98a148ab96f0491bc989cca8bb6990a19768afb725dee885c1456aba4f2a2c116b9868460b8cfc5d
SSDEEP 24576:JVbqPb88hv/l+6JVXXC8Ac2YV3swxhZPegenZPwC7:JVO88hXl+yWh4sCdegmZz
TLSH
T18D559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 907ff85312b4b3883b927ed8b3a8410895a068c1f9b7fb268919bc7ae371d4b7
MD5 3ccf59ce450d347949d1fe1ec6623315
SHA1 cdac569a491abe551e9f0e6a8dc0115f15998b83
SHA512 4e3c7896bf36c404015cc527f470a72b9248502d2448a1d803230a5e46137084f2da1c639393b3cad5349c16d8bc016bcf60a3d586fc05ab2782d65b977c277e
SSDEEP 12288:9RMVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:9RMVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1C8C423A2CE069467F7BF0674DDE4E7D9E2289F949084CD29D2917F1A6C3C899B432133
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 6cc9eeafdc4e959befb59a9c6d4adcc43035448dd5c9e51fddcef88c70db250e
MD5 ff4f14fa55b99c9966ca6999028af5d3
SHA1 cb8acb5602e721cdeefce742183503a5b1429988
SHA512 773dbac03ec546364a50fbbe5349b3a67df005c1b515672065fbfc96813f847ffa3f0e8f0e88259a2980d1146cbcb2ee2f919eee9e763070ee2110b2b59e4707
SSDEEP 12288:BeBNUbTVO86UhVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:BJIUhVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T11405CF3BEE28FCE2C27E4DB85A918340E77278304B61A3CBD165830E9E275E55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 19ae223518fb21ede61d0a5d118677b2063304fd17c5f0a6467620cf2abf8dac
MD5 ea802e2ad0ffcd6435253c75ac6ebe36
SHA1 6161839bdaf62d63da786fdf9609fd9d4d103237
SHA512 9cf2d07f403f7c4db9183f6b9bc21ea1fa3c9153accc95b2e855fbd54d17105b1df91a1e0fbbf1ccff5826da9d74917ac0033a9a1c095445de55da78ab178749
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:3QvGAdlCEL8c/yRNw5C4WIURZz
TLSH
T1DB266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 a4470490fef7c72e2b2e953cbbde0d22db3ca23f39a389a4d3f1b9d0837374a7
MD5 33339cf6c5399f37c52a53327a2e7864
SHA1 9219d8fbad7e08f487017995be8d71c167870eb0
SHA512 904ed77f992a6b581e835a7e1433f2bdfb7fbfa0fa50f3e36611462ddddd935d44a7664897df30bd4685860441cffda1b9647edde741ae8029b38de1a57e3782
SSDEEP 24576:IdewsAj3VXXC8Ac2YV3swxhZPegenZPwC7:IljdWh4sCdegmZz
TLSH
T19115E031FE75E036D3BF0DB61B65C716542CAE204B911AC3E3E89E9E59341D22336A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ded53b2ab50818185aa501620751d0197a8e7be18af77aeccf877872cb4a5c66
MD5 9d6d35def6cda140e92cccedade51a41
SHA1 20cbeeb4600a5530fe294ca6fa688b962a51caf8
SHA512 83e1024f74d87d80c406a064e443034d5548535ef86e0b2458298f52b03283ab333cb835952f3a5eddc5043749737b5f40b4de353e543c42e5b34438c900722d
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHEp:rUEtQevvqc2W1cpV2EI32w
TLSH
T1D0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ac8058ad1d06acab386c597ce3962117ce9284572437f83e49cd6498843d09af
MD5 79826f5ecb28728eb79e763e589c3ecb
SHA1 90cff867cc91cc49a2c4f08303587e0dfff7def7
SHA512 dd3c283bf2fb211bf5a02e0925b007b4c82e43cf61f1730de797287c0ee33af62ea0fd16edaa20c0e59adac475684133f431cdca9133ad9d16898d1c32979de3
SSDEEP 49152:gCbRquA/m2yL5zLfFiV+XenmE3/z9Wh4sCdegmZz:poq2Vjnm0WIURZz
TLSH
T1BFD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 506bb6157f25ee104f597347b17cb305e92ea206d21c8ed346b016389be4d083
MD5 8267c1e779432f223f96abca3b4eaa03
SHA1 dde872ea1c313c90ad7daf14738e297ca2c854b0
SHA512 e153230274a779aba2f2c8b9e5e87a3cb15e3a9b0123c339f274f7b264b4b085e78d1ef55850353be66a5ebe99a4a9afd7a7d5d735f7a8df3a5982dc8c967328
SSDEEP 24576:1AhGLJIFoiwtA5l7S53CVXXC8Ac2YV3swxhZPegenZPwC7:1AMyFoiq5EWh4sCdegmZz
TLSH
T11835AD81EBF955D4F5B3AAB899B69170EA76BCA55E30C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4d88416db501b3c76434f56781e9397ce1c759c9336fb185fce6d80a6d19408d
MD5 facb5ad2041182e7aefe0e38fead90f6
SHA1 715c1a1933d9233b2c84a4e118b8b0fb88214cba
SHA512 47d1c5a26047da62a00a46df6edea6dba63af9d83bbf9c7ae4f968e8d3ccb968deac618868cc32ff3c1b924784b3c7eb38bfee52e3695765bafe8000601062bc
SSDEEP 24576:gwuoOWzVXXC8Ac2YV3swxhZPegenZPwC7:gwDOwWh4sCdegmZz
TLSH
T1F405F14666A50CF9E9774238C997C136F7B2BC012A24DB1F5360C75B6F37261BD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 804265b979cd770918fa4ed1808cc0e01356bd410f92fd5d757b25455d580f47
MD5 00d6ad55119312d94e3a1dd4bfb9fed0
SHA1 bac2d64135bd907fb5be239450d1a5c0a0cd4fc2
SHA512 04a7739c5958b2481057d598dc8e4a2930802a5f7e0fe75bff9615b1df5589801847cf6427b0b788388e21fe350aeafb6c62f56ba1cbdc5c4ea79e27a0f1de5c
SSDEEP 12288:7BZ1IynVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:VZuAVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T118E41296279460FAF2BB4278CDE09789E371BC51637487CF42515B6A2E3A8C52C36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 afc7af98b59604fe25786279f24e24ad1c56045f574ab2d7c4554419f031bd8c
MD5 c952405b644834ad0768b4e72b0a07ee
SHA1 bab0193b0bf752e7e058d8fe39f79cc109b788b3
SHA512 78c0e5acf5e2a9cae7df27040e391394ab60e4dfef7b69232160cbce1ca1383a8e18bf730a95e2ef6e7a0c1562ac219ae9f503f22bf149c1ae40c10e37dd1c0a
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:uQRQyi36YOcPQLvw2gAf+PN3XWIURZz
TLSH
T193667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bbdeb452172f30f9779bc36e4f4ce09ee32111c726e6b6d0f068ae485f22ebdf
MD5 64b91c9e1e972843b064aa3ff8f9a4a2
SHA1 4ab5690b41df8a3f11b617ef101f572629f3af35
SHA512 284c27e644a3e43a08902248099aae488e70b532283120338ba879c1ab922e1699f2e17577008f47ee81871165b855b502a5309bd8b7c703e53e465572673f7d
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:7QRQyi36YOcPQLvw2gAf+PN3XWIURZz
TLSH
T1A5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fee21b880f2bb798eccad630aeb96cac15c03750add564212878a4f1e1d6e033
MD5 91f7e4b57944ede89d81d4169366f92a
SHA1 14ceba88dd675df1614fa20d2253ffd492ffb0b5
SHA512 05b24bec3cd21f9224f03b62ee2cdfedcdde41bc8c3f9816f8d79ba72134ec8156668bbe72afeea715d9f9ec806bb23bdf9285059263943445bb19e45f7e17e5
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0QVXXC8Ac2YV3swM:w68Qg55nhheWu7PNU3/NWh4sCdegmZz
TLSH
T147B54933B2F600A9C45DE1769F4A872196D17C758FE0E7DB8501720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0279f2206d912a1c5923a8758ceb46cc1f30ed036c922bc5423b6040dc20f875
MD5 675494003a7680f81579fb8a7bd988ff
SHA1 35260c965d45650e5b9b79b4ef9b34a018bdf243
SHA512 e3cb55e24c2e6a46cf623eedd1e68a4384b2d2f98697431556f6ae7cb61ba5ff73691c4570b6ca6fdfec319d252b3c08d0d7325dfbac3799cea9945e317af386
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99w:Fy5112gYy5azzVvL69nLKnhZqWIURZz
TLSH
T1FB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 476e99a83a385ac662d0eab61dc8b51dbe652ab46805776c7578bbe8566aa8a8
MD5 14bc6ba34203cd23e932ef8c179338f4
SHA1 e474521fad2ff9d230dc3da2c1e94855d6cdbf1c
SHA512 a9b000269c771ce26517b3cf95370a40288dddb64e65cd924c206c5dc3984e3fa9d187ae99084f802789bd5781429c0dcaa1024324e6cb1532dc83cc09893622
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl/Wh4sCdegmZz:iu6JmVxd2d/WIURZz
TLSH
T1FFD59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b53062e1bbe6586ae9b4f850a100bdec6216c398b15279ab3c9428476d88925c
MD5 66f31225c733cfd31656985eb019336c
SHA1 e5244dc209cb5fb2855b4aa580aaba105e6fa7d2
SHA512 ad7276a29cfbe10c1d9e8645e71b21f5686607474f03cd56da638ffb59339032031d2099dde2471d67b642b6456b60aa274fda1121e7c570ca946134a30c5c2e
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xbWh4sCdegmZz:QmifPbR0WIURZz
TLSH
T113B5BE13F2D900E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 187474200fcf75aa8a304876f52990501db3825f7e51bef4cf6eb911e78ca47e
MD5 a1e199cc38b9defd017e1c7127f667ae
SHA1 e14d220813143c4928dd9f87d0fa3689bea05d1a
SHA512 83e94cec8db1eef2475b8db68e0b329e11f9382ad459bb1625864c9189f385f9c23ac5d5113bd5b15fd01c09a54c25db54d5cf21cf9dca494812e38b8b3e300e
SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHquWh4sCdegmZz:95dKTi61uWIURZz
TLSH
T105C5BE03F2E940E8E0BED674CB659236EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eb8d326d9e6c39e20ba3952e97ee2b4e3ffc92f09fe3005901bd6074d679c5a3
MD5 9a696b45181640fb64d93b49b31b5fda
SHA1 f1b2e8935bdbcdea06fbf75d4c4efb30ff823f62
SHA512 6fe66412b8453d07248f182ef1f330bdb102e6728bc72ff2d36d9acd98efce5b9fc45db5f3173fa74ea8e068fca09226a9012b7efc79554ebba33c560b4f0180
SSDEEP 49152:AhtSn8EApI0figngiDn0AP5wPWh4sCdegmZz:RX2iyphQWIURZz
TLSH
T1A995BF13F2D900E8D06ED174C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f9b89f83688ba359d37438055dd9aa7a3137ca38b4bae1b7b0cdb7ed39e9455b
MD5 f4efb3de853f3f0f2e50056eca46cf74
SHA1 69b7b1c8544e826272f4a488dbca0909fb60f858
SHA512 d65f877fe26cd17cc787916252b39b37b73979d8c0f95ff5528a485b6d2484651d447a73f9f15144a674f1f8a4c3c570345d49517e5d6932d5bdcf3896dbd3e5
SSDEEP 12288:0EVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:0EVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1B8C423A5CD07846BF27F46B4CDE093DCE22C9F94A094CD6A92827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8267b5fa94a88cd47025a79e9bd22792b97b0a616d9d33c65ff9716917c27434
MD5 ec116d1589005e0b4c67235fdb36fc90
SHA1 741d0a45d6200f691106fc1c54dc6d0985469676
SHA512 85245d618b9b66b8136158d14c586796c84eec993e37a4a645f935b785b24bfc8760ff75b45009a527a758967c10a0edf606d52493fe52919b2beaa0f20671ff
SSDEEP 12288:/7VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:/7VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T16FC423A5CD078467F37F46B4CDE093DCE2289F54A094CD6AA2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 4cfb78a2722a63fed1875424b8d21605c23e8398c847aefba65e5022da7c7ee4
MD5 ab0972898aa587e71e4228b27110e07e
SHA1 5e6f748400c0ed7931a987584b85116edca373cb
SHA512 e725096eee0dafb34d0b298934f975af14e5f0475d561cf4276b7e5f5c207234e9ddb3921b7c83f2dc4ba54049d96800a0752a7f37a99dfc57d37ac90bb310a8
SSDEEP 12288:XZVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:XZVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T19FC423A5CD17846BF27F06B4CDE093DCE6289F94A084CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 9d36359a7d72edc8b6b68062d13eb4f5e487b799a33b5bc9a94198992c840b58
MD5 5c4db3274676d20e3fea643b12f2c0e4
SHA1 16678c90dc438448cfaad6f55dd468787d5db33c
SHA512 bfa7e3a732d6357e004972afbc986c1007255f47aaee7a57e1d2427fa9671084607389ddc3b362caad69e4877698e257200efaa33ab1ee04c3586e1f6bfc160a
SSDEEP 12288:QViVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:BVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1CCD423619E1A40E7F57B8674CDE0D3D8E378BF94A264CA6F93412E1A2C784987431B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c560b2dbffbe423242e6ad50e524bb9c347fc0c774da489f0f38c5b03eac7e88
MD5 892e4787c7b288a2f105c62f85cc1b8c
SHA1 ed03b85252bcd8e5fc9b2061d1eccdfc6d5b71f4
SHA512 e06a289525b4f71fb2c7839235ddc75ba4445d94ac60e6311b365a65ac5b424241b59e5a84dd4f10600d7bad702ecf2968ac45a6be697437308a6a4fe0e79205
SSDEEP 12288:TKVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:TKVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T163C423A5CD07846BF27F06B4CDE093DCE6289F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 3bce457c64df82f941789bc9814c991d681208625a6cf207eeb4db226f491db9
MD5 7a4840e8401883bfb477aab8afa4398a
SHA1 655fc6964218d6b05d1ef185772d279f34fcc755
SHA512 c61c54e1b2002c6d2d3e13a785482027293bc0e15e83f2b306d6e0edbf44059216879f92e819fdf11387edeff1cf2245def1bd879516d16142d7ca58d8b25cd4
SSDEEP 12288:IPVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:IPVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T11FC423A5CD078467F37F46B4CDE093DCE2289F54A094CD6A92827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 11fd65ab9690f5c018fc4306e7806e2c7c2463b319dfe7175a0041874964f8b0
MD5 9a196b1e31f17fd42788252f34775084
SHA1 91334ee53a624a8509ca691483b194a7adba5fe8
SHA512 0944dd9ae568c2bbcb583cd889aca335baeded3a66fc484a68ef1d1204edf118a3a4995ae13afe11f40921c17b3a988202505e36ab98fb9f4facc29bafad834d
SSDEEP 12288:ADVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:ADVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1BFC423A5CD07846BF37F46B4CEE0D3DCD2289F94A094CD6AE2826A1A787C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1f2ba9ac5cef724fa24053ec0433f8d89404ee903c3e2dfec241766cbb733120
MD5 bd654e03226bdb32881f6b0702f0f097
SHA1 45373d9178893b9903cabcf07dd67287f474a683
SHA512 fed27da8904a8af689cab7abf8eb8df2b5c07853c202e9eb28888aa7b1b981b9d9a0baf912732ff97df7908828c772c8053755c59b20d5d7121393917a6373cf
SSDEEP 24576:RZMSzFVSObVXXC8Ac2YV3swxhZPegenZPwC7:RZMSzfVWh4sCdegmZz
TLSH
T1AF0502A5B35018F9ED77823DCD658A45D2B2BC590760CA1F03E4362B5F372A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 3d35aac60333f4700854cc9af45b4c42abd9630371b008508bf114d4f3c2a390
MD5 cd076d8dbf3a4d625cc99901e32b7ced
SHA1 ef3bc0550d46937631cfa3213674c0bf9e9da142
SHA512 b30aeb90b440e55aa64a1ca47f23fa7163772e295c13b2556c413a896fca708556a9dd3370c0cfe7dc2d65041d39af7c91618b617b78b5e721121613da447765
SSDEEP 12288:cwVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:cwVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T116C423A5CD07846BF27E06B4CEE093DCD62C9F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 d99a85e750c6afbd4decf29eecde6d0ec82358a04ab4e68d678b2063342a8631
MD5 cde2fe597940ce65f502c83aa872e2a2
SHA1 cb52961d7362cd82a96dfd3d16a49370b1d18cba
SHA512 bac677e9a7779f00f14ea32703ca157a32fba6a7cfaf5037c27cd05aff23e3d1f41f8b28693bd3374bf5542e78e9fa43ecf0ab0ed5213ef47a608b357f9fd0a6
SSDEEP 12288:Z8VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:Z8VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1EEC423A5CD07846BF27F06B4CEE093DCD62C9F94A094C96AD2826B1A7C7C85D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 3deaf9cc7812a7c2e851bc65b34f3c5a4c4a925c9fefd49dd3253a09712520d3
MD5 a8ce27eba94313290985d4c883ca6585
SHA1 d5d610b33064460832fbfcfd6ef36a8ca42ed6ff
SHA512 43bced0b8b9cc93d8cf067da7954ba561fcafc21e09f01e7ed625c51f68bba34f18b0f80a9d5d1f1be3df30f2173fd805349b48947192ca64e69570fd9b26597
SSDEEP 12288:LyPz5L8nVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:mzynVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1C7F40257A76620F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 99bada60b7790ac13f1d5b1bc0aa315b16001aeb054f4a1e21a1932c6e9900b2
MD5 25aab050c35695cf42e5a85553152f5c
SHA1 f2d0223ffb3221207556b4a4531924942e810d17
SHA512 06cfa7d6f2c7f1796173940ddb1ae2478b6366e914653909a87017c6a2bc35be71deceb19377f189f90c9a2cbfd072e5c6a00c17486863f2e63344aa63081ef6
SSDEEP 12288:rwVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:rwVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T10DC423A5CD07846BF27E06B4CEE093DCD62C9F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 a09ca77a080ba482c16e3a53fffa7c106f92b852794a7261d90ff61363622dfb
MD5 f39332722510a341bb83d9d80b5d56e2
SHA1 1ae2f6d92e87dd80edae2a9776e11e8ac152b80c
SHA512 fc71003268660b06ffe7f636161cc4a9f8b9cab777025b2e87a1de5c571e9b6218fcab523086b732e59b13984950371e40135b460109589cb53aee727085892d
SSDEEP 12288:0wVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:0wVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T192C423A5CD07846BF27E06B4CEE093DCD62C9F94A094CD6AD2827A1A7C7C89D3432577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 77fd6d6758c8c4444e3b1a4c83bda0f5d5851663203f96b5d530bd2dae076cef
MD5 a4fc474271d94bb3614f9073bebf72a2
SHA1 680f415afb43e0fa00e8f14a9f4c0efc9775baee
SHA512 187d8cec1f009d21dd4e75f353af7e8d38d6b308c959fa131eb84b512234e7471aad81c0dd261bd3aa1375cffa189b834a90d953f2638bbad130b015c81c1c4a
SSDEEP 12288:YyPz5L8nVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:5zynVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T108F40257A76620F9E17B8238CCA15A45F375BC3147608EAF53A0073A2E3B5D46D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 a7e943ff94e41a1104e53ff8594a271804052906caa1321849f40abfca194eb3
MD5 2f4924c70c3dbb5e07722386e1353bcb
SHA1 cb30d0671ef2808c51b85e5458ab3a11f9da3f78
SHA512 39ff871512db006ee375a1e0c35e610ffe4c2eae4ffba20a084b6d3cedb23c29ed0e22b6828b262bef5d84359cde7bfba66db7fbdd62768f7686959a5de63f5d
SSDEEP 24576:/cP4mcvIjkGOxhKP2l71nNKbrh/8KB4VXXC8Ac2YV3swxhZPegenZPwC7:UP4m4IpOO67W8K4Wh4sCdegmZz
TLSH
T12E65AE2DABDC0096D0BB917885658A49FAB1782A1F3286CF1160933D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 e432fee127817b5ae1c923e65663c289709307822b19c93da3ddfc9111e0afa9
MD5 42f8b4e7dc3c4697c593df94cfe4e086
SHA1 7629c1d71ae3df9114fdc3b73192cde5b4a085c3
SHA512 ec9ab93e75d9f5b9283902ff86c3bc37301b08085be977b9afda279ead8c73cb2ce995e3acc6f4c0b80daaf4d7f367b2b664a0e8e1d2fd8b42f6cd03ea8d27ce
SSDEEP 12288:VNsfAVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:qAVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1B8E4F05AC25801E9D16E5278CB918684F3377D6493E0D7CB52C0FA3E1F3A5946CEAB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4a9f78376e2e2127edd4f4ffe4c4aa158196c6009917402be51937c0ba6b5ca8
MD5 d1d54a653a237234396078b89a918414
SHA1 435b3a64b1c1841bf9bafc488e80ab18398b140f
SHA512 4087fd834791c9d17e588ef845b53c1c2f05af67bf2567a5aa08655054e5e8d01d1a215618ecdfa02fa86ea64c1e084a31701cba19d5c558f46e85378f56eb2e
SSDEEP 12288:ggVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:ggVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T188D42362CE1A842BF27F1770CDE0D3A8A22DBF549554CD6BE1417B1A7C3C8996832637
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 778074661065259d82314379a6ada89d35c5e483438afb3a05821d6e417ba87f
MD5 68069814a2dd2cb10118d516226cf1f9
SHA1 bfd3389b5fe58bbfa7eefbab8474c65798aecc40
SHA512 235da868ac795ddba51003e4e92146211520c32bcae0042fa84f61d8ae8b95595003ee1e98d20689cb37145b75ce9be1400d171168b3b9c16be53ae9897a8935
SSDEEP 49152:aa0h2GEkuAe73q3pp46zwwQsWh4sCdegmZz:aa0hNYG4Jw1WIURZz
TLSH
T1C085AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 2b74ef7f012ff3cb8d7acec2d2040e02bc9f5cbdd1d8aff7d7afd7dea17f29fd
MD5 a607a827f9241657a751aa3b3a62720e
SHA1 1b79b33294e0e3432ea59ceca1a32056528ad6b5
SHA512 7fb6f769c47d4ffbc3ece76374dd073785242b93cd5c51f266dacd24c449467f764b6b738038c4c255194f3715cfa613e211aeea05ac589fc0dc52d96608a3da
SSDEEP 12288:GhbHjfXLVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:GhbHjPLVXXC8Ac2YV3swxhZPegenZPwg
TLSH
T103E4027E5A6D109AF276927C8991824AD330BD25171097EF63C1823E5F3BDE81C36F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ea15b9d7f7d426e8458b5b210385711f904d5f48d638301521d5486562eb5f90
MD5 000682e7a500bcb26b9c9d1a41419616
SHA1 68e4e49eb57a4c0279c348e0357454efd5d5fdae
SHA512 751239e0329e6f4d56434b6aaccdb491e83756a0899bdfa892d579f7342c749b023018492c7a5d6c9c173ed440314bd53c0b1b8e1eeeffde1a3352da370108a6
SSDEEP 24576:/3YgnJcRTk4yti+R5dBR/zVXXC8Ac2YV3swxhZPegenZPwC7:/IgnaTk46pBR/JWh4sCdegmZz
TLSH
T11F45B02DF2B910B9D8AAD236454143B5FB71782D1F209ACB0170C538AF1AEE85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 d5cb4f72d996391c7d31b47789ad5ad049c213efd062d51eca584ff270c441fd
MD5 f8848adc6af7690c9b7895626fa64fbd
SHA1 593fd6305f7b487df87ddff8492c88c576821c1e
SHA512 efcc0af4d2f9b4dad55341a6718c1a4bd3283e0e64f5babeaf714dfc29573c625081a2ebcc9bd57a2424acf2078ce333122211b260bd29d5f955fa279d8b029b
SSDEEP 12288:jsVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:jsVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1E5C423A5C90A846BF27F46B4CDE0D3DCA2289F5463548DEB91827B1A783C8DE3432573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 0487812ce8ed4c25c90ab8d6df22d8dd0132d015b751ec7d96efd78b99577d4a
MD5 b653ac46082b78887eb419517183c280
SHA1 56a104976b359e43f4448fd701acc970741ba01e
SHA512 714cc94835b274b26e8a42d0486435b16c4e44fc9d4a150daaefa46f509d3da2628e391552b24a0f8ef814688fff0ffbdf8637c1668b7f27a7be5a853d9cc4ec
SSDEEP 24576:upL3UT1VXXC8Ac2YV3swxhZPegenZPwC7:upL3U7Wh4sCdegmZz
TLSH
T151250155E79500F9E97B813CC9B28616E272B85C0364EBDF03A84F661E336E54E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 1dccb8d8624dd69ff1fcb4dbba774484a5b48db105de5c53368625d4a0547b31
MD5 c06f0ba51a5be6deeffd4f5b8452f714
SHA1 9a07598895067056835d6e214507eaa082e28b71
SHA512 ab5b709166878da56afb1ea29be1cce514473e360973c08a7b0612039332b022910cacaba0ac1234cdfce700450ffb3566dca7f2c575d44b15e8e96c71b3d69d
SSDEEP 12288:dpFtpOBVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:1OBVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1B1E40229369D10E5E17A923CCAD2834DD371BD65071097EF42D0827E1F7BEE86C36A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6b051dc4bd7025f3fa36010f5deaea98f000e58881b6dac997352758976017c2
MD5 4bbb99b8ab7cd932d11b80aca5d40e02
SHA1 a37970bda3c3a0de661470444024290f27958a0f
SHA512 381fc0f73eea2943ed6e13a88dbf20db2d418da1f407e5d191aaf0bb4b060f692f93b1089048d10c40d2fc3f8f7345436129cb09eb09a8c37422732c18b94617
SSDEEP 24576:37NM9YqZqmWMUkPjZM48Mv6bEhswVXXC8Ac2YV3swxhZPegenZPwC7:37cBWMpPjN8DbEhxWh4sCdegmZz
TLSH
T13D659E2E6BAC81E5D577D13DC9E28245F2B1B8611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2ab8558e2cc72f9a1c4ec1fa9daa7f1de5c7c7ec2611d9d5c65e6b5f4f08b967
MD5 098e290f181547ae741b43e54f673320
SHA1 49bdab9ca4107ab4450065cf9cf9ef138423f2a5
SHA512 c3bf90095572c656a9140b75f3da3feb9ca060ce0a5ad195efd0cbd716d8d7488b97ed5d626d5dbd0cb25089b9aa749aa1f3abc8afb33267e60fd218f52a07ed
SSDEEP 24576:6W6BApg2YuyuNDYTabvcdvNYf8km1uVXXC8Ac2YV3swxhZPegenZPwC7:6F2YuHNETovAvNYf8kmeWh4sCdegmZz
TLSH
T1EC858E2927ED80A4E0BBD27D45B6D286FAB2B8511B3055CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e386f5bf36f8a89dad44b30ed23b07f829bdce31e8f61cfb180d272c1d8c1d79
MD5 ed1147521d99f5e9cfebd47079baa7c6
SHA1 3aa2de351750588470d7ebdba08de9b6a5d7494b
SHA512 8fc5e56bb96d92e015c0b8f57104e3037027157aecbaf96317fb97ad8a1d8fb73eecd6963f7c675a8fbde25e580824f91da59ffd023e0f6767a2707792b7c567
SSDEEP 24576:vAFs06+Omlf3NXEbTotVXXC8Ac2YV3swxhZPegenZPwC7:4Fs060lVXuMWh4sCdegmZz
TLSH
T15065AF3F66AC00D5D07ED17D8997C91AF6B1786307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 dca746454997d696b3489f716e8f898807512b82c51901ad838b8b0a407454c5
MD5 5ef5b8e594addd112c4e43cccb6ad0e6
SHA1 380917316a1fdd0c54fab59bd1f8ef4bd60c8ef4
SHA512 4246dc09f7aaa38a24757ae962ac57e91a569e7e1bf5ce88c2cc1fe8539d63113ac36494e9a798b66d807d90241951a3ffdf176dbf218d79180d19f2b39530c3
SSDEEP 24576:KJnJ5D3WXqVXXC8Ac2YV3swxhZPegenZPwC7:KJnJ5DGXMWh4sCdegmZz
TLSH
T10215D02DD2A810F8E4B7C274819A1795FF72383D2B2169CB24B4D5353F26EE0A939F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 515f15412c1697d2df6bd359d6ff05b26428081839c7602716861b6d8f53e1bd
MD5 d368550874f790e22ac1911b10fd7559
SHA1 2fea3e9afb14162efae5659a67aa3467b14b4330
SHA512 04397f8cc46b2cb9d1ff126d752b2430e03b39f5985ae8dd8e3212e09dcbeaff35e129425dd17a80711653c9017916b71e4b71ceb9e45a1d6baf35b7ee866e33
SSDEEP 49152:Wg06DIKdwc+eQnSt65aVyWh4sCdegmZz:vgWIURZz
TLSH
T13E956C16BBEA5294E8B3CAF1C962A1159B327C509B34F7DF0AC0C92E1D33AD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 64139e761a6e84d457dd78d59f82e41450992bd08d000d1dd8985297b2294ef6
MD5 4d5a5988cb0e40d836bc48de59bc93ee
SHA1 376aecbcc91e744a76567765187f66d5497c4995
SHA512 f57638605f9b24ad1c315daa6e89e479f636988828fdc57182783b66ff487713bc8543951b2fbc77def633573781300be584dc9b8477b39ae6d2358aefcb8786
SSDEEP 12288:zEP3RnmVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:4nmVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T173E4126D6B5D60EAE13A917CC9D08288D371F96027515BFF52D1C23E4E3B8E92C39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 bc4e46359d2aaba502f7c1a4d9ee7fd8c69d8d2a870162d76891a38d0881cc7f
MD5 39c0b7647e3c55e8ef3fc68f220d4793
SHA1 83c6e0d20c93ac6d226338ed4338710ede29d98e
SHA512 0e6aac7f121b9b639bb74f1dda41d9d0280e4ab8761ce7ade45720abe4ff1223aaea882428510d575f8b2710fb51915a4956b36b4aee66df70b6e26443d3e861
SSDEEP 12288:1jky7VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:1Iy7VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T1B3F4125597589095F6BA0678CDB282D4DB34BD205B1086EF91C0FB3F6E3AAD47831B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 8dae1a8e43f4aae952f5ec1589c9ff1b9f111d1604cbb3bd54ef756a063e9634
MD5 dd84165795fec3b675b5610635dc6d88
SHA1 b30c5aa7e274dd617a09bfc16704fc924fcd8e88
SHA512 b7c0ed81ab77107113e7b4b1d100a6a0ffba11c2c65686de0188339b0283cd0584339c71c864c3f70cfd6a0d33f0abe992d8f8d36af6dcf64d6d1819efa4d4ae
SSDEEP 12288:LyxVXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:2xVXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T158D423698916946BF63B06B4C9E097D8D234BF6453549DFF91C1BB3AAD3C8C93032923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b5163b4d35722912c49eb302cb96b9bbf54e9cb9e0bad091449bff9d448d88d5
MD5 a090f3d933dc9629b0f1fdea559062db
SHA1 934637e64eaac1a3c181d22f0357f80e22cb6103
SHA512 6129b8a4bfd7133f4e9bb60cc85fce487c0b71af852b693df400a6e128ea48ad7f194cc84eafb64ca84fffb18c7252f9d2b48ff75511756c89eae8ae4ab0f383
SSDEEP 24576:/Q9MxZKdcz9dw3IVXXC8Ac2YV3swxhZPegenZPwC7:/VKZmWh4sCdegmZz
TLSH
T195558C2DABE9059AE177D279D5A250C3A633B4301B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 9fa7936980243774923a21b0a3f3615d171e5c6f105563cd17b1465924cefb37
MD5 3aadf9170d95a8b34511b680fea18fbf
SHA1 245e8dfb70ac3c57a58a1c5f48b05df9cb4f5e88
SHA512 5b6ceedb3ca51b57e0abab5ec1b18c935fe2a6b8c72acc8032576651485ab47c2205e68b829a83f1397126d37339461cd0d279cab8b0abe3f43addf07f94ee8d
SSDEEP 24576:LyocDAp3VXXC8Ac2YV3swxhZPegenZPwC7:+ocDApdWh4sCdegmZz
TLSH
T1EDF4E01FBB6A40A2E176823C89818385E773B4305B6157DB6291C73E4E379EDBC35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0f913fd789238b78cf1ff38ec43059574c0f5b725394f11641115f0a14594de8
MD5 2633203ae9b3001eb18995eb0b9344f1
SHA1 8773e56be53232dacc7108d2d6c6e3ba6fda1891
SHA512 f804e48440827201050cdd13c4d90c3a9e7748a41e817161e941522d67145bf035269423731bc39b0854417ff25042f338657cf2a1b5f45243a5f437e1adfd19
SSDEEP 49152:vWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKdWh4sCdegmZz:X0zuNIPWIURZz
TLSH
T1C3A57C3DA2BC00A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 54354546cbb0c8218ca9cbdfcae74b30847ece49d4271e10d562683af99aae4b
MD5 17b705a0711062ccec9ea6d1c98f7005
SHA1 3fc5d7c6e815fb13bb8af3436567446dacaf26c2
SHA512 224a070f6e160bed8f113f0153a091e8d4e3ed3dd828ce1da0a81cfac46e5a84b376f26929a316654cd5af3662b738bcc13d8bb913785eea604f56cd94b7963b
SSDEEP 24576:I1QT7EcpfxR+N5AWAz3ooiYtjMqbmVXXC8Ac2YV3swxhZPegenZPwC7:1TDxR+N5YzTfjM7Wh4sCdegmZz
TLSH
T18555B02EA7F915E9D17E85788A23C512FB727821033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 ea377998b8621a74a35240b97a124c8f72beec1dfa6144dd36deab0a34e44633
MD5 bc08d437cbc943311143072ff3da95df
SHA1 663c0eaff564147c9cc4becf25d7715685e25a52
SHA512 7ea637ce6cdbc990bdccf5e3f25bf131224c4706f78529879841e80cd41855f99614f3df59c874fd2035fe316e1a95e4ae211ea193f672a2f18ed1e353baef4c
SSDEEP 24576:fTMdOz0FFS+imSLiVXXC8Ac2YV3swxhZPegenZPwC7:90K+imSL0Wh4sCdegmZz
TLSH
T1A015F17EA75D14E5E57BC27CDA43C906E67238610321AADB06D0C1793F6BEE4393AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 8b242b868aade2297a247658bbf5c4605afc31387e8ed567a20c47bb902b9ab1
MD5 1d2a4d73ede3c0937dd8e2b1b51edbcf
SHA1 b9bc197b79281a382f81197366913e11ced84200
SHA512 5939a2bf5662ee4db4ffad562a18acd00fb9ac0d10421c79deb1f63e3be38e4b710182d1248ffef623b9005fa896fa6aaaa00c6f98d600e9ec13cea7d462e6aa
SSDEEP 12288:u4K1VXXDGQFl5//qc2/3AeM3wNynFxhZPegeBmETz2yYEPwr417:c1VXXC8Ac2YV3swxhZPegenZPwC7
TLSH
T151D4125D57D920E5F17B5274CAB18399D230BD6423249AFF21D0DA3E5F3A8D8A831B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1116-275-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1116-95-0x0000000000760000-0x00000000007C6000-memory.dmp

Download

memory/1116-100-0x0000000000760000-0x00000000007C6000-memory.dmp

Download

memory/1128-367-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-392-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-387-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-388-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-389-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-390-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-391-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-393-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-394-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-379-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-380-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-381-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-382-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-370-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-369-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-368-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-384-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-366-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-365-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-364-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-363-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-362-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-361-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-360-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-359-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-358-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-357-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-356-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-355-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-371-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-372-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-373-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-376-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-375-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-374-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-377-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-378-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-383-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-386-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1128-385-0x000001F648F40000-0x000001F648F50000-memory.dmp

Download

memory/1280-405-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1280-286-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1556-274-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1556-88-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1556-82-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1648-347-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1648-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1696-278-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1720-67-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1720-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1828-288-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1952-135-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2264-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2264-17-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2264-16-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2264-353-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2412-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2412-404-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2412-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2412-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3012-1-0x0000000001F40000-0x0000000001FA0000-memory.dmp

Download

memory/3012-0-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/3012-332-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/3012-7-0x0000000001F40000-0x0000000001FA0000-memory.dmp

Download

memory/3088-60-0x0000000001850000-0x00000000018B0000-memory.dmp

Download

memory/3088-66-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3088-64-0x0000000001850000-0x00000000018B0000-memory.dmp

Download

memory/3088-54-0x0000000001850000-0x00000000018B0000-memory.dmp

Download

memory/3152-276-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3336-289-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3336-72-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3336-78-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3580-281-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3836-277-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3836-354-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3888-279-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3888-111-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3888-117-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3904-285-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3988-280-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3988-122-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3988-128-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4300-287-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4300-154-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4300-188-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4300-170-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4300-351-0x000000000CD00000-0x000000000CD08000-memory.dmp

Download

memory/4300-406-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4752-284-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4904-283-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4924-38-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4924-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4924-403-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4924-32-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download