0a42dc91f7dd2916f5ef752cb31cd521ba9efaa16abe3fc7928c36afeb68df2f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 5.2MB
Sample261024-b6fbvaea47
SHA256 0a42dc91f7dd2916f5ef752cb31cd521ba9efaa16abe3fc7928c36afeb68df2f
MD5 a68e191aefba724ef58e2ccece42d5cd
SHA1 7685646415891284c60aa52103271007a1354ddf
SHA512 b71385b10816cc7011d7534ee49616a47756c01487f30d50e280776aaf81bc604684aed2a72fa8a2e79eeb5c6d0ce3a5ae8a6054bb36222dc0a5a24ebe1feed8
SSDEEP 49152:8alGdsSX7DxKVf81VvjoBeedMseAS6NJ3LvcwBpk1ltACqTMCVi7+tgauhwbR3PB:zgW3NjK72i+gaPJ4JTy
TLSH
T1D8468B07E7B941F4D0BAD1398A979617FAB27819973197CB4290464A1F73BF09E3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Executes dropped EXE 22 IoCs

pid	Process
4880	elevation_service.exe
4936	elevation_service.exe
2564	maintenanceservice.exe
3900	msdtc.exe
3132	OSE.EXE
2820	PerceptionSimulationService.exe
3768	perfhost.exe
516	locator.exe
3796	SensorDataService.exe
3960	snmptrap.exe
3056	spectrum.exe
1680	ssh-agent.exe
3740	TieringEngineService.exe
3668	AgentService.exe
4572	vds.exe
4876	vssvc.exe
4224	wbengine.exe
4548	WmiApSrv.exe
1604	SearchIndexer.exe
2556	alg.exe
4392	DiagnosticsHub.StandardCollector.Service.exe
4664	fxssvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5a96d9645ef7726b.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4652-8-0x0000000140000000-0x0000000140E46000-memory.dmp	upx
behavioral1/memory/4652-68-0x0000000140000000-0x0000000140E46000-memory.dmp	upx
behavioral1/memory/4652-139-0x0000000140000000-0x0000000140E46000-memory.dmp	upx
behavioral1/files/0x0001000000017425-112.dat	upx
behavioral1/files/0x0001000000017bc8-111.dat	upx
behavioral1/files/0x000100000001703f-110.dat	upx
behavioral1/files/0x0001000000016ff1-109.dat	upx
behavioral1/files/0x0001000000016ff1-512.dat	upx
behavioral1/memory/2556-513-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/files/0x000100000001703f-527.dat	upx
behavioral1/files/0x0001000000017bc8-529.dat	upx
behavioral1/memory/4392-545-0x0000000140000000-0x0000000140166000-memory.dmp	upx
behavioral1/files/0x0001000000017425-550.dat	upx
behavioral1/memory/4664-552-0x0000000140000000-0x00000001401F2000-memory.dmp	upx
behavioral1/files/0x000100000000c530-565.dat	upx
behavioral1/files/0x00010000000233bc-564.dat	upx
behavioral1/memory/4664-594-0x0000000140000000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2556-595-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-10-24.0145.4652.1.aodl	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe
File opened (read-only)	\??\PhysicalDrive0	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a0f755a5963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000480db35a5963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026ff235a5963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffaa915a5963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000289b405a5963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4880	elevation_service.exe
4880	elevation_service.exe
4880	elevation_service.exe
4880	elevation_service.exe
4880	elevation_service.exe
4880	elevation_service.exe
4880	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4652	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	4880	elevation_service.exe
Token: SeRestorePrivilege	3740	TieringEngineService.exe
Token: SeManageVolumePrivilege	3740	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3668	AgentService.exe
Token: SeBackupPrivilege	4876	vssvc.exe
Token: SeRestorePrivilege	4876	vssvc.exe
Token: SeAuditPrivilege	4876	vssvc.exe
Token: SeBackupPrivilege	4224	wbengine.exe
Token: SeRestorePrivilege	4224	wbengine.exe
Token: SeSecurityPrivilege	4224	wbengine.exe
Token: 33	1604	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1604	SearchIndexer.exe
Token: SeDebugPrivilege	4880	elevation_service.exe
Token: SeAuditPrivilege	4664	fxssvc.exe
Token: SeDebugPrivilege	4936	elevation_service.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2076	4652	2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 1604 wrote to memory of 1820	1604	SearchIndexer.exe	112
PID 1604 wrote to memory of 4668	1604	SearchIndexer.exe	113
PID 1604 wrote to memory of 3052	1604	SearchIndexer.exe	123
PID 1604 wrote to memory of 2516	1604	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a68e191aefba724ef58e2ccece42d5cd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4652" "1348" "1196" "1352" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:2076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2564

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3132

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3768

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:516

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3796

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3960

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3056

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4636

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4548

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1820
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4668
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3052
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:2516

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2556

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4064

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e9be5a044920730615d06a6b21a29cb58821e7ea81fa2554c176911ec5738c98
MD5 5872f0df13346e28cf4ed5ec18e7963b
SHA1 dc8bd1ed5aa76d337d560acf4c2acbc541fb351f
SHA512 f30a225745892447c87b94e1bf331d8a97db176729f890d9806688044834f945a36af7c5299b5a0b816217bac18fad01647927219e2365c60ba3190c5a9de62b
SSDEEP 49152:4b+632BuPkFKRrdE6ohdstBhuXjfS4LWxn9+tgauhwbR3P8wT8:S3q6mjBVgaPJ
TLSH
T1D3D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 9f0a89bf5969b2bebd51241945a70e130754eacaf006b462c9d98c0824c3fe2d
MD5 f393c293e28db8cd93b15132c55d875c
SHA1 f3b401e591dc4ca50fb343300935018bdddbe3f9
SHA512 918fc023fdbdc1e6c4c7ffb1e71301c1d10b2b107d017cd498b656ad86c5e7bbc32fa58cf85b31ceb0629ee048571635f2d8630f6707df08495afbd0457bf231
SSDEEP 24576:YXYsptczA2+4ZAgayjhwbmY3MaReFeDvSP3bDaKngL2jdshRTdG1YxITqvfPkbIp:Qtcr+tgauhwbR3P8wT8DarSj8RoTCCW
TLSH
T1FFC51229A7C409F8DC6B4338CDA28901EA737C854755E78F43E4AA694E737D84E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 4d9cb27172635f2ffff11423c029d213b7e7132c6b8e4f3452a5d3805e0fc750
MD5 96a26cdbd505cd5354a0fec58ea1a06e
SHA1 8abe074412c8c0ba8479b7204142c82334c90bd5
SHA512 788efaabed74111a5fb349e404ca3c02939c5875559b03a68a7821748125909a7c75b24c17e25a7657e7eef8b84057832dcab35b7f4cc51f95bd2b4da04a71a9
SSDEEP 24576:+XYfDtczA2+4ZAgayjhwbmY3MaReFeDvSP3b:dtcr+tgauhwbR3P8wT8
TLSH
T15985F128B3D408F9DD67823CC9A28511E673BC9547A0E78B03E4AA654F737D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 03b0ed18da0ccd9e70a06bcbad1bfad18f2e5c77758e2bf59ea90f20fead41cf
MD5 3008d852cd19736fcd2415c0b34282f8
SHA1 099e3e7cc7bd47661b96a1e62646c4a68ee189ff
SHA512 8eeeeb499d7172c674cec5ff05b750ffcb25564a99079ac964b9488da72c0d7bfdbc54a2bf6af677b9e6b1411aa1ca29cf00fc2fe11047da93f429ce7e77f510
SSDEEP 24576:G0Le5ji0hmxhrM++4ZAgayjhwbmY3MaReFeDvSP3b:GPji0Az/+tgauhwbR3P8wT8
TLSH
T1B895AE16F6788335D073C0B9C5D2A69AED7134821B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 024e09bc4534e0da479d7b37f3caf06984023d111ef71dbf762bc4e89f046f43
MD5 90300bada6e06f5b2ac5c51f3bfaba73
SHA1 2826d23129992c9a13ef779cbffe49a394b0b5ad
SHA512 01bc44237a0c6d7ad263cd906339742905fd15857fe3cc3302522ae2133f8b63ecaeddcd14c3c49d9f41c3f847cd1080a2ec1f67863f40bd4e3f5cf0c63b1012
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWj6q8wyu8+4ZAgayjhwbmY3MaReFeDvSP3b:D/ezSC6vUzPv+Hjyb+tgauhwbR3P8wT8
TLSH
T1AD756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1a452fef45bf8960bda846fba9ef857a011d85995af09e34ddc542a31107ebd8
MD5 b86dc51afc4be521f86e73928055fd78
SHA1 87f860b1b2ac9e074217a5cf7e1b160a4a4f9b67
SHA512 e893e10420466d1d5ce996ac0f8e2d4bbc0c41b82bc738183f13e6d6001d70e8ec04d62f55e0376ba34db6393c9f36aac16ec8793b74aaa9b12073b94461eaf7
SSDEEP 24576:GVbqPb88hv/l+Bp+4ZAgayjhwbmY3MaReFeDvSP3b:GVO88hXl+f+tgauhwbR3P8wT8
TLSH
T1D7559E66F5748331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E77BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 e4ef59f8f02548ea3ee2d1a0ee05e9fc5d5b0a8272617498542988d967f76216
MD5 c66da77e02396906fdabdcc0c8e789fd
SHA1 1a5a455e198b51d4f3d51cb4ee7edbc5551319ee
SHA512 7f9fde2c48e63e50fb965354f9f97f917a615160c4c681ec24c4ac1b2c9d8c2f8aecb071e2fc6bf345e4a4230739123be3edb437f5f9b1664a76276683812f2e
SSDEEP 12288:/GreH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:/Gi+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T18E652381D34C94CACB7B0B348B7A0D706699AFC51E85A504E9C97BC9CCF0DADC6B2395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 c902d381d46fa90ad7d26811fb11593512681bc6465d63563a3c2a05ed841cf3
MD5 50c4ca236e55c6867ed71eccc8a544de
SHA1 d25bcd7eab0a806ba37e1103d46c04dabf791f71
SHA512 9a9d47e591d381df8d83f025fe981ff7095a43fc02f92ddf737178c1a12d5148a0ce8758d3c5439984bbf22c780f4fbc5b14ccb0e599b47808ff52ac09218228
SSDEEP 12288:IeBNUbTVO86UweH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bw:IJIUB+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T12C85CF3BEE28FCD2C27E4DB85B918600A76278704F52A3CBD165830EDE235E54E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fd72a0461264f37f8dc432e8f5cf080db52172fc5fbd66f2a0aa0c9c287d5065
MD5 c9997c82bf6179c573f9577085e88a8e
SHA1 40de8b7d010e1f0153fab67940111a7444e2984a
SHA512 b10dc8f6908ddb8d0409983f9cd0b56c82dce9a150b0b8483e8c29b7a850bb6a870104e20208975956a9eb80691d8d54311aa7772a55d3ce28133e20e013bc6f
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THj:UQvGAdlCEL8c/WRNw5CfgaPJ
TLSH
T157266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 d6012852d267f6a16aaa4918d8ce54f5359c7816c5308e6650936e5be972ec36
MD5 7a5e08685cd0ecf5ab91bfacc717a2c5
SHA1 78ab608c9d49341a1c392667607ecf5aab485123
SHA512 871fb491cdecdc11fb5f4b0467c31ac9e7637e5ca96c27bd3f99dc9c16a5da86d098c0a42bb2d800485c9d30b7be395d636b8925b6ccc853597af7e7cd8a20bc
SSDEEP 24576:VfewsAjP+4ZAgayjhwbmY3MaReFeDvSP3b:pljP+tgauhwbR3P8wT8
TLSH
T17A85E031FA74E436C27B0DB21B36C712146DBE604F911AC3E3E89E9D99706D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0b52d00e944ffcdb4b58bcd8a2ec218a68e463a10fb46afe638011a626c65357
MD5 9af1eac3544876e132474d0e64668027
SHA1 847836ce7e076cbc37930d92b28e7bb6a742f12d
SHA512 cf9d25b14f6740f1e93f87c60ce94da489a4f1f14e31049cc3767abc611b9a2c8aa2e56fbb6e5c921193e2baa056922415dca0ac6bf8df6906a8d744316a9129
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHZax:1UEtQevvqc2W1cpV20I32S
TLSH
T16E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 98b905546552e14f65d95610181f664f440309f02d5bbe2cb1d67bff686c00aa
MD5 2452d2229ad80898248aa8eeb3c3889a
SHA1 684a8b3a5aad69f589f231315b7a58ccb365affe
SHA512 ee4c8955ff007795cafd5973594f59ec63ea638f004e24fc827a253fc32e8764762a8eda1965a997e0532735f2ed66e924383abf0b7f1613aa87d2c27c71f57c
SSDEEP 49152:/CbRquA/m2yL5zQfFiV+XenmE3/zv+tgauhwbR3P8wT8:YoqtVjnmLgaPJ
TLSH
T16AD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 569b7ca58d5e43189a4ceaed802cfdc0aacda54c5ee1761bdfc0a904d160881e
MD5 e2ad382504a8a87bde35eecea72a25a5
SHA1 17395f0156eafa3815bb11ba4a5d534b36bb43d9
SHA512 2b79c334cea9627a1c2158fd1d894ed989c773f87d236a7cc1c686917d8d4c30370dc4c11af04920a17cee0f3ca34edc7ebd3844af5deed4fc6e0957c4aa40e4
SSDEEP 24576:QAhGL6IFoiwtA5l7S53I+4ZAgayjhwbmY3MaReFeDvSP3b:QAM5Foiq54+tgauhwbR3P8wT8
TLSH
T1EA359D80E7F955D4F5B3AA7899B68570EA76BCAA5E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 10f98893411e1084ab831416cd1a6a260b4b60348d6d98bba23f2ab73ac9101a
MD5 8d83bfb96b198e0cee6fd2c54485b0a1
SHA1 aeaf37d849f99fb5ec100430946ae352e9d3037a
SHA512 03f78ed91c7b8c82c45fdd1ae66cd93f6f988d2a5f12563ba022892d6532e335cca596a15fab37532ff89f0e16d17b26ce7bd786ff54602145fb4e36d533163f
SSDEEP 24576:BwuROWc+4ZAgayjhwbmY3MaReFeDvSP3b:BwSOT+tgauhwbR3P8wT8
TLSH
T14685F14673A80CF9E9674238C6978532F7F2BC022A21DB1F57A0C75B5F73661AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 01cb37c35038cc18c0821036eb30df5a75d72ec3642f3ddbd50fe96f19f56392
MD5 578117fea042f338ca6fee50639c27dd
SHA1 8a7539e1fcc28330479f1a23004fbdfd91af3321
SHA512 af031769e003513daf69f6cd8a4d105192ae510cb4713e8f9705bd6a9dfc9d04e1e6b218dc62ea107b3afeaace97b4426a865fbb39fc72f9906eadcb735b1e4d
SSDEEP 12288:5yZ1IyKeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:wZuW+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1A1751285339860F9D1A70338CEF60A10E7B27C922B7243CF9595679A5FB2ED54E35321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c56180da12199d79ef6c93740f752829c4f74a4d40478aae4a4c991aea22d40b
MD5 ab48ac721fcea0c7777c349631ef437f
SHA1 fa5dcdc534d8848eea5d2d4cd7b06994ac8efe25
SHA512 4b66b96a4e07c44bfc16d06d3311151bdaa5f2517bb8af356e930419b76971502f964e8147662f91c1220d06e0f7b5082615cc3e21fa646363748dc54d69f311
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UX:EQRQyi36YOcPDLvw2gAf+PN3wgaPJ
TLSH
T17A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8cf0ef53dbbf33765e98e3e38e57e8168b0bb3adf7acf81da6a1ab99c5dd4de4
MD5 ec10a37bdafd2cc7d16ccf9490d7832b
SHA1 235caf5623a61677f7b45231867c970141923481
SHA512 419131eecd311e335bb4661daed80aa38df6c3e55c3d2b70688a385d1b9f36667e5ca66022a325c45b7b6f1985f6cc8bfce0365a0f7fcad7cd9c82ec7df4fcd7
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UX:9QRQyi36YOcPDLvw2gAf+PN3wgaPJ
TLSH
T13A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 475e004f4a440f46accf30a1bd9cf0c90cab234a53ae4f66f71ccd5f2d6e6734
MD5 e02716c8c6579426cd4655e4fa550101
SHA1 49b2340f3ce10e886e7f483c287abb57d1c7fba7
SHA512 cc8e2bb7e7aa4e0a2ef286fe8257d45c2db11e2ab0c2d1663c5ab795642265cccba5477d2ad8f6a54f092b4bb7d5c9930a8839fdbd9972182608b64306e94df0
SSDEEP 49152:v68Qg55nhkeWu7PNU3//+tgauhwbR3P8wT8:pthTRc/igaPJ
TLSH
T162B54933B2F60099C44DE1769F4A873196D27C758FE0E3DB8545720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8cf1c041d04696232d7116ac8fd5345fe88975d4725269916fc97cd41ecb2d6f
MD5 cbd64b79b45f15ab94ceeafe6998b0e3
SHA1 439a970b93c8a9e94380e3537f2b3a152a8527ae
SHA512 863502d20a77c79bcf38564ee8638e36e806db1171aa352b41110b7058198f1ac87a3c0332430b5ed1297d88108f1ea6e9146da0cf182e72869f389d1b6f2fa9
SSDEEP 49152:U3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99h:By5112gYy5azzVvU69nLKnhZlgaPJ
TLSH
T1DA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 254027f4673a49672858ddae0732b71e92ff29b2bc77aa7fb5ced53393574b74
MD5 909092da4349e1456bf4bb3cf802222b
SHA1 1c1d3705c941e3d18ff0fcadc28b296c9013e5d6
SHA512 4ed59e28f9e8e54172ea6f95c05dbdb1d64158263f36521859f9c75b8d15875ee652c53c08c63aaf7cb5718e531930208436764f9c62ee0b1b9b3139a5a02d1b
SSDEEP 49152:0B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glG+tgauhwbR3P8wT8:uu6JmIxd2dJgaPJ
TLSH
T122D59D13F1DA01E8D06ED578874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2b73b41cb483f438561bb483f040fb9ed6b93c41c24e6bb51fffc1bf58a6846f
MD5 2cc3931ae58bf499b90d623c1f4b30cd
SHA1 9fa076bfe16158c83aca7f106fc82cb64cc8a19a
SHA512 041af6c91eb9de703a4b62674a51f9fe8ce23b947c0e4d68c439e5705bfe90427509d5bbf2db77bdee857b11ba16fd724f4d81609c223d8301e7103491594b7b
SSDEEP 49152:f1hpsNoJpF1A67U44CwH7R4xh+tgauhwbR3P8wT8:fmifPqRLgaPJ
TLSH
T137B5BE13F2D800E8D06ED17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d833550204341578959e8ddd23510add5adb94995958ea7af270d204de5f8d3a
MD5 d38dd89b8dc3250c5d2b0692ebdc68b2
SHA1 6aa0af321e5603995cd14d48a1398c5fbc7e5d50
SHA512 7e577a272dd061a3862f9d93deae38c5b24afaaed04a568e6c74bab23b087c177ae9b0978df6d3f36744487e51633a8b227ee5d6375d825c3f71a5c1b080caa9
SSDEEP 49152:PSuZQIY0Be2KkRVtOnks6NMHqW+tgauhwbR3P8wT8:15dKqi61ZgaPJ
TLSH
T19FC5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 492b2d607735c80ca1a134f51b150527b6975bed64fc24eaec09c250692c71c7
MD5 d825888e2d57f7b546ea793d888c7aa2
SHA1 7350d832248b9b08155986a9529e29131f47ce4a
SHA512 574421ead17647e91bfc0bc300110f19d892ee5d8af97cc93410a1b70d082b0198f3d5eebfedd676484cf9c43c909000a8c13b6c3f5f0dd324abb0a94b0a34d6
SSDEEP 49152:ehtSn8EApI0figjgiDn0AP5wF+tgauhwbR3P8wT8:/X2iWph3gaPJ
TLSH
T12495BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2afee2f846ebd3be00e7ef36760d2a49ba446e493fe8f2bf03e46dfa2a3ac29c
MD5 65a14f8bdfbaaf0c654a233a8e7d8540
SHA1 1b57a7716a9ca9a2795e88a2cc098292e0ab932b
SHA512 ff13fe018dbd2e829e4dd755699268bae68df55f1cfe4a29272a512fe66c698385c31638c66ec8fac654109df1c913a8685f082733e0bf8ead01589357b8bb38
SSDEEP 12288:QjeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMTj:Qa+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1A7652380D24C88CEC52B0775CB6A0A60A699AFC77E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 177bf22cb277f4f36b7309dac0cead1ed2fcd6e6ba007e2c33ea712d4f28415b
MD5 1a33556c99361161df30182ca2847605
SHA1 a6e413904f8ec26501fa3ed6d1d442779b965f1f
SHA512 6c81516bf0566b9f391578efc4e2c90f1b3939189b9e7a57e777e97b76f8ca60b288d337b46460a57383c57abc59afebb0d43ebfcc7260058eb67baee726bcf9
SSDEEP 12288:B+eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMTj:BD+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1B9652380E25C88CEC52B07758B6A0960A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 098b99638f9d80c4e6753d18e0e8b50c4cadb7e34158ff0f4bd38c17a43c8d6b
MD5 c653f3d8d76910bb25d80cf593a7544d
SHA1 3c42a3ae3ff6f0d9e49e315da30881aa0aea3d3c
SHA512 f35f5877e8a614d599d74067700730e0f3da0a61bdf4c17720dab675db4405fef867fbcb2c43fee3e4d00c7f51f8355b561ba276a8063f637ce64434ce0741aa
SSDEEP 12288:UoeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMTj:UZ+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T18A652380D24C88CEC56B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveUpdaterService-2026-10-24.0145.4652.1.aodl

Path C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-10-24.0145.4652.1.aodl
Size 10KB
SHA256 bdc803de97dae6ec26c60e2a03accffc7d102dd6e4f64afb0ea7bb3a9c77381a
MD5 3558faa8c60da506ac607b668f6c71f5
SHA1 40cb6b304310220fa926efb4b35356e2be96b64a
SHA512 e60ce7926fe6762c331d7b62024baf93e24c7cf1f3fed6797244c81a1386a23933cd11bbf44f62e13edd6d737ddba051ae7250e1196886b1079d2448b25829f7
SSDEEP 192:uniWH/KM8y7ytx5om8MPM+sAyVFYPano8gZgx41jp17H2InvSPv35rn:ubey7yBPk2LFv0
TLSH
T11E32DFE2DC918934DF6710355470CE4E2AF0C9EEE0DAB52B22C6B85F249753967BE306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-10-24_014517_4652-956.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-10-24_014517_4652-956.log
Size 1KB
SHA256 1bd9d7a1081133f1d523be40494b9b4253816e8286df7a477cb4e73056a23377
MD5 9d8a03f57ea55ab6f93d425a873a2e5b
SHA1 b062e9a39b982be151e86c8bcb2250f84d683de5
SHA512 32e580af013a7695e23a03b54449f165422f5a827e955eb5b0f10cec7a4085ee883829aed6fe5be6bfafba434b7a4286a0d5375874589c0f1293072870f8a434
TLSH
T1F92184296BE40A06FFF7DAC298F715539E3539912834D91D00A1424E4975F44EEF472B
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 49528e8e2a9807d7a941e387d597a59b0b0489d0355e925f575ea1442d97e4a3
MD5 dabda8333f160ba5b7256309cf4b44a0
SHA1 8b8c823fc423f49a2dd863d0a321256aeccb45ca
SHA512 7eb72fc54a9ccacf15f5cbfeda669afb3913f76741fad2e3232743815ec91535a0a60ddbc8bac6669d7d835f7c432436efb6223aa6405c02f62d4123fd3264dc
SSDEEP 24576:GcP4mcvIjkGOxhKP2l71nNKbrh/8KBu+4ZAgayjhwbmY3MaReFeDvSP3b:BP4m4IpOO67W8KM+tgauhwbR3P8wT8
TLSH
T18765BE2DA7DC0096D0BB917486658A49FAB1782A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 2cb90ad4253ac35e70e190fe54d21a3854e88882c31a42c92310801b47c4c0ee
MD5 4cce5a1a668813bb6810cd5dbb4045ae
SHA1 dcc0be541244bd2508725ff0771c0e74e99ea2c7
SHA512 36e73d37655c7ac977aea0b8938b0b3b47d9cadbad32fc8ec4c5d9042871ba3443c77e43b107f85175414d8d2f09a6b27c029602eeabfc09d8c540c6e651cdee
SSDEEP 12288:6psffeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:TW+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1A775F149D29801D8C06E1275CB564A40B3777C6697E2D3CBA6C0F67E0FB1AD48EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 63e363caba5f7fb4cd5e3302af0a9380a2ab9d1b7cbda1abc3edc62bc87f2768
MD5 d119fbfdbafda5c01dd37cb43852f160
SHA1 4e39d1e2a10ab60cb67ef9e000a68d4573cb61d0
SHA512 8e6639efdafb12eacb32decffbfffc1fedc8c0aa9b24eb1549cebe4db33971a7a9fdd8af7f62966b9aae786c8a6bf9baac5663efc5deaf2e970b59cc6ba5bab8
SSDEEP 12288:Q/eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Q2+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T121652351D34C988AC57B0B708B3A4930365EBFD62F41A14AF98977898CF0DF98EB1359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 762130a5a3676783a78b56499d97668d00478f0b8aeeb05e087b02c92a90ef86
MD5 a8c8fc37d42aff243921fb4fb93caaaf
SHA1 3ede06b0c1344118e201423baad7bb57b9a049e5
SHA512 f3cbf25e33c0b5f49dc256df7ebac5d34d675a28b2fe047dadb37878e6d1296a5744a3f26a2ed0a8f784c743edb7374ce9a56a1be92caea41457b942f02ce4dd
SSDEEP 49152:ya0h2GEkuAe73q3pp46zwwQw+tgauhwbR3P8wT8:ya0hNYG4JwKgaPJ
TLSH
T13585AF1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 49b0ea9f67d9f0069b950d4cf1852db80149a7c90a82c8ee65a70633e8064b5d
MD5 058b9a528e5d0e23d8956dea1e98054c
SHA1 5758a3d47345f894dc7b39b824c4aac0791475f2
SHA512 5c53cf09b473acd4af3cc59d2121aedb06c5869332ad21d3c9d2966a0a2060888172361fbd14d0c7096ed5e0ed807697ce3d6942cdb2fa8591304253a10cb84e
SSDEEP 24576:2hbHjPhaKngL2jdshRTdG1YxITqvfPkbIcbjLf+4ZAgayjhwbmY3MaReFeDvSP3b:2hbHjJarSj8RoTCCP+tgauhwbR3P8wT8
TLSH
T1406523BE978C15C8E136677C4BA68901E672BE591B0293CF96D092BD4F77EE40D38B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 49c11a826a341fc62fc018d5dffb9a7d02370af72f669c565cc1d833ba030283
MD5 c6e2e758a0eab3edd9ce77336a71bf73
SHA1 bbcf7e4e9c93da7fb1e20ffa9b0e016f304f5d4f
SHA512 f74125c7ced7e5bbcf6104230670b26ab927dd57aa4fa8a2af8b76e9f1e481d98e8fb407f00077b2ef265ebafdf61ce890686fd5c8d9a615578c920abd8e14f6
SSDEEP 12288:HLeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:HC+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1B4652380D20C98CEC57B07748B6B09206659BF862F5662C6F8C97795CDF0DFD8AB1394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 c8706d61c6d92d54f1847f3cac527d3ef61b5abae480b2cd7774bd20d9c87b65
MD5 c39bfa09f48582bb96b3dde1c7aa4978
SHA1 94b29d92ef99a29b87de6a54a39bd7ff0c93a6d0
SHA512 84c2eefb07ab216b5e60ac419323dda3051c6655ba535415d966dfdbb2b62a4aead481e46456270a593faa0104b387150ede4d169632cc8bde9fd2b85b8a42fe
SSDEEP 24576:LAL3UTF+4ZAgayjhwbmY3MaReFeDvSP3b:LAL3UB+tgauhwbR3P8wT8
TLSH
T1E2950154E79800F9D97B823CCA668A12E272B89D0760E7DF43A84B651F737E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 60a84e43b2a4dac11674fa4b68cbc18c20f73fc7416395c32a0fa23e5222041a
MD5 d6a119f07b391b6da918c8020caaecc4
SHA1 eb5370634e850471cb1ae526f507269b5218c19c
SHA512 6a4f38d55070d3a1a9edcaaab94e5bb2af4560682054aedf7a6eba27e064737dcf6d1d486ee80ffc73264db20bbc0b0ed8461a15b4662744aebafd517d0792bb
SSDEEP 12288:MpFtvOjeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:0Oa+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1D6750219339C10D9D57A523C8A974205E3B1BCA61B1253DF86D092BE4FB3EF89C36B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 636ced1a8badb1213bb5ce0c3301a5628815e0952e6011a2ac2251b354518c9e
MD5 0da722f4620932c5a2ede24c01b39313
SHA1 e15588d450ee2283bb41220d8184f9be8c0b9376
SHA512 e3c63e75e0e77cb15379b8ef60ac5594816baa4ce34373b317b130a22d1ea1ab5fceddc9289fb35a510359925e59042f507d541405d7827a657a046111edb83e
SSDEEP 24576:c7NM9YqZqmWMUkPjZM48Mv6bEhsm+4ZAgayjhwbmY3MaReFeDvSP3b:c7cBWMpPjN8DbEhT+tgauhwbR3P8wT8
TLSH
T1BC65AE2E6BAC81D5D477D13DC9A28205F6F2B8611B318ACF5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a6a4ac296ba8b2874f665b732e48a8b46e8f116c0332931be7b586576cdb5c7c
MD5 02a3f7230f9d8b46f5f1e977388f2962
SHA1 df89a8c5e94629d61eb2d567039d2f26676c865d
SHA512 c7467f730a6134310412ac451f9b0240bebf3553be51da68bb83e487046ce815d8e44b6022c869e5bf432d17afc69b38a0c9b9227c0d677da60a948df0cfada3
SSDEEP 49152:TF2YuHNETovAvNYf8kmG+tgauhwbR3P8wT8:C6BCf8kEgaPJ
TLSH
T14F858E2927ED80A4E0BBD27D45B79246FAB2BC511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 2.5MB
SHA256 b5a519d5ac53db1383579b72d2656cdc9438feedc45e44a20892c90cc09d9098
MD5 c5dfa7f5fa36ef74541f15020393f675
SHA1 b249786a300c272216826d4b748797dae880265e
SHA512 51674252452df3f4b796c89cf5740af6979bfedf0d7faddbd6e20fd033a4162282b3ae1289dee7f89537c1563366bdd6913fc56d4edfe47d80c39b97319416ef
SSDEEP 49152:TF2YuHNETovevNYf8kmG+tgauhwbR3P8wT8+arSj8RoTCCW:C6jCf8kEgaPJnJTy
TLSH
T187C5BF2A67EC80A4E0BBD27D45B7C246FAB2B8551B3056CF4255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 634d0e46df92acd9def59be0490e998ae26165431dbbbdca2dffcf428e97415f
MD5 f65a5fa3456cdd389e07a3621b33c294
SHA1 c59777b2ddb0edef425265399817dd2984ca0730
SHA512 cd05dc7a513f7096193abc8ede13a5310a231f3672b3d580d350a0686935e69c5f3bd8b79c7e8267bf3bf5a16d4f1b2092d28c4c0eb35b88c96f287c7ed05eef
SSDEEP 24576:zAFs06+Omlf8NXEbTod+4ZAgayjhwbmY3MaReFeDvSP3b:8Fs060loXuQ+tgauhwbR3P8wT8
TLSH
T16565BF2F62AC00D5D07ED17D8A97C916F6B1786307255ACB0260867E7F6BEF81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 4f2bacdf13649035c32eb6aed6106eebd8e2634a38840e9cfa9f00c16724b1ce
MD5 f6c389bb9db2cf7ea0b221321a5659a7
SHA1 1e22366680cf49c10d55bcf5111a00a3c9453c5c
SHA512 21770071bdecbc91b828c00a41d527f0bec1ccc6686a3b34af7c405ece57ea5875015558280528f614c4309cb5208f5c623b726e51aeed94498be60d0348e5e7
SSDEEP 24576:lJnJ5D3WXQ+4ZAgayjhwbmY3MaReFeDvSP3b:lJnJ5DGXQ+tgauhwbR3P8wT8
TLSH
T1ED85D02DD2A810E8D4B7C374825A1B51FF72386D2F226AC768B4D5357F22EE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d653c81b87ad31806a887efe24ec84096dca7e194e50dac3740866c5a8b5cdd5
MD5 6fad741c0cc0082a1922093271c0e58e
SHA1 8f49d2c0fa8b2d3400f21140d0fed4d7ffb827b6
SHA512 37eecd55459dece0f92e190a0befe1bb914d4bd1a4318471853395cdc51464ef87c7fa00385f7c30d89f293afd0f8a5979b6c333ea6fc27362a8116f9efd08e7
SSDEEP 49152:og06DIKdwc+eQnSt65aVa+tgauhwbR3P8wT8:pHgaPJ
TLSH
T1D6956C16B7EA5294E8B3CAB1CA6295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 8343326c7bc050872abcff3020ccec3b6daaec985564b2f248ad8c6fafcfc009
MD5 5efe5cfdb5ae80dd15251b9318e36aa5
SHA1 6bb969f617dfef2365688729f8298e426f1edbf0
SHA512 05e201986f8b15d87e29159342ecf0f622d434834cf451750dbadfab63024f9504737203b394dac7fd06b465f24fe9fa61f567adaf15489701c0a7e47d23c34a
SSDEEP 24576:MiQaKngL2jdshRTdG1YxITqvfPkbIcbjLm:MiQarSj8RoTCCW
TLSH
T14A05126EABCC61E4D02AA27C69A18549E7B3F168570317DF45E0C27D4E77BE52E3CA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 e87ad17c2982f096b945fb30f78702e7903640a6229f3fdb4e514a3d193b4a5e
MD5 a2082566982c55ba19e22b26a9385972
SHA1 6893a5d8938571fc0bae541be1a4fce1067b9681
SHA512 a5474f82709ab7c393761f6a895ab351c2a2df515c08f2f73e34d693ef36152411c317b13e4416f9a636a1a5816a4d9d7a4ac087dea1804bd3df3f9e817c335e
SSDEEP 24576:KpQaKngL2jdshRTdG1YxITqvfPkbIcbjLf+4ZAgayjhwbmY3MaReFeDvSP3b:KpQarSj8RoTCCP+tgauhwbR3P8wT8
TLSH
T1E16523ADA78C50D4C12B573C4BA28940E7B2FAA52B4757DF85D0927D4EB3AE90E38700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 b50c44c95b21f1b5158fa42d4d3d3ef4b58fec1e112a6f07e53578b64f8d1c0b
MD5 7be6cb9a3d1aa9dd2db8e3a58c8453af
SHA1 f98912d66c6ca55bbeb3a6b8f60e5fca28ff8c81
SHA512 7c8c37111c35d9a9ee7867aa622b64829fc4252d68ee59d6363627f28afa10ca1e1fda9e6eb829fa8f93d5ca1a08c59e4e6a542834b21feb88bacf40d0af9967
SSDEEP 12288:pjkyZeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:pIyE+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T16C751244A39894C9D67A07388B7741A09A75BC612F1193DFA0C0F73E9EB1FE89D30B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 1011882e8ee03d6e5ceab70415fb292e50b98df897f675c5c6dcf3b76d378336
MD5 44a903903b411eb4f235efc29e66b4cf
SHA1 b84c81a7b68314576a58a5622c6969d6744e0169
SHA512 6dd0b2c95dc221cd723def53d60ea9643393b8b3cf45085367f4e76357dbe13d5eb6d40b93a01236fceba1620235b0d4993bc9b1b66e85e15299801361d97c11
SSDEEP 12288:8yAeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:px+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T145652344921C64CEC92B07748B3A0E6062A5BEA62F4271DFF4C9B7B5CDF0DE946B1784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 de791a9c2b588935968b032db507f5ffc58fa6f006a79af9bc64e43b07f3569c
MD5 5585b3a45faa6ee43ab0e6852e9dcbd9
SHA1 f48dfd1f207c44331865869b2cefa38596182d0b
SHA512 30d2da625641ecf0a401f86643a444e523cbf009f5d3eb52ed8c5ee44b36c8493d5f5640ccc0bd4a342b308c63330e36a78510150a236836ebdde289a006c538
SSDEEP 24576:xQ9MxZKdcz9dw3e+4ZAgayjhwbmY3MaReFeDvSP3b:xVKZe+tgauhwbR3P8wT8
TLSH
T12E558C2DABE9058AE177D235D5A240C3A673B4311B31D6CF2448D13D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 bb15d99d117072f1547998891e0a27cd649db9456e62d8007d66be814b23c035
MD5 cec6921a130bdd62ab95aeea5bd703a4
SHA1 61bdcc5ab85f5cafdadad4c456a613a99ce1996c
SHA512 30ce385a083791e2fc5027d2ba9798efe824c0a2ec44de972ffbb58bc021d4a385c7ad4a387d4ca80615d1aa242fdc6eda34aeee5e43641d9f020ca2bb2a44d9
SSDEEP 24576:9yocDApP+4ZAgayjhwbmY3MaReFeDvSP3b:AocDApP+tgauhwbR3P8wT8
TLSH
T19285E01FB76D40E2D176823C8A858641E7B3B4701B6263CBA591C33D8E73AE9BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d74f82bbc8181f45d94762c19374c3849c4bd36ba590f8c84c42cfab808203a9
MD5 c89ec73238911660792d1fc174d00063
SHA1 087c63c62d1c91a2b683b79376d5df0c35d26760
SHA512 1a4280aaf1810f7a0fedcab8dd47eea31f323c1caae80f5f631ce3df038ef1a7d04baaf4ede891bf472842767ddb056c33570886b2c40492deb239f4ac007b93
SSDEEP 49152:vWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKP+tgauhwbR3P8wT8:X0zuNIogaPJ
TLSH
T190A57B3DA2BC00A9D8AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 ea7645e4a643b0dd7ce698da158ee6b977edf48dba53c488256833df38c67a40
MD5 6a160a6589cbd85a083fb30917b946e9
SHA1 2aba2149c4dc381eaa3eef82bfa1eddeedf2a152
SHA512 bea1769fb9172a772bbef856b59e188f0bd5fd66b890862aac5dff1978ae755d1ddf025b0f2a2f355203a5bc0514bdd89b2b2a1984b455cd713bba57135f5de7
SSDEEP 24576:P1QT7EcpfxR+N5AWAz3ooiYhjMqbIaKngL2jdshRTdG1YxITqvfPkbIcbjLm:yTDxR+N5YzTTjMdarSj8RoTCCW
TLSH
T1E375C12EA7F815E9D17E86799B23C506FA727821033193CF42A0C17E1E6B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 2bcdbeb591c08a9d1a3a1be91d307ef37dfa6a81a05a85eb516be98c7c369bc0
MD5 f4038f821dba80052586fca50ebbfc7a
SHA1 a451f53a3cbd46f2eb16133a0e388dbdda528a2b
SHA512 e2e4435b23acb0e7fef7b0f9eaaeaa508835341cb21057f2ca0131a55d1d6af0ef143dc1e8687f70ae0945435137c3d7fc6fc9b31e5ad439f6baa9c13fbec8b4
SSDEEP 49152:xTDxR+N5YzTfjMdarSj8RoTCCP+tgauhwbR3P8wT8:Fu57JTegaPJ
TLSH
T15AA5E12EA7E845E9D17E86789B23C502FA727861073193CF42A0C17E1E779D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 c1ac8d9a13a0995dea88649bb256072c9c251b9d221295277464686aa862cbc4
MD5 3eab731dbaca045bc547ec427a66eecf
SHA1 b5ce6a2122f621d582fd36bba449b988f47c1216
SHA512 c65a8cfe2ace6f55b10a7d4c8f17840775c1f48fbdf0240237403768147b451bf6687ba2ecefd938ec358455770677c08dedaf391bbcc3ec05b8c905ceffea9a
SSDEEP 24576:5hbHjPhaKngL2jdshRTdG1YxITqvfPkbIcbjLm:5hbHjJarSj8RoTCCW
TLSH
T1CF05127E57DC12D4E176A37C6AA6894AEA727929170283DF46D0827D0F3BBE01D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 7c0720438af4a0a7387df299fc26a7b808f4eacf1da51f826b406ce7e4586ea6
MD5 c21c76452c9fbd11c2ed25876acd86ab
SHA1 3d78f233ab9c6172c7959cac2571984dfab78023
SHA512 3328ca10d246b39c30c50b111af7d4dcc2d74ea54612686b97f65c8d679032779f5080f4a30b424dcf19a11c26585eb9d1549600d9eb99c69d3c8d7df260c425
SSDEEP 24576:JTMdOz0FFS+UmSLo+4ZAgayjhwbmY3MaReFeDvSP3b:D0K+UmSLo+tgauhwbR3P8wT8
TLSH
T13785F17EA36D14E5E47BC27CC6538902F6727862032266DB46D0C1B92FA7FE47939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a96d9645ef7726b.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\5a96d9645ef7726b.bin
Size 12KB
SHA256 745c014a091f6eb5b40adffa4a8b92ee82e8be3c0720bc4b06365a1ef03350e9
MD5 796ad42f7d1cae89aa4a49b7009349ad
SHA1 40ca449449879685f5143cdead1fdc1c57bfa789
SHA512 3cb357c7ea0f87cadf4d61625454d0e81cf318a217a8c70a9534534cd08d753444c9d175b2eb9fa24839c0df743666a2644c243725a4afd11ae5892b35ca06ee
SSDEEP 192:AM/n+Vm+AlMGzZtEaTzm6rulw769t5gQPtybZ9qAiC6T1VhKu7qiEMsf6:AQ+bxG1aaNIBL+8EbHiC6TPt75EMI6
TLSH
T1F142D0C919F165C2E65CB15B86AE90C59248F447E2CD1414CECFA86B5070F8CB2F3C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.4MB
SHA256 fddb5e6ce3c805403be01cb7207ff490516c07693af8c041c17700c991efd8fa
MD5 64661bf006feeb24efc470a1b9d72007
SHA1 2f95ebeb993c76e2f18510c7e140dee0fb5f0e59
SHA512 38f035568a538441cf0b8b3a6f581050e5f32101584971f10f08c3b1735c48df0f54298fe2f0b47ea8e43243b0d6ec58abafcbf82c66aac47e24c2881a8412a4
SSDEEP 24576:iwYgnJcRTk4yti+R5dUR/CaKngL2jdshRTdG1YxITqvfPkbIcbjLm:iPgnaTk46pUR/CarSj8RoTCCW
TLSH
T15A65C02EF3B910B8D8A6D236450147B5BB71782D1F219ACB0170C538AF1AEE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 96cdef1c63a18c53bad0eea5e55e1e98fc55655c36a0cc94e1f2ba6d1bf8d37f
MD5 7d2d706b40718f7e70c8e93b791712d8
SHA1 156c31962de0693c28148d104ae4a5e81a19c23c
SHA512 b36a6c02808144a4621d45f20d33b7c5483c31a0aa67d69617b11769c2fc7458ed5c55b5ea5d12d3a6de18c23e5b5510ccdb5034c0d6e1b2718229dea38d0212
SSDEEP 49152:FPgnaTk46p+R/CarSj8RoTCCP+tgauhwbR3P8wT8:FYlJTegaPJ
TLSH
T19695E12DF3B910B8C8AAD236450147B5BB71782D1F219ACB41B0C538AF16EE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 eff290e5962d20b17c1f60ce77bb05d64ea390c01e7c99248592a3966aa9015f
MD5 ee55e83747273d088c4f13cbb5490c39
SHA1 145bc7934a28d81716a03b9869a869fab972d223
SHA512 92ae1854cde5a792221148ae9f1f875f9392cf0620e0dc62f08141d992d0e7b7a13c2221c166b5b8f04b20a9302ea5133b7dd883697638279d57bc60e2a521a5
SSDEEP 12288:b4K/eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:H2+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T19575124863EC34C9E4774334CB3A06109670BC762B1166EF74D4EABA8FB1EE88974B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 2.2MB
SHA256 9f02b44c01f0ecff5ad4dc0f861e0a2051df586c92bbe3102f1ef4faf66e4c5c
MD5 76b7b88ecd242454680c01d41386edaa
SHA1 cd708fe116cd4705e60e9bd8415b8089d1cbee0d
SHA512 354a0211b0daf9835f0edf5cd6c7786db77c60fe39bb857cbfa211b4f445bced610b3123d86c345edf6ef3ccb05e6b17d308f8b54006b0078ada9775e3e0ab35
SSDEEP 24576:g2+4ZAgayjhwbmY3MaReFeDvSP3bpaKngL2jdshRTdG1YxITqvfPkbIcbjLm:g2+tgauhwbR3P8wT8parSj8RoTCCW
TLSH
T142B5235D93CC65D4D43727348B7B494029B2BEAA170756DFA8D0EABD8FB2BE48538700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/516-337-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/1604-223-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1604-203-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1604-334-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1604-187-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1604-487-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1604-385-0x000000000CE10000-0x000000000CE18000-memory.dmp

Download

memory/1680-318-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/1680-165-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1680-159-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2556-595-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/2556-513-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/2564-70-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2564-58-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2564-64-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2564-72-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2564-69-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2820-485-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/2820-124-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2820-311-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/2820-118-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/3056-148-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3056-154-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3056-315-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3132-89-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/3132-80-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3132-86-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3132-484-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/3668-172-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3740-319-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/3768-335-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/3768-136-0x00000000006E0000-0x0000000000746000-memory.dmp

Download

memory/3768-131-0x00000000006E0000-0x0000000000746000-memory.dmp

Download

memory/3796-381-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3796-338-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3900-74-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/3960-339-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/4224-327-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4392-545-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4548-331-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/4548-486-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/4572-324-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4652-13-0x0000000002B40000-0x0000000002BA0000-memory.dmp

Download

memory/4652-139-0x0000000140000000-0x0000000140E46000-memory.dmp

Download

memory/4652-68-0x0000000140000000-0x0000000140E46000-memory.dmp

Download

memory/4652-21-0x0000000002B40000-0x0000000002BA0000-memory.dmp

Download

memory/4652-8-0x0000000140000000-0x0000000140E46000-memory.dmp

Download

memory/4652-107-0x0000000002B40000-0x0000000002BA0000-memory.dmp

Download

memory/4652-106-0x0000000002170000-0x00000000021F3000-memory.dmp

Download

memory/4652-0-0x0000000002170000-0x00000000021F3000-memory.dmp

Download

memory/4652-6-0x0000000002170000-0x00000000021F3000-memory.dmp

Download

memory/4664-594-0x0000000140000000-0x00000001401F2000-memory.dmp

Download

memory/4664-552-0x0000000140000000-0x00000001401F2000-memory.dmp

Download

memory/4668-407-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-399-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-424-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-423-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-422-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-421-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-420-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-403-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-402-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-401-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-404-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-400-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-396-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-394-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-391-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-405-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-392-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-393-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-406-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-390-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-389-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-388-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-398-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-425-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-397-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-408-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-409-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-410-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-411-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-412-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-413-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-414-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-395-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-415-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-416-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-417-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-419-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4668-418-0x000001DA5FE60000-0x000001DA5FE70000-memory.dmp

Download

memory/4876-325-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4880-41-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4880-42-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4880-34-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4880-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4880-380-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4936-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4936-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4936-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4936-387-0x0000000140000000-0x00000001402D4000-memory.dmp

Download