dcb8d9955ea121e913c48f54477d49770d42898894e73860ca2cf86f14c2b9d8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Size 5.1MB
Sample261027-a1pgwsxt9n
SHA256 dcb8d9955ea121e913c48f54477d49770d42898894e73860ca2cf86f14c2b9d8
MD5 fffd116becb3bb91d7de2f4b264fef44
SHA1 4e89a82506fdc617835d052fd2bf3a2c925ba251
SHA512 1f8f1759b498d383f5ee2d003e842253cc9f36c6cb89ca9e4879a7e07a7ae6044c0f040b44ca61c12c394c60ffb7fd21f7180b746bda18299af1755e046f6c60
SSDEEP 49152:PKjPpkBqsRqeKdzjA9DbKcM3GHFSanKyAqErPJKUfOkbSICcIFwC0KHLkT/M+whB:U1SC13GosGVbgzFrmwIYbJzl8Nw
TLSH
T11036BF13F2D901E8E0AED1788B669233EA72BC458B35B6DF065076251F76EE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4616	alg.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
3440	fxssvc.exe
4304	elevation_service.exe
4248	elevation_service.exe
3008	maintenanceservice.exe
3420	msdtc.exe
2720	OSE.EXE
2340	PerceptionSimulationService.exe
2976	perfhost.exe
3400	locator.exe
4544	SensorDataService.exe
2588	snmptrap.exe
3736	spectrum.exe
3104	ssh-agent.exe
1652	TieringEngineService.exe
4984	AgentService.exe
436	vds.exe
4748	vssvc.exe
5484	wbengine.exe
5608	WmiApSrv.exe
5732	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8a35f11a4bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007000c9e7ab65dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a75dee7ab65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b6d98e8ab65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf58a4e8ab65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090345fe8ab65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000259fa7e7ab65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000007c20be8ab65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1167fe7ab65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057e650e8ab65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bad51ee8ab65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4304	elevation_service.exe
4304	elevation_service.exe
4304	elevation_service.exe
4304	elevation_service.exe
4304	elevation_service.exe
4304	elevation_service.exe
4304	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1788	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Token: SeAuditPrivilege	3440	fxssvc.exe
Token: SeRestorePrivilege	1652	TieringEngineService.exe
Token: SeManageVolumePrivilege	1652	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4984	AgentService.exe
Token: SeBackupPrivilege	4748	vssvc.exe
Token: SeRestorePrivilege	4748	vssvc.exe
Token: SeAuditPrivilege	4748	vssvc.exe
Token: SeBackupPrivilege	5484	wbengine.exe
Token: SeRestorePrivilege	5484	wbengine.exe
Token: SeSecurityPrivilege	5484	wbengine.exe
Token: 33	5732	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5732	SearchIndexer.exe
Token: SeDebugPrivilege	4688	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4304	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 5900	1788	2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe	111
PID 5732 wrote to memory of 1728	5732	SearchIndexer.exe	112
PID 5732 wrote to memory of 2320	5732	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_fffd116becb3bb91d7de2f4b264fef44_cobalt-strike_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=156.0.8078.48 --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0x140316468,0x140316478,0x140316488
  2⤵
  PID:5900

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4616

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4908

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4248

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3008

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3420

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2976

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3400

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4544

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2588

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3736

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3104

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5780

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5484

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5608

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1728
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b5fa52c52ef4b632af7c0eac212ddffe1a449d37ebd31f805252d67f1c72b5bb
MD5 c12cb6b9cb1690cc0b8dba27f6fb804a
SHA1 d70d12c8e050ee96b731643b64db15b973669548
SHA512 88f50d4fbe6e672827b711214c4d822a9f911961119b28c3f2bd8f942db6bae511802a1edf30277585fdfeaedf5f90fb44c4159c4c80c6e2ddf37e6eedf2d097
SSDEEP 49152:Kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnRT/M+w:83q6HjByw
TLSH
T1D1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 11828f6a5a811eafc86d187a0b1e12f3512ae194d8a8ffd7e1e6e223affb213a
MD5 40244fc9f58f577d8f7a669bb83ec1a5
SHA1 b15ddd1548edbb561031231a22aa8c9b26c7f4b7
SHA512 06e8317feb2a056fef0627ad31c91f52db64cfad6f0999ad9faaf5bb788062d5f9b10342d35ccc40cf0c91790592d2316656f65f2f982e9e322dffdc94f7ca19
SSDEEP 24576:HXYfDtczAroHjto1GFxlXutIs1WZX5AR:StcHT/M+w
TLSH
T15085F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 783ef208e2c942168db1dc04f5a737fa9f755d77fc0c00c84e1cde2d3d269a38
MD5 5578d51cbc356ee95f413d69927afdfa
SHA1 4eb27b2f54289f040e85f073cb09e296bb0a895f
SHA512 7176660f72bc33f2400bdd93712eadc107eac68246dfdb0d814e06001fddd6f05e52f5ddc249c80bfe12e9885f3f0b10a23d0a74310a00ae6cbed4fdf981a182
SSDEEP 24576:k0Le5ji0hmxIrMIoHjto1GFxlXutIs1WZX5AR:kPji0AGGT/M+w
TLSH
T143959E26F5748375D073C0B9C5D3A69AED7230861B308ACB4286D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a251f17e3cfa416d186e033cc40d8ebe240fdbdff50ae92d172d9beff14bc036
MD5 d8a6833b294d9006af43dd52a5b484a0
SHA1 9f8d872079502f31cd0418b1737976a4f48bd331
SHA512 cfa4d476f556f60f5e20dd78fd8d3ffc683c2bd16a197885ebe89d3abe4c1c402818446b83655cd9ea4ac5932b39965898ff41b2ad12aa368d91d25e9b14db0c
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyu2oHjto1GFxlXutIs1WZX5AR:D/ezSC6vUzPvxHjyyT/M+w
TLSH
T1B7756C25F5788323D0B2D0BAC5D7BA99FE7230465B3089CB0246D76C3E276E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 75ff78c08fbac6a1250f95b329571c0e9bb68c8f13e7f503cfb1aff5ac6247ba
MD5 942722c31a6781317f9c2c4437c20778
SHA1 5c71c9faa078852e7a1011e2b4c0de7e5d55aadd
SHA512 83c611f96b5a8a8a2ac01a362574c58274c17c8b3799a5638314be325dfe3d9db02e107772ed3b7ff92ffa0b601180f02f13df5deb5e81e3ea5a61eda73697c3
SSDEEP 24576:8VbqPb88hv/l+6HoHjto1GFxlXutIs1WZX5AR:8VO88hXl+1T/M+w
TLSH
T196559E66F5B48331D073C0B9C5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 16990f8ece92b96811018f34c335715d860b6177126e0dcd29afb7e35299ee56
MD5 25ca82bcf70e2d2e82623f34c55fa44b
SHA1 b90a868a2c9b58faae1562a6da589310a053e30f
SHA512 5a72b507ee170b70abff9cdbc9ee364fb6d61ef41f99c027c9f20d89bdc19892e484ef859f936e37ec8523e5ff86b7d7d9c4ecc0b47d52d06806ed72e3995caf
SSDEEP 12288:4H+hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYYN:4HkoHjto1GFxlXutIs1WZX5ARJN
TLSH
T19065236399F250D7F77A11B02DD77A61ECBBBB06094824BB4B50FE190E3C060EA726D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 edf541762c63079c3d20512ec54b242bf2eff1cdc58c579ef3fe9b4697063a2d
MD5 f2caa4222a13554226072537e124b0ef
SHA1 20daad5cc0d1ac4d9d1585747c5ab529d61f4180
SHA512 84fa675cec718eb08aa430ac131825a21b0ab6a43e61d027532e53e5aa91c99d497b278872420a623888fef35885101c582d233e231ea9f7b631972732c80c75
SSDEEP 12288:ueBNUbTVO86UZhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX5Z:uJIU/oHjto1GFxlXutIs1WZX5AR
TLSH
T18B85CF3BEE38FCD2C27A4DB85A928640E77274314F51A3CBD164C20E9E275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1e4e19094124e9dcc49a22ddcf15df7dd22e3915d8d72fa549f237698349f198
MD5 0739459c9aa873c19bfa5de4fa1353b5
SHA1 cb223288fce0a20ed9d327efdbc075631636ebdb
SHA512 4c05cfb509ef247728291e485f1143651e4e6923e1d4d788710985920068d9fc4774e6427440bc89b1ee9cb275cd6e646cd9aed8ef94d378100388284ff88d0e
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THB:vQvGAdlCEL8c/yRNw5CLw
TLSH
T182266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 875353da20befcb7f354d9f93be0d4d9604ce7a2d9728e5233923b7edce21a3f
MD5 d12fee00e0a4f33cab6ee6616f086517
SHA1 e1a0e2b3abfb6ee7fa043755e4b7a2cc78947ccd
SHA512 22b5d0931ff71c83f8bcecbe4e5dc0a1d5af79ef35cf76c4eddfd1d7fc0861683b69a2f2a598ca4560172c1bd5b42b8d6390e3b58ad6391564194e616c8444c0
SSDEEP 24576:H7ewsAjFoHjto1GFxlXutIs1WZX5AR+N:bljWT/M+w
TLSH
T12A85E031FEB0E036C37B0DB12B26D716687DBA204B5119C3E3E89E9E49341D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 75a65e41d1b38f89e0ce201e8aada4cf47ad53fd7a2a84f25f4e44e117519445
MD5 ea8441cf01501c9499e0f53af5fd9dc2
SHA1 2fd6ccfd0b422d53c57a8db4f56b72426e43cf56
SHA512 f7561023bb87f0d8907968da486a61e207943d3b328c24c6fc1196254c6d0661014fee404e66187da2e3886aa1c0a4e9bca2da2f2e12d231f2c19663731ba0a9
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHP:rUEtQevvqc2W1cpV2EI32
TLSH
T138474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 50965209ce61c1c405b4078fb1e2b56864ee04bb2884efec7df39f6ae6d964ba
MD5 032bbd1df71fe69bc0bf127365aea1a3
SHA1 437898f84b8f3ae9cc32292e67b437777ee7a310
SHA512 98389c9225015c9497184fbf0d06570bcf7f159059be4da36ed9844511b0f668e110b2b23bb08bb8e66779ad7f30fd2dd062d05fc5466a3fff35eed3a61c5219
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/z2T/M+w:VoqtVjnm/w
TLSH
T164D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9bdb9735f3e915cc94de42bb53a130b068b3665650e95aa92f03d5a3610a15f7
MD5 5ad04b96fc173b0d9dc74195a0c8379f
SHA1 09dac4ac1231534951b0ee506d4969bc79244878
SHA512 94e925a69604425e58d91254fd063e00ad05761a074d39372326b758fb37d54093ede84d1ed98e6327f3c7d3836ce226c05c4b5b5d086de1a936c31163378763
SSDEEP 24576:BAhGLJIFoiwtA5l7S53KoHjto1GFxlXutIs1WZX5AR:BAMyFoiq5TT/M+w
TLSH
T1D735AD81EBF955D4F5B3AAB899B69170EA77BCA65E30C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 07fe34371474a8d0f1b9dd77467717eceb8ee70a873dfa002f334fbc9ccdd68c
MD5 9178b9a7374082724417f4312c677f05
SHA1 bbe4188755f8b9ad917834076e092cdaeb0f3a81
SHA512 78f8608137ffa724db2e68227bc4bea22ee06f8988520db1296a741f1f296b5814e18a219d47bd82bd3cc91f83ce528091cd2507d1941b3812c1f6abf3518160
SSDEEP 12288:bmw5HEjsChNDBFgl0WDm+CkhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:6wuiOW5oHjto1GFxlXutIs1WZX5AR
TLSH
T17185F14676E50CF9E96781388597D536FBF3B8022A25D72F0760CA1B5F37220BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 654b008f68afad45c059a303cbb65537f6fcbde710d93de1aa825921d6d4b9c1
MD5 8e0a0f29a0e422c15b59b0325de92246
SHA1 aa3bd4fb686f5586f00b654e89c7da813da1c100
SHA512 30b62a2ad4ab9418ba791dcf80ddc0256b655409e5acd9cecbef591e43ec300932d1904438ec23becb049b2372cbcd2139835def52e52e651f0db08904ca6af6
SSDEEP 12288:wTZ1IyLhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:8ZugoHjto1GFxlXutIs1WZX5AR
TLSH
T16B75125636F020FAE2A752789DE36A55EBB3B013173503DF07608A2A0F375D16E39762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9bc6a2c92758b703ffc94856ea2b052a2e1ffe4c20fdcb36b2ecd421d6288899
MD5 792afef0d7baf6b5f2dd611452dee286
SHA1 c648880c4ddcab90c43183977744b418a87100bd
SHA512 b5f583b219fca14dcfa134d958217ae90cdc4e30a56bd2da0d0d87cf44c6af3bdc7dc779262c2a5c759cae5c5c2a30a69c44887fe735564454f037d72034194f
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:MQRQyi36YOcPQLvw2gAf+PN3ew
TLSH
T141667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5892907ba8f37a9c9265fc01d31a9f1ac872c4f6f5c1b98c4a030116bda39bb6
MD5 ebdbff0eb7c5bfe3b1bb758021efd6cf
SHA1 7b126a47f3317701e4692d7aa406f7b4c9d5322c
SHA512 1cdc8ce5f74251399090e5984620dd324e7b6c20d91f16a6c7c186821a6c025bac5512acf1cd61de3a3c9672bddc1a669f2dd30479b3ef3eb40370c9903feb31
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:wQRQyi36YOcPQLvw2gAf+PN3ew
TLSH
T1DB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 11b0bce9ca06931529ad4143bbc255c14cb3face72829f486e21d7ed752d1fd9
MD5 2c5dc68721036ec3888b82a9534100f0
SHA1 8d949d354030d301a6ca584027e965f25cc344f6
SHA512 c175670ed95d43eca561beb2ed9791782e49b640b33842bc0e7f8f460b5a17058ccfc967f90fd0a09161776d492605bd88fd82361ea30501dcc211ccd649648a
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0woHjto1GFxlXutx:V68Qg55nhheWu7PNU3/GT/M+w
TLSH
T148B54933B2F20099C44DE1769F4A973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b805a2acd50d9643d55c689877ef16280c959a96368b04125848411820d2002c
MD5 60d04f088fdf8791a6a2dbf4566032f1
SHA1 d5701d9c1cd709bc9eb3e3eb3fd95e0d04c1e2ca
SHA512 640e40ec433019c72b9417b094e7507c893e58f34bfbba4945ed6ed628ec3453d03ecfe48f1c44f32455792cdd87496575e5c5d06bcf4b8267c9e6c14c5f67d6
SSDEEP 49152:03aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99H:hy5112gYy5azzVvL69nLKnhZRw
TLSH
T1EE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 393b40e121c4ef05009c50540df48d81fbbd2df91346b2bf4a34a0f1b1ab8a54
MD5 f6c2db065a4a95bc64bd938d5ccdfd8c
SHA1 765f06404e002de9d3ddd6403f0db0b1582c0541
SHA512 24adb7bf1716e7fae3187a43b11088c82c83a407edcbec44905d0817b5261630ac8bef223be6bbc47bb329f5d06f2e980e1b4cbb5300159f046056df4f12efc0
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glET/M+w:Tu6JmVxd2dGw
TLSH
T1F9D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 42e5d965cbe27bbf54bb131182609baa079aa62c0c7e34ca819eab709d9a82d5
MD5 c701957769674b5d21aa3349945b8392
SHA1 516a70b2194aaf717ef78b4f6f2dad081df3884c
SHA512 8ed03212cc51d79d685a925ef2c9371061703b569b7890935380270703558bb8bcbc12dc871fc296332cb0073db5f4d1b8b10ce1a4f79e17e0e486f70d7c0dc3
SSDEEP 24576:1hv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3PoHjto1GFxlXutx:f1hpsNoJpF1A6UU44CwH7R4xAT/M+w
TLSH
T1EAB5AE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 873d36a613f78396a7b16c8b464766af564ebf9fedd5e9b8c41c1eb2d0e2a296
MD5 a4ad842ca0e7e60fd0fdda33f5559316
SHA1 6c941e491f1e82397f25e2e8be2c28aac87ee036
SHA512 63deffa45e30f05039166236dc5feee547cfad457a7175ac157a1cd115dc55888fc96eab63849873396dd0cf7932df6daaa0cba784ec94dcd032f23f448663d9
SSDEEP 24576:64BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqgoHjto1z:OSuZQIY0Be2KRRVtOnks6NMHqhT/M+w
TLSH
T18CC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 39c377c553255a32c1e7387c7b8f5beac0850ca3dd970933e3733900a4f92d08
MD5 d14c1f52dad99095e78a83de64a998e4
SHA1 368cae05d2aca025b9c23dc3023614b2b1e8ebcc
SHA512 e5c4307ddf19d06377f5235f792dbad75577245863848eb4681d999a93b3e0f24fd23dcd7e260e5ea93693d3d8bed87403c77064a8bf5370e8db12fe243a06b8
SSDEEP 24576:0hiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLPoHjto1GFxlXutIs1Wg:0htSn8EApI0figngiDn0AP5wUT/M+w
TLSH
T1B295BE13F2D900E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a6abbef56f7b9e777f6784348165bae2b51c683aae94ad505491cc8d41e5d6e7
MD5 f536e849830f9b073369d7a468c2cdd0
SHA1 8de1210745e8522e6f79e0e5492560ef7db2ade5
SHA512 da291f4afb4c76f69fb4f28b7714995b567cc52a2ad580628c1794224e76f0b79c8c15eb989de8771083422ceb3943f972907bd1eef00d5e3723bc2ed36d2c10
SSDEEP 12288:lWhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:lcoHjto1GFxlXutIs1WZX5AR
TLSH
T1D16523639CF340C7F62551B029C77AA5ECBBB307594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 274e997205ca712cc83378c81d148dd89f4b04d154d81620b8e559688645059e
MD5 160179e1973a8ed4a1229e93dcd37d19
SHA1 9ba424cc132854949f4df25095a78975cbcb6551
SHA512 b8f0ecae17302d18e833414d605b09201679a7e66fc58d5fdb6c2c3ef6bd43c1dfc6828c0546afaac8f5133f74e43cb8a4afbb4b8cfd18a876b29a5dbbf989a9
SSDEEP 12288:mnhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:mhoHjto1GFxlXutIs1WZX5AR
TLSH
T16C652363ACF340C7E62551B029C77AA5ECBBB317594910BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 1748b075b03d04cdee73e691d20a8460b17b9caa5474eed0b37138c0e95eb0d6
MD5 2f0ef823914039fcd3db962175ee85d3
SHA1 bdcd9ab6268dedcf3a3ad851d7632f7b761ccf0e
SHA512 6530167c3d32ec7095c432d155bbae6791379b9dfba401ebc3a0c56fb59f499f89a0d735d822077f108e73a8a4aaff39bc4b3482e5e50ee82b7afe8c0700c9ac
SSDEEP 12288:DxhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:DXoHjto1GFxlXutIs1WZX5AR
TLSH
T1DC6523639CF340C7F62551B029C76AA5ECBBB347594920BB8B90ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 e5664e0999413bddf4f8a3febbda3ab94f073cdecb1cd4ffbc9291b865b3c6b2
MD5 48cefb2a5d4547f074fbad00e0870814
SHA1 8d317986bcce9aee9e1853028848ba596aaf2fc4
SHA512 ef2b2acb7e113ac10e3fa400f50e077f4ce15a52c09b3f424c49e549893025a7b71a76bcbd2570497d4b2cd5040648db9261c8c49a4811192ae4bd409d9979cf
SSDEEP 12288:XVYhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:8oHjto1GFxlXutIs1WZX5AR
TLSH
T1AE65232369F200C7E53692B49DD36661FCBBB6565B2521FF8B009D190F391A0BE71BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 7869a4c863da16e1c9c21c5b6e6a7fe1929964dc169787a656a13a94d2fae7a1
MD5 5eb37faa49335c1f2076dee71fe7bff6
SHA1 ed7025eea229b014b4ee31dbe6517f6f0615bb03
SHA512 f1351c85b2b6989a70be467f84d21cbdee5e5494ba64bb1d2eb9615b017f9164c964f9d0b5860c11f6cccfd92960f0d0d9e8642d44666129788028f4281d998e
SSDEEP 12288:XghKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:XSoHjto1GFxlXutIs1WZX5AR
TLSH
T131652363ACF340C7F62551B029C76AA5ECBBB307594920BB8B54ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 9a559578fba1fe491dc4e1011c4b585e77dde98e2725e6a44963fe8991fc14b7
MD5 eaf918ed011182076969d51a9d3a1dde
SHA1 3d9681db9e0472676642816a5460796941ae8fae
SHA512 8303f635f05edd700071969299d8255dc65c5ed9eece95b71c7017312dd148ee83257b947d1054740451b11149b90ea88d3e9de987db10620136175b61103b5c
SSDEEP 12288:hzhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:h9oHjto1GFxlXutIs1WZX5AR
TLSH
T18C652363ACF340C7E62551B029C77AA5ECBBB317594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5c284708d4b3c51946292bdeeec24e7dd3ab7b4eda087584ab5b419f66f86954
MD5 1d90b6f7d8a874dc5d7de0e329e6878d
SHA1 4194b01eee0297236c854cf1368a3b59c2613ba7
SHA512 9e0c07dbaa70b1b360db1746e08659a6910d379df2dad4f0557136c98cb604f31b6be9709b963a455702e750ac96596d6c5f1537a71703385302d012c2f36d06
SSDEEP 12288:EPhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:EJoHjto1GFxlXutIs1WZX5AR
TLSH
T1B9652363ACF340C7E62551B02AC77AA5ECBBB317594910BB8B50ED190B3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 2def41d88d4c9be9121310e5ef5c3bd811394cd086c2c4c2da099e1ad5c8b06a
MD5 8d6fea79140cff05b2b376eb0cc3f278
SHA1 bab334e999f80c4c7acda92dc46a2920052d2e9c
SHA512 566c5898a08a235a8f1c09d4cb1c1a303d387f3f2337fafbd9dbfed7c3a3a0f34d150368ac0a848981d74e492becc5c3b64dfff6263a9c18b5c56ae989175f54
SSDEEP 24576:pZM0zFVSOBoHjto1GFxlXutIs1WZX5AR:pZM0zf+T/M+w
TLSH
T1038502A5B3A018F9EC67813DCD569916D5B37C1A0B60C65F03A43A2B1F373A01D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 7a20113b34a62c5e204ad64ed1ecbc89eb10dbd491f490df51b72b84935feb61
MD5 c58654a0a56d4d37b199b65c05cb954d
SHA1 88dc3289b9c4533639318b848b995dff596f3aad
SHA512 95ebdab2214c63573da291983f90d9b4333e5ecf7f1d543080cf2eeb2595d1b4a5776a650487e75dd8eac48a4ca8a79b0c75e2570335276d73f0ca06f5fb4a00
SSDEEP 12288:iqhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:iQoHjto1GFxlXutIs1WZX5AR
TLSH
T1A3652363ACF340C7F62551B029C76AA5ECBBB347194920BB8B54ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 b31683bf049da66769d246ff9f49f7e345ec32cb3e2934518c72b50b061286da
MD5 952157bb8c202646634aca1884b793bf
SHA1 7c13fdf8c33dd5400b7896bccd7cd3727df35f55
SHA512 c57dec7c2da5b025df70ea8aefbd0da9f23b29517fa2f29292f4c63f17821ba709266434a408cd0d5eba83375c4103eec6a6759741dbc0a31fa85d6ece875ba4
SSDEEP 12288:kOhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:kUoHjto1GFxlXutIs1WZX5AR
TLSH
T1E5652363ACF340C7E62551B02AC77AA5ECBBB307594920BB8B54ED190F3D0647E766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 bb8021bce3504ceebdf704188079040c0872c9537d2a5f64ca6d120d3bbc2771
MD5 108690cf1171c2cf075237835e48d736
SHA1 0f2b16917a75d3c1fdc9d8c33097314cbd505f7f
SHA512 7634ae31c323927929243b331ba0c4284ee583e3f960807251df726acebf1a7e057521f5f30d72d6bc399bcfe836ffb1f2f85320a3b57489e50818f3242663c3
SSDEEP 12288:5yPz5L8LhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:4zy1oHjto1GFxlXutIs1WZX5AR
TLSH
T1EE75025776F130F9D136927489931A11F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 28d0af3c05ba6b8b628738df0eb7a2a9b55c8db2e79f5c576bb24558d5273755
MD5 75f4be313fc20b4f46d80eb3c97c5596
SHA1 3d01288b1c349d0eb7cd3467dbab9650673e98d1
SHA512 e8772471ca18c0e37e3578bf498a0c13ef47b9706d3fe989fa2ca8a15f4b613791d46111294010213e9ed438882fd847c9cfec79f6272954f2bcd9cf9459357d
SSDEEP 12288:oqhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:oQoHjto1GFxlXutIs1WZX5AR
TLSH
T15D652363ACF340C7F62551B029C76AA5ECBBB307594920BB8B54ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 61c73c5600df16b9c8ca45718d40f8b87ab95be68fcc5dabc4fd4f2345366371
MD5 31c1fc66d1d3e8989287f1d333ae1ce8
SHA1 2e315325afbcf16147161036941ff21d620cf51b
SHA512 0c3d26bc1b45b8d70991a2f753536666cc83225b9df2c60fc6092060d14482c1335b615d8335f80dd85c2d08b01783742e00f556e61909acbd5920701a52c3f3
SSDEEP 12288:tqhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:tQoHjto1GFxlXutIs1WZX5AR
TLSH
T102652363ACF340C7F62551B029C77AA5ECBBB307594920BB8B54ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 f1c2ab57d92e64fb4dae19e5b56ed93779ebf1c04ed69553a8c933cba601c250
MD5 9f3ac1e386c33ed5c19fbabb93c56edc
SHA1 55fda5e93d001a8b8e190f32a0ed38939d3e5519
SHA512 b4662d1b11c5c54ad96e7d5c50d2d97168c21cff8fa929859367f9058c3d3f44f1610027603949b91621413071e1c9411bafac409c2bed9f80ea1a29e9323bb3
SSDEEP 12288:MyPz5L8LhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:Vzy1oHjto1GFxlXutIs1WZX5AR
TLSH
T1F775025776F230F9D136927489931A11F777B43607245ABF47A04B3A1F371A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 bc860b04a602b37bb5378c049dfd9af68f5635336641623c4c25c94bca57b1df
MD5 ced0eb4ac6ade25c79318348d0cb4deb
SHA1 024de7af02b9f0f200560e2002b3e2c9e1c5a541
SHA512 dff754ddf2403cc1c9a02d4db3b1e5bd2db561a2626bc1d174cfdbea299b6be50d5c0f7afe5025b8836bcdf98f41b4fe21abd36c92be4b34ef8af2b570583870
SSDEEP 24576:4TNaLl3z0zDnoHjto1GFxlXutIs1WZX5AR:4TALljXT/M+w
TLSH
T1098502A5B3A018F9EC67813DCD569916D5B37C1A0B60C66F07A43A2B0F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 6e85011a0089a4cb907843d60e4253e93501c3f7d00fcf015cda020ed5b31dfa
MD5 9612e2e9d65aa3301c81b178be3d07c9
SHA1 a96b0430b40c4b106cad03f9c2d26145bea08e97
SHA512 75057dbef76a595ef74066e348ccf1abf53298ad1c7c976e0f26110684c71f38baa57f4eaf7502be37321ed94d8c0be7f8bb3dda9c8001921ae8b85ed26e3994
SSDEEP 24576:9cP4mcvIjkGOxhKP2l71nNKbrh/8KBYoHjto1GFxlXutIs1WZX5AR:CP4m4IpOO67W8KnT/M+w
TLSH
T16765AE2DABDC0096D0BA917485668A4AFAB1742A1F3286CF1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 3a08bf5e3327de1dbf17d25c902aac248e6e50b42cc425b4258c9a21a82faf2f
MD5 7a60e37dc63c0d07b3b393adbf283065
SHA1 f58b3fcc45fc0d5262051f0f5ca4c4a705480f25
SHA512 9b488635e0298152e1aa3a31948c22bb5cb061f799c170a6d62dff1cf4a9300600e03aaf3f442e49af800d672e769ab49b24f0af7d4fde120cb0968bb1cb4f75
SSDEEP 12288:JzsfahKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:wgoHjto1GFxlXutIs1WZX5AR
TLSH
T10A75F11AD2A401D9D06E6174CB865A41F7337D2647E193DB47C0F93E0F3A190AEEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 0c2a900c4c577694c0889a80a750acb7bb08dee4d7a177c2c234826cec831c36
MD5 29a8f3eceb64bd160b0dafe9360b4ed7
SHA1 fa188e5a1efb879cd2a878059e831d9b80f36ab7
SHA512 90c4f48013d8869a54ef414ddeca8968adc2c405631113396a080184bb9844719431186c1b265ac379f4be74af8d84ca11965d434db17021ae21f4171f57e542
SSDEEP 12288:L6hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYGN:LAoHjto1GFxlXutIs1WZX5ARXN
TLSH
T18765236399F254C7F67A61B02997A671BC7FB3160E4410FB9B40EE190E3C060BE766D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ea58910f5183f98873f7d30ce95055ae6187596d16ca6b3b23ffa507711bbb23
MD5 a85ab38de1cac66ed444c14300e795c7
SHA1 499c236dc802c2e700357672da86ad51929fb661
SHA512 83910ec4beebb735331743b7b327faa3a34ad0ae9b9de7eef0ac2f3a37adb9bde893011d943fc087d277eeb7a91c0dee7eee61083955d4cc78f724a3dad88b76
SSDEEP 24576:IoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9EzwwXg/b2oHjtq:Ia0h2GEkuAe73q3pp46zwwQrT/M+w
TLSH
T1DE85AE1E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 300229b7645c4e973483c27297d0f2e6d3e7dea6cf3e36de1ff5f0a2a96e188a
MD5 e6257977679394fb3c20fbdbbad05099
SHA1 5c4afae7121b61d4b7f5abac9cd73fd194340a3c
SHA512 1e7a1692ae1ba81db688f9f404332a73f8ff33544c2fdb5c7279839cf8394f3be5f9cba8cbb74364785665a3d7d1a6caa2291a44bbe7b416091bcc9c3bc7d9c6
SSDEEP 12288:MhbHjfXXhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:MhbHjPxoHjto1GFxlXutIs1WZX5AR
TLSH
T12675017E1AFD20CAF171A1BC59839606DA72B926071163EF1781C23E0F3B9E46D35B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 77b01af2dfca984329fcbd0d84832cc19f1b3015e131e71aeb539cda5be562ba
MD5 e091b620f722676505f800dc8f63d32a
SHA1 fec55aa54ba47fdc4bc060c2ce29739103fcb51f
SHA512 741a12538598abdf16ca54f181c30319b8344ed3be8d7fada84058cacd954a39ed73f693748457a8a0d73335c7c5c057e73f3d6b89f08c76db487178dd29b21d
SSDEEP 12288:CehKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:CEoHjto1GFxlXutIs1WZX5AR
TLSH
T16D65236298F250C7E63562B02DC76A75EC7BB3060B4911FB8A50EE190F3D0E4BE766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e52d699a3124b96123f45b1b3fd457afb1f014966bd0e18d9bcf99377de254c8
MD5 663fdf8d6109f129a2d651663a8cbf62
SHA1 08fbf595836910c58f2dbb2474f0aecd20fb585c
SHA512 58c0b919a28e79a388940780b312ddf3dd8b3d63db2ae34e972da512cfa7b3abeec5c2df2b442f1199069887a333d1bb81c61a0316f9f318608b4be0a4ebbb04
SSDEEP 12288:dObbA4LWOsvAYFTVhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+J:6PL3UTroHjto1GFxlXutIs1WZX5AR
TLSH
T18995F155E6E100F9E97B913CC9A39A12E672B45D0764E7EF03A88F251F232E14E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 75f9f6ddbb3975b60127e695ca57fb88187b6e0ceafaf209f8ec3f86b930becd
MD5 5d7dc1a4245002737b1095518ffd9ef9
SHA1 b8860cd9cdb7980b8495d6681b2a769968a642f9
SHA512 39dd1e523e9f1c3aa1619c085e1d8bce83c77495760106bbda6709ebce43f1cb927cfe174cc1fbd147b0f878160a3bd18e195e87aefabebe012016659e3cd118
SSDEEP 12288:npFtfO5hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:tOfoHjto1GFxlXutIs1WZX5AR
TLSH
T11475022A36E910E5E136A17C9A835359D772B466071213EF07D0C53E0F77AF8AC3AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7b23aae0f4a9134e0301aea51505c575f6f12caee04a7d0f09e4b5b144e38762
MD5 8c59511c7c516b6081f2fa9d3ca84e92
SHA1 88f24b743ed581c8830dc9bd11a9d4bedca27a2c
SHA512 2ded8264cbec276be710f8319102525461949ef659b9360dd9dfea4327d97227203070fd51d96587ba41e38ca79a99f71ba5a2ed36c223018da20a54e225ad10
SSDEEP 24576:+7NM9YqZqmWMUkPjZM48Mv6bEhsQoHjto1GFxlXutIs1WZX5AR:+7cBWMpPjN8DbEhKT/M+w
TLSH
T1BE65AE2E6BEC81D5D476D13DC9E28205F6B2B4611B318ADF1262833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 581e61603e87b6a842799ba685333678e3be7977c76eef906560ed310f89622f
MD5 f92e56b9a82a3945d584e942afc40f24
SHA1 3057ca0ec4292fcf8e5520cb7853aceb26495647
SHA512 a83803de860922cbffc648ca5cc8c5d17c44d26a9eac5bd0a95800dd29f8433b95fe893b2b2062cca343b19f83243e7cb318407556434cf2b98b8c0f3e07a5d4
SSDEEP 24576:BW6BApg2YuyuNDYTabvcdvNYf8km1eoHjto1GFxlXutIs1WZX5AR:BF2YuHNETovAvNYf8kmRT/M+w
TLSH
T19A858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f77cb2320ebbe68c3fd7670b4826cf3fb50a19ce996a9f8809f01aa35da96243
MD5 b70a4a1361041560325465de4134edcf
SHA1 bb6eb34f83a11acde6f85cddce36de635c443416
SHA512 4a9cb3b32dda30f5a5c6148f65d17268b0e2808054f3549bc379eb1df0e5151427d41ac1c3dd4a816650f8feb383974bb6a835a2f98b82e44115dad1cf299c65
SSDEEP 24576:BAFs06+Omlf3NXEbTojoHjto1GFxlXutIs1WZX5AR:WFs060lVXuLT/M+w
TLSH
T18265AE2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 13264061f84f0ef06942f4fe8a785655729589632581e2e9cdb526cc9b2492b9
MD5 6f195a190b07aff5742f4ed0294087c7
SHA1 b5a96afd8241fc798b4b224888725ad311bb2244
SHA512 9731bd86de1c5710d3d9ea759ffdc61d441933d5ae46f8618210f47720868798449f2b1016aff0c828fe718e640d91bc02321bb694cd57f2827e8a26ef26509f
SSDEEP 24576:4JnJ5D3WhyoHjto1GFxlXutIs1WZX5AR:4JnJ5DGhLT/M+w
TLSH
T18185E03DD2A410E8D4B7C2B4819A2B56FE72343D2F2269C718B4D5353F12EE0AA79F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 21b8800cdca17356da4ebef824265d4459cdb26c4a3a179443bf0be311dc80e1
MD5 b45cbeb6440d3bd5264ee16cbf9fb848
SHA1 025c06080f579de2eb9cbbb577dbd4f0b1bebe6f
SHA512 df7f89052e5018d74a0775fb168f11591b05e95bbf2164707c73831d2f36bdcdcfe42daf54424df5cbd785829655ce4b82186c76d68b645ad6f6bdde48d6dff5
SSDEEP 24576:sEPghm6/7IIXdwcXrif7qQncjlP65i3Vu5oHjto1GFxlXutIs1WZX5AR:zg06DIKdwc+eQnSt65aV1T/M+w
TLSH
T1EE956C16B7EA5294E8B3CAB0C962A5159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 441aa1391d6398cfda878a95b63ac5d03ee628a828141963d477f67a37e3dfd8
MD5 d3d7d35f297fcd7be0e46fcb7aa3b5b5
SHA1 fdb4e6fcd63218186929a8a4fc503b2bc742de56
SHA512 192589c106cd66558fdb6157e50e4380c68441ab09487f39c61f9bb95db6a2686d105fc1f4c6cb73ee9222f1fe2e0dcaa620e4d4a24e09e9e5f98f0ff2b93757
SSDEEP 12288:ZEP3RFkhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:qFWoHjto1GFxlXutIs1WZX5AR
TLSH
T12675126E2AE960DAE136A07C59938645D7B3F0211B5223FF06D0C63D4F3B5E46E39B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 424b3bbddbd460e78bb34b21d1c9a1b3bb90dd57967b1fc53e1401d099428977
MD5 14b55b1a94e9d5eb7b385f1aa9277dea
SHA1 d9f3c832a744e0bf2c384ff018c239d339a15d2e
SHA512 d831715d6f57d74e3bd747a91984034e8a385b8ea06d01500fd871f0818acc9cfe247ae753a49fc4ca699e063ad7c7d8ac473388a29b4a5e2452369d1fc9fe52
SSDEEP 12288:1jkynhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:1IyhoHjto1GFxlXutIs1WZX5AR
TLSH
T1C475120567E050C6E67A42789EA392A0DD76BD211F1112FF5680FE3E1F3A6E0BD31B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 3716aa73a96dfbdd1df0aad7d15d6c24e47f5fb85ba85bc4f6fc6bdb6f589777
MD5 abaa8ac92b60641f6867fa40953aff12
SHA1 15cc1ced7ea2cc3be9fd32e177b6b06dcae6b416
SHA512 408666aa9fbad210d0305fb32eb4359048fe3cec6075799f7329d53f70b5cc867eb85e2b72d6d7015aac2c78a3c4e3067a90db01ed1f19a227240c44800ad5ba
SSDEEP 12288:tQJhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:WPoHjto1GFxlXutIs1WZX5AR
TLSH
T18A65236659F260CBF62551B419976B61EC77B3261B0520FF4AD0EE394F3D0E0BA72AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9ad42fe66c75b95138b79623b291d4817c40494d29b43e4faed9fe3da6866d6b
MD5 340590e8f80049fa4b992155f54000dc
SHA1 8df985ccf29f2531dbb7db860ff31f8b9bd40712
SHA512 ecf0d7ca03186cbfb44b53b9614c50287e4634b00e6b42f8d0a243f8aaa837d75886d72b25543ba9034f8fe51c242607134446664d6e417904a0dd6c9edd547d
SSDEEP 24576:7Q9MxZKdcz9dw3ooHjto1GFxlXutIs1WZX5AR:7VKZJT/M+w
TLSH
T192558C2DABE905CAE177D27595A250C3A673B0311B31D6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 fc734049e3e79f70d1b15e0ae236d10d9129efeee8e56df8bedaf5c39eb015c1
MD5 74cf612c9544d2108c94c45bc1e2cd1f
SHA1 fbd33fa1a90d1aae4bb6a03b9696926ac118ee37
SHA512 e128b5662fcef89a9eff5c68d6c27b792790fdde9482b0cafcfbb86ec7b196b71efc66d8d8a2cc96e9492496e097c95af65df9bd0efecfb33e428432e71f47c3
SSDEEP 12288:7yoKo2bRple9p7hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:7yoc9ApFoHjto1GFxlXutIs1WZX5AR
TLSH
T19385E01FBBAA40E2E176813C89868755EBB3B0301B6213DB5691C73D4F279E8BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 efbbcae0fcb11fb6967504e8f26084777c51aa614609b0a3b65d6a8a6a588d39
MD5 41062b5c3d81eaba501275c65ffbc35d
SHA1 64a0be96331c6528dcf49a93aecd11a31d6c7398
SHA512 fd0516ae3b7903b0352ac300f288a633e8dcead25fba983c0458a0c68da52128307b6e98ed9086de3df5a039f7aa56e5c6b8ec680bf9aa42e0289ddf7beaf011
SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKWT/M+w:i0zuNIWw
TLSH
T19AA57B3DA2F800A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fd747ab4eb3800b8268292afc21052895f6828ae1cf41679ce46a13c2f2188d1
MD5 595add080054be929e4c2130b0bac4db
SHA1 b8b00bf9aef2e69e0ca82e8953fa131578aede4b
SHA512 d0742c84c4a6c1f28a7369a7d71151a0dfaf602d1dd31a684b087b0362adeb2f33455066f65416ea85a03f8d9b51fa1e1810375c67b46f36e6afd08eee5f6792
SSDEEP 24576:f1QT7EcpfxR+N5AWAz3ooiYtjMqbWoHjto1GFxlXutIs1WZX5AR:iTDxR+N5YzTfjMgT/M+w
TLSH
T14255B02EA7F915E9D1BE85789A23C512FA727821033193DB42A0C13E1F7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 17bbcde49713c5d4847e0523a5df14517b7b8348f9c9f80516e15ca4837a36a2
MD5 e1d418d3bfb1ef39712e35ec57f5a29c
SHA1 ef2a2ef5714143408f7a4f285047f76e1e5cd07e
SHA512 4c9b01e0f7d190ffc412150b4aa3e979960aab90c42931a3be643c6bb756bbdadac2545fdae7e183cd0e7cff6bb2d439232b924c6775c6e967891d9b3a43bbd3
SSDEEP 24576:cTMdOz0FFS+0mSLqoHjto1GFxlXutIs1WZX5AR:00K+0mSLDT/M+w
TLSH
T19885F13EA7AD14E5E47BC27C9A438906F9737462032166DB06D0C17D2F6BEE47A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 a38d1644549a67b311c0b7d5859121bf06b5cb3ea1d8de1793875419bf6cbfa2
MD5 c9c58f6afd0f3119050dee97c8c95965
SHA1 95a443c5dd09337ddafef3213ea394cca43f81f3
SHA512 50bc4ccab848fbba25c2ddcdbbed6e5de08cbfee4fb48110667c65203852339009ee5da1d8c54ec49646ccab5733ab46a5278a33693a8a6d14dc97438a2e6bce
SSDEEP 24576:A3YgnJcRTk4yti+R5dBR/5oHjto1GFxlXutIs1WZX5AR:AIgnaTk46pBR/ST/M+w
TLSH
T1E345BF2EF2B910B9D8AAD136450247B5FB71782D1F209ACB0170C538AF1AEE85F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 68ce289cd6d32def4bd4e86b764a8d5d087abea7fe08a54cadee09e57b8e74a5
MD5 0d88a63657e94dbb62956925903c08de
SHA1 2622e37665f39bfce08f47e93cef3992754537f9
SHA512 a94b6e808878fa8058d70b00071b8bb53bd6f9fba487db78354c0163249b5565d830dce818541f7e5fce7db05e85a9ca7a34775c69c629371be5585bf2dfa949
SSDEEP 12288:O40VhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:iroHjto1GFxlXutIs1WZX5AR
TLSH
T12B75221A27F530C6F43292749AA71261D972B532171421FF2AD0DE3E0F3A5E4EE35B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-274-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1652-272-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/1788-288-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1788-9-0x0000000002780000-0x0000000002920000-memory.dmp

Download

memory/1788-8-0x0000000140000000-0x0000000140540000-memory.dmp

Download

memory/1788-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1788-241-0x0000000002D30000-0x0000000002D90000-memory.dmp

Download

memory/1788-18-0x0000000002C50000-0x0000000002CD3000-memory.dmp

Download

memory/1788-11-0x0000000002C50000-0x0000000002CD3000-memory.dmp

Download

memory/1788-255-0x0000000002D30000-0x0000000002D90000-memory.dmp

Download

memory/1788-293-0x0000000140000000-0x0000000140540000-memory.dmp

Download

memory/1788-289-0x0000000002C50000-0x0000000002CD3000-memory.dmp

Download

memory/1788-281-0x0000000002D30000-0x0000000002D90000-memory.dmp

Download

memory/1788-6-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2320-440-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-454-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-462-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-461-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-433-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-434-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-428-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-435-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-436-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-438-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-443-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-427-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-431-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-444-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-432-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-449-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-442-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-450-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-451-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-453-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-452-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-441-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-455-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-456-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-437-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-445-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-457-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-430-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-458-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-446-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-447-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-448-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-439-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2320-429-0x00000190DCC20000-0x00000190DCC30000-memory.dmp

Download

memory/2340-92-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2340-252-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2340-86-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2588-265-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2720-82-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2720-76-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2720-240-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2976-99-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/2976-104-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/2976-253-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3008-70-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/3008-68-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/3008-64-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/3008-58-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/3104-126-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/3104-270-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/3104-132-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/3400-254-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3420-251-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3440-72-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3736-269-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3736-121-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3736-115-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4248-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4248-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4248-250-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4304-44-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4304-38-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4304-249-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4544-319-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4544-264-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4616-238-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4616-420-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4688-31-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4688-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4688-279-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/4748-275-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4984-139-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5484-276-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5608-277-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/5732-154-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/5732-425-0x000000000CF70000-0x000000000CF78000-memory.dmp

Download

memory/5732-190-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/5732-170-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/5732-278-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5732-421-0x0000000140000000-0x0000000140179000-memory.dmp

Download