884682627ab820d4909ce137e55613b02beb6e5f746d279c42bb7627c6c4f3e4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e29be0c498b34367a1b66f318637e264_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Size 4.5MB
Sample261027-e4ppaa1wa1
SHA256 884682627ab820d4909ce137e55613b02beb6e5f746d279c42bb7627c6c4f3e4
MD5 e29be0c498b34367a1b66f318637e264
SHA1 35be131ddde61b6c78f7b0f4297bb642e00f8b7a
SHA512 c679afb69961b2669e641a42deaf33c8a984cab57969f8922f26cbbc51e5a21a439fe902d7fa303210c406a95f4a387b7f857209c43ef41a270844d639e57407
SSDEEP 49152:eK+ApkBqsRqeKdzjA9DbKcM3GHFSanKy0qErPJKUfOkbSICcIFwC0KHLotxIRmBH:f1SC13GosyVbgzFrhkdV7wRGpj3
TLSH
T16326BE13F2D901E8E0AED1788B6A8232EA71BC45CB35B6DF065076251F76EE45B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4468	elevation_service.exe
2868	elevation_service.exe
1136	maintenanceservice.exe
4124	msdtc.exe
884	OSE.EXE
3740	PerceptionSimulationService.exe
1732	perfhost.exe
2876	locator.exe
2316	SensorDataService.exe
4620	snmptrap.exe
2224	spectrum.exe
3864	ssh-agent.exe
4692	TieringEngineService.exe
964	AgentService.exe
1092	vds.exe
4932	vssvc.exe
5040	wbengine.exe
4052	WmiApSrv.exe
2260	SearchIndexer.exe
4264	alg.exe
4580	DiagnosticsHub.StandardCollector.Service.exe
4316	fxssvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-26_e29be0c498b34367a1b66f318637e264_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-26_e29be0c498b34367a1b66f318637e264_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_e29be0c498b34367a1b66f318637e264_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_e29be0c498b34367a1b66f318637e264_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_e29be0c498b34367a1b66f318637e264_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\20b871f85ef7726b.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017bc8-55.dat	upx
behavioral1/files/0x000100000001703f-54.dat	upx
behavioral1/files/0x0001000000016ff1-53.dat	upx
behavioral1/files/0x0001000000016ff1-418.dat	upx
behavioral1/memory/4264-426-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/4580-450-0x0000000140000000-0x0000000140166000-memory.dmp	upx
behavioral1/files/0x0001000000017bc8-434.dat	upx
behavioral1/files/0x000100000001703f-432.dat	upx
behavioral1/memory/4264-493-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112140\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112140\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-26_e29be0c498b34367a1b66f318637e264_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_e29be0c498b34367a1b66f318637e264_cobalt-strike_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7e93bdccb65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017a8dbdccb65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bdf6edbcb65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000222bbbdbcb65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b9911decb65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf53a3dbcb65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d45ef7ddcb65dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f30595dbcb65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b25f51dccb65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd1b89dbcb65dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000612c9cdbcb65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5d5edddcb65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006aa473dbcb65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe
2868	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	900	2026-10-26_e29be0c498b34367a1b66f318637e264_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Token: SeTakeOwnershipPrivilege	4468	elevation_service.exe
Token: SeRestorePrivilege	4692	TieringEngineService.exe
Token: SeManageVolumePrivilege	4692	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	964	AgentService.exe
Token: SeBackupPrivilege	4932	vssvc.exe
Token: SeRestorePrivilege	4932	vssvc.exe
Token: SeAuditPrivilege	4932	vssvc.exe
Token: SeBackupPrivilege	5040	wbengine.exe
Token: SeRestorePrivilege	5040	wbengine.exe
Token: SeSecurityPrivilege	5040	wbengine.exe
Token: 33	2260	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2260	SearchIndexer.exe
Token: SeDebugPrivilege	4468	elevation_service.exe
Token: SeAuditPrivilege	4316	fxssvc.exe
Token: SeDebugPrivilege	2868	elevation_service.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 4724	900	2026-10-26_e29be0c498b34367a1b66f318637e264_cobalt-strike_icedid_njrat_ryuk_satacom.exe	85
PID 2260 wrote to memory of 1212	2260	SearchIndexer.exe	112
PID 2260 wrote to memory of 4156	2260	SearchIndexer.exe	113
PID 2260 wrote to memory of 3344	2260	SearchIndexer.exe	122
PID 2260 wrote to memory of 2000	2260	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e29be0c498b34367a1b66f318637e264_cobalt-strike_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e29be0c498b34367a1b66f318637e264_cobalt-strike_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=156.0.8078.48 --initial-client-data=0x268,0x278,0x27c,0x264,0x280,0x140316468,0x140316478,0x140316488
  2⤵
  PID:4724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4124

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3740

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1732

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2876

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2316

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4620

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2224

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3864

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1348

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4052

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1212
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4156
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3344
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:2000

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4264

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4492

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 20bc0d41154c238145d755e9cb4bf0d1e09f6126cbc1b3395e0a9feceaad71c7
MD5 a8b9087b81488326dadfc26a189d1b1c
SHA1 7c3ca824616c5546449289e1ba81aa77a1b3b7de
SHA512 5bb6ca3c6e10391eb6b105857f1b17c79581fca16ac6f70abe62fdbf3e1479d22f20a384dae4617610ed85f48e78ef423147ec4f58df543f4fc032f72b8fbcad
SSDEEP 49152:nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnsLNiXicJFFRGNzj3:V3q6mjB37wRGpj3
TLSH
T1A0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 81a692f22fa9c66c8805585150cf3e3940d6bb2df72649e5955fa78fe6803136
MD5 8bab96d5552ef1f46aa0cbc8e0e75398
SHA1 8e3f9c7c434c354774231c370b9076da7e67862e
SHA512 8986b8a6159f68bf3403f7305bccb1db0b8a5eb51c7917399951e2263dc738106b3728b5aff0bcff313eaee739155718ec1f1f6027df97b264e3f78e0ecd779b
SSDEEP 24576:zXYfDtczAj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Wtc+LNiXicJFFRGNzj3
TLSH
T18C75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 98306d130e112be13a49985ecff4a9fad96cf7ba6534feba21c42a5ea9d9d820
MD5 ecfec9f41f50d1a54b30e858a4e6470c
SHA1 04f5c17f0b906eba5c7941d119cf71e9dd437584
SHA512 d500d1a7af9dd177a7402631574ee7adf64721b5ccfd44d30e4c1a73461cab102048a35cdc4729454253742e7dcaeffb7fa764f10ae5de97a7674b132fa73191
SSDEEP 24576:Q0Le5ji0hmxhrMk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QPji0AzZLNiXicJFFRGNzj3
TLSH
T1B3859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b59aa1f62f222a5788cbcfbc6bcb53c49797c7d78d45b580add215a180b8ec8a
MD5 24af2e0359018de6556794e3e2659489
SHA1 66d45c8bbfc8331c6782d12dd48a7e1db9365820
SHA512 e0635be888db84ee4dfb450af298590d66b3041807dd32da734e74bf11591ee9ac88e495dd7bf14f63733a768246471bc8a8cd0d58486e8dad78a4e9669a5dca
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWj6q8wyuO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz://ezSC6vUzPv+HjyFLNiXicJFFRGNzj3
TLSH
T18E756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 637e9d365049317f24a8c33c61556d5093b8b5754b155c2a6bc4de96a237f9ea
MD5 3fd16f8f6e7e93800753df44fd6b9e0c
SHA1 dfe92c0a72072145f30fd98a471cd217a43ee852
SHA512 5fd2f3da3bc1da24be0f84ca1b1c7c5e084f9dbccb42247753a7825929bbebb0f7b728a468177f98921ad270557f01a154343a60b9ccb6e06264af8fd5379475
SSDEEP 24576:PVbqPb88hv/l+BH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PVO88hXl+5LNiXicJFFRGNzj3
TLSH
T122559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f96e9cac3b66da593db9ee02ba0f7960d3943c8beab432d44bb2280bc310ce93
MD5 aea13f09f38a608b91b05c89e13827cf
SHA1 fc7cc7e90c068cbf70974f7c08bb2561d5a30fd8
SHA512 178b42b8b1b73b5c717b92f60b2011f64f576a0dcda4179bc4b1a277d3e2e787a58d0e94fb1804d5fcd5b7ea75e49d40bb5bc77d3ae27f9dca1b0ae65c282f0b
SSDEEP 24576:BGI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jLNiXicJFFRGNzj3
TLSH
T1375523D3468854B1FBFD003A867A5828B5845E2CCA555DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 45b616e747a8466912f484cbce098b870a203ffdbca98a91ddfe579c083242ed
MD5 12ba01a61e46ab3478b522caab1ceb14
SHA1 50ffebf172d2af010896f37ec9e7ac957c79db6b
SHA512 be892fa650a42ded86aeb81be3616b6f239f14eb52e52aa0e015a4997784d11644184f1da8f3a5217870ad0d99605b270bc9c017596a51e37abe1aa7e248bf14
SSDEEP 24576:xJIUf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xJIUfLNiXicJFFRGNzj3
TLSH
T1EB75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4b3e75f99b722131e7f14f7637ceedfd905d67ae451a878329f026e43fde395b
MD5 6c2cc37afea7094b9638c8ba9c3ac3b7
SHA1 70b8182f7d69a4c4b7cd9e5e5e10fa3af9b14c37
SHA512 9fa95f358bb491071bfe4fe0c5fd0af584a5d8fc34b2240c9b3de2bec5745c9dac074a8a2a162597dec189535ea8f70e115b52631f66f79e37fff0a2f7b116d3
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH7:6QvGAdlCEL8c/WRNw5Ce7wRGpj3
TLSH
T14A266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6807eca0c13b85137624f0016937a4d95fe3f5adb59a45370da8b9e8c39b197b
MD5 f67eda7caa6609675c82ac182083287d
SHA1 27e66983abfb67bb529edc4f364be23652ef2f63
SHA512 4b40c3dfef80dd848aefb3b655d15d4594d1dbf4e0bfddab7f3fdf3a0c4fd7450fa434bb793493437c0177367a17a29edb3468ccec852abeb7033ed59c57aed4
SSDEEP 24576:QfewsAjp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6ljpLNiXicJFFRGNzj3
TLSH
T18C75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9fdb241ee2ec43da6b2c2a1a8a8e99e9e41fe3617cf4f378de892618e8b822df
MD5 640e474c56f387e8535eff976cf52c30
SHA1 63862a9a8967239bc9eddab486f79991742fcd37
SHA512 67127f4d00f5a9ecc2dd6bd5b38833593c390d5158f3d15a63286467b9361620d6771541637a4ff3c66f946af9a4db2570e396f19d91c0f6df16cd60cf5738db
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHVF9:gUEtQevvqc2W1cpV20I32L9
TLSH
T134474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 529fc5996188cea2fb077e1802631de4872fc9cfe9754de92eaa56693b1c2e3a
MD5 b381592bd63d4c9a3b1bcc536b831056
SHA1 7cbd534942ff72c7cd7151d986bdc2a4f25a1f95
SHA512 ccdb2f8069c96c5b4dc4c127efd70a7cb3375ba288c9017fda44f54a254498b864a47da86173d61973112f4ea74e8938251e376e3a2406788cb562b30fe88db4
SSDEEP 49152:RCbRquA/m2yL5zLfFiV+XenmE3/zJLNiXicJFFRGNzj3:eoq2Vjnm67wRGpj3
TLSH
T1BAD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8fe3fce3a1965f2676c7102d9ddbbdc5d0310eeea18686c98d4c2ed46826a5a9
MD5 1855ac85d9183cae0c61e541254cbdb0
SHA1 af18764a43bc3b0ec3120a93f594309e20eefb04
SHA512 ac84da4031d6c254fdf62ce36c42665e35de7a4d92c74481bc9883315facaedb7ffd9c404175f1f3179fcaab03206b5783af4002d8fcaaaeb6d69cf0b2f73e73
SSDEEP 24576:bAhGL6IFoiwtA5l7S53a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bAM5Foiq5KLNiXicJFFRGNzj3
TLSH
T1A1359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b2410c4e5ee2342be76202223f50a128236606500c6e86aa04157c996e119f0b
MD5 a8fddbe69f5c7cf3bc2e55723242d010
SHA1 54da0d975be55264ac9a4e02b9e477943c35ae08
SHA512 ab82f8448c6cb0fa097748f91134a5029119fe28b4032b816eb22c86731211e3437ce672a3aebba65f416c567563564296b947ec1a6ad3e1bff974038a0f9e28
SSDEEP 24576:XwuROWl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XwSOmLNiXicJFFRGNzj3
TLSH
T1FB65F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7bad693a6a7ff8cbdc2f7adfa80174bd5a5adc2bf8c51c0992cd6e958411345e
MD5 e76bc977e24d9a6c935055d436bfd2c5
SHA1 c5f2eae78e6ce08ba0c71608398f911d17523e41
SHA512 e95ebf36f0aeb8c7afe2919f356bbe7ee957175d275867664387fafe197e5ce3e13d062ac97bec42d61581e895b91a2e4d6e2ae537586d3fcc9d3a0a28c0059f
SSDEEP 24576:YZu8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WLNiXicJFFRGNzj3
TLSH
T10E55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1a33431349e3c6aee2076e5a7f3042c62b38739ff1eecfa89cea9f61bd1baa11
MD5 2d307dc63000b152feb174605426d74c
SHA1 62a2bee56b14bdcc46baf492d98e326ea71fc958
SHA512 dafdb93fb40c0589ccd5c439f409250e92e3fc9443b13d28cab3932b37f4c0b92d2cb9bfbd011f70c35ebcda7c3ddea1f4e7875193817fa60b6ce7b4569f8047
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN3b7wRGpj3:qQyiKanX+PNvF9
TLSH
T114667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 441ba50e90c74cf82ff43fd451df7c538b8f96dbdb187b872a66419c6c1b97c0
MD5 563afa1669063dbb343da9745a9efe4c
SHA1 c5706c9a04c90c0a0b3a69fb19dd32e97c6b73db
SHA512 1e98f1f04561fe9140952d40e5eedda248a7ad4a6246b3e7ac4d295310c5a508f0242bece66cd1df613c5d8a90c1e08b9a0fcbdd28324e5cd23dd63f2051730d
SSDEEP 98304:1QRQyi36YOcPDLvw2gAf+PN3b7wRGpj3:MQyiKanX+PNvF9
TLSH
T12C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e81f5c9ed6fd850b984cfcac0f5683a443df5ac2a851bd38136d29bcc4ded724
MD5 41db7e60fdaff0a3cb534b870de0a8b7
SHA1 01746fab0b15da31426939e73e0128913c1362cb
SHA512 fd7e2648edbba8bd59cc2bff6de7f2d39f80d9fbec595a8b9c18d31fec2c23e1c305fb53976fb1b00d3f08f479a928e44012d0e67bdbd6ea637763272aa7d3ff
SSDEEP 49152:i68Qg55nhkeWu7PNU3/ZLNiXicJFFRGNzj3:gthTRc/Z7wRGpj3
TLSH
T1CEB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 989c8d129a6df01c4386b87454761cb3a564736fafb441e8f0583397cef5abe1
MD5 177e972a592d51e10a2fb22ee5ec10a6
SHA1 62a1bce2156c63e167f472842ca0cabc3e0ed669
SHA512 5aef7d8af0e43a78757944c8295d716ab3e61af327e8d20d53db9996e6f676313363a4573e025e259b46eacd709c8df2f70c559b2677eeeeb955a46e3bd36730
SSDEEP 98304:ey5112gYy5azzVvU69nLKnhZI7wRGpj3:PLIHRWhmF9
TLSH
T1A8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bd2029ff3e32b8899eabc10676c86ab615ceec0f07ac94b5fd8605dc7ab40cc2
MD5 64164c615136d9e5b742d4bfa088d8f3
SHA1 2d4a765c12b1d3a9458d1640a0d2f880190e28ad
SHA512 053b04211794a81a27eaf59822428b214f90ffc106231295e39cb3e08d454546ec05da429c707a4ecd2cd3dbd183d2dcc37d34dd5820677b9ad6546f88c3e868
SSDEEP 49152:WB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glnLNiXicJFFRGNzj3:ku6JmIxd2dn7wRGpj3
TLSH
T164D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4011b87ed0acfa5b9f98a50f9cfba25b560530495afed7ac5a852740353b39ff
MD5 71151b30fa41400e9e7b0389ede612e7
SHA1 aed8096c46b641c0e430a1a17de90b92f8dd9b61
SHA512 31028faaad103369034da4122f089e0b640ab4d557fac4eeac92dff4a62c1a42519664b53456a49bcbd7d0cac60cecb414d2dcb0770f556265e2e2485e3acc2c
SSDEEP 49152:t1hpsNoJpF1A67U44CwH7R4x/LNiXicJFFRGNzj3:tmifPqR67wRGpj3
TLSH
T1EBB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3f5324f5933a77177ab5b931421f02c5e8de654324641a81b0e918673e4d1c7b
MD5 013586e3e82e6e22d174f8c0d1ee0bfb
SHA1 23a0ee8040bae41100e2e0f39f4821bb8d4a18fc
SHA512 67465997c0e9179214bdb42ce26ff476d68c3bf0b4143faeaf494299dfe9111fc1e32c6b9f143b48a2748d68bff7a99ab417ad256004e2341e7657989d28dbdc
SSDEEP 49152:dSuZQIY0Be2KkRVtOnks6NMHq8LNiXicJFFRGNzj3:z5dKqi6187wRGpj3
TLSH
T18CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3f4ffce7e25f68e4ba7fad4a82476defb2381eaf5fb4007a6e7326096bdbd92d
MD5 aa6300048003a671b1c2a34d3da5e790
SHA1 b46935bc8a1d2d1b1229d3d1622ff2ca6503e687
SHA512 5647c016d698bab6741be606362db64a65865654f6febee74ead8f2c8492def00df31f5595710338f6305487a25104eda10ad510e864a12d943998b707dfd923
SSDEEP 49152:ihtSn8EApI0figjgiDn0AP5wjLNiXicJFFRGNzj3:DX2iWphG7wRGpj3
TLSH
T15295BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 28fc0a2cab77a10266b59fb5d1d02b585ef7d189aaba1ec97370b704d1fff228
MD5 64f8a0069468189f6541bcf73a6f2754
SHA1 26128634f1fb79e0e4e02cb5e9a6617507e26151
SHA512 21cc5ed1df9566de0953f7f8f871206f4523c4c2a033ccecdccb7826d0beb1102c4c56c6746b8f05ef2859849adc62c1611e5b1b4ac9f357fec2ccd1e5dc3e82
SSDEEP 12288:32iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D85523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 82d2defd51528db63909c058a407e6c08b3291e44a67d2e86eeb4d6376296c3c
MD5 6a9bc880698cfa6405f191d5cc633a08
SHA1 e78f680f2a7eb1d945054bad19cd1a53bad12e44
SHA512 61bcb9f24db4b9b31d3d5ca39e60ed2ec17153efb6378db15cbd5bf4a38f47fb412811eddd1f7eb826d1f3f28bca562ddd69b9959c560131b1be1f106d724492
SSDEEP 12288:ZBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1815523D3548955B1EABC0039C6754428F5886E2DEB5619E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 af1e13c3858944a6c398b02090424c1ea99aa342bac1aa96db6a6a8ff9fad0a6
MD5 c3a721bc1653234c4c0d08161094cd7d
SHA1 46489011456ba4c41dc8bc651342e5a6a483c874
SHA512 58b9a19cc3093e4ffffc6bdd5ee2f788b456c1c4c19106578e61fbaa191ac7f94d46579c956660bf250364e6d5b47708850522d2fb250bb1073d7f855c83b9b3
SSDEEP 12288:/DiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F95523D2558955B1E6FC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 ae4070dad5c11a6ad7010f46b817556b567d97b5b053c54521d5212ed0e10247
MD5 b0f126b4e249e45b7a35814cd296ac8e
SHA1 96d94a365cfdad2d64b617d3e8af43df7f63212e
SHA512 edc37798063716b2ac28f965486ff987b95a32dcff4e4e2415f05813b4f9a889826223a4e19c98ce7c4b59d9eb1e56d402fd5cbc3b957f39a8c37a0b48728ecd
SSDEEP 12288:oVIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10C552392168900F1E9FD8039CA764424F2A47D6CD7325AEBD3003D1E5A75FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 efbbc2a85ca68df6a8cedf6ee5d5250b527563390197afe7835de68d54b6ce5e
MD5 302f088f5334f6b58db96734777ce358
SHA1 403fc261654244508caa4d52b3ae7431d38400cb
SHA512 fa97e16cbfb3286ef4ce2c93beb1959dbdef575e658b33e4a51ea9557a05cbdbb4c1d2754a971c1adb47a53d55d2847371ec6a635bebae9b0cd99d278ea026dd
SSDEEP 12288:uwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ui/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B5523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b5cfcd5d4dfe93717b1489ec65d1809fbd0eb815ecee02b09d5f23ec29de1ac5
MD5 93d93260a56767b96deee1a546e5c137
SHA1 e64e00b3bf152c59659c3aa23d43fe467b139ae9
SHA512 814f4a723f0f89f65eaf18b31947f6177607d016f1a3d379ae6520c6336b63e74b4c009364d3bddfcaa1616142870cef2a248aab6be9d790776ac7593ebe2e54
SSDEEP 12288:IdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523D2558955B1EAFC0039C6754428F5882E2DEB5619E3E2083D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7278c35501888d30798000c53bc9faad552a74ba0f2a94f6a81e991b4a1a03d8
MD5 c341d5bd05a9607c50a20aad8ceba7eb
SHA1 ac09e3e84243b818c037b18f24c59730576ecec1
SHA512 7da5b142246388e2263655b49a0e017872c25b2873ac1772b466be62de8e286982f746d01ec48846f9568807766c9a079bd83da8914e0ad47266a6206b8c0ccb
SSDEEP 12288:YJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1945523D2548955B1EAFC0039C6754428F5882E2DEB5659E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 34b95880af171f314bb3f096ceb6ae25fe7e72db7393d9340d62341be79f835f
MD5 7a3e3ba1234325faa5c2549a78c9495f
SHA1 c74e10dbda855271def21e5b67eb33463df24610
SHA512 020c5754cd8bf9cb61aff88ba6d4164dce3bd6ac2337e53f0781bb18cda521f37838cdea76a1a121719659102d9090aae0454a754c96c3a13d728755b7a25b62
SSDEEP 24576:eZM3zFVSON/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eZM3zfRLNiXicJFFRGNzj3
TLSH
T11C750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2f22996e0ff001a66daec7f5a1f9e6774783eeeb6e2a6f446cbd6cad0714d15f
MD5 77cdd7e9816330765a107cffab1407d4
SHA1 93285e472cba6a0f6b6ec5672c91af1f64850d4a
SHA512 be35f40ca4573cf4dc16367195db1c1bc92b320432b72b42042a5ad54c226e15111d20f3cd154b10c571eea89b496bfb950504977f75f8a55443fd603ef6ef84
SSDEEP 12288:eKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17B5523D3548955B1EAFC0039C6764428F5885E2DEB5619E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1bc6b6c1e634bb5330cddb3b680c57f451b986cf0f723de6e998993316a4f9c2
MD5 1e8b8528aece1ecc89cc291df576e527
SHA1 8b7d03ce2420d9d135d7db5885871b0cf32c3a5d
SHA512 e7bf91c91a74c442102f9e43736743147eb56b41f499733d9da107336e13e629760cb151e76b98677b6c4a6152f05f279ab9703afd3f1d6dc038cd0a23e00bfb
SSDEEP 12288:wuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F55523D3548955B1EABC0039C6754428F5886E2DEB5659E3E2083D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ba5920e0053c56295925da8c79db227a81ce8b37b605cc2c50795107e934860e
MD5 1917758ab8d9e49640943cbc060c68ff
SHA1 4392c700c6427064d1ba702a5599ed744d11a761
SHA512 c4158ff2d89ba23236b0676931e5e6909800668ecb16c84427001a5dfc43001979e2509372a93b50afed2d5f88e9ebdd0091326609e3d4c7d62264213f2639cd
SSDEEP 24576:mcP4mcvIjkGOxhKP2l71nNKbrh/8KBU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hP4m4IpOO67W8KeLNiXicJFFRGNzj3
TLSH
T14A65AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 f529393193c0bb8b2f96f317b45e796836d9becdeea33772222a54b95f4cdd1c
MD5 082e17f475672274fe1dd25a1ab659f6
SHA1 363795736fe88f620d4f317dd41692aea1764468
SHA512 82c5bb1d6e2c591fdfa31f600c21327c73217937197d2c28b6033216f5336ea089f831e5563833c09b6739a90c8904f6abce5785620bd571203d9d1975c3b36a
SSDEEP 12288:bpsfaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18065F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4f187ee76efa86dfa00321d738bd48a92b425d6e5703d53342b3b37453fc21c4
MD5 9d440a64f870e8dfde0dcccbe2fc6c4b
SHA1 9fb025573f4cf4d192e3870693ddc5225535cadb
SHA512 1160bbfbcda2131aa3c484443b4b018856431f283a5ef14fdb6693ae5ee3920baae96bbdf393ca34069759840098de2feebea40a3030910208e8c4ca4bae5167
SSDEEP 12288:d6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D552393528C5562FAFD1039853A8438B5497E3C9F5599D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a5c3f331f99132e326b551be07619657c6691d4ae6c2bbc31cabd4c018c11c15
MD5 a007751cba8c617f0c00be6d9767704b
SHA1 7be22a59a389de0ede22dffe481d53de2412913a
SHA512 caafdff88b692957569bef93b806c46fc12c24b7c041e6cb5df958893651864146ae3962ae39ae90ee993b67870f01f4464ca761a815148f948b90c5bd13af53
SSDEEP 49152:Fa0h2GEkuAe73q3pp46zwwQiLNiXicJFFRGNzj3:Fa0hNYG4Jwx7wRGpj3
TLSH
T18885AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 e54cd396710ca3944c45fd9fdbc6b62249fce492ec35c972eba2c1ce9618885d
MD5 cf5e2b03b644084c241f13de43290172
SHA1 282f714701e68ecf7bf4bb67dceaebaed38247c3
SHA512 dc181b97ebba2f662ab242729c89d04c0a6037a0364eac434a528e8f2d4bdc931056ee99e578e857c613dd035594fe532f65b024dfd6fab77afc97b70d686f89
SSDEEP 24576:thbHjPlPVMM7m5AMLtVM9xkSZikEUJKYEji/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:thbHjttxIRmBdpUQLNiXicJFFRGNzj3
TLSH
T11965226A13AC20A8F671E43D8421510AD7B1BD28472673DF62C9913E5F3BFE94D38A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 cfcf2488a9e8537d78eab871fbf23b33d2e13113c435ec9b2b9c9eda1b354be2
MD5 cc7d4ba2f42b98d3d79c3c8c08c408f0
SHA1 488d5504e7b21620e9fd6a04f6deb18c33231735
SHA512 46293ca976075e1024757d858629f22100d3d585963cfee4fb23d8035d07a623c0687550d0e75f8023c029e4f4f59ebfe68bc586ed0f8f04eb8d45296900b9bc
SSDEEP 12288:QeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BC5523D2518955B1EAFD003D867A4428B5886F2C9B2619E3E1543D1EA27CFEFCF38163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 74ee0002eaeb46a06a9821861d5c1b55b1fcf4d8d9dd9cd0f10b82a34efc0e97
MD5 9bbacd2aeb132beb9283d6db28e9bb56
SHA1 bd027b0312ca2f4ce7cb83e777c68ea6fc2dbe9e
SHA512 abdf8ae42a2d20574f423fa819d037ac0cfee82d713eaecc8c07fe10fc51e4286709e25d6363ac5aa81b224501159f8443a4db2559059575cbb9d0179f2fa4dc
SSDEEP 24576:AAL3UTj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AAL3UfLNiXicJFFRGNzj3
TLSH
T15B750155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 78f24a9779f29587b319c825e1c60e783a6261563fa645b18cba881c61735a0a
MD5 7b21cb8b9a2e9f8731fbf0efcc940fd7
SHA1 7dcd362143b4bffed7e4f3dbb0f2b651968329b5
SHA512 9957a6ebf3c7539b20e5c61bf9befa7ccfaf8e0ae0ded46fa48178849fc9bd995621cddd4c0a88b2e9a4e42cf1be28cf9bbfab6d544dcc3a383f0097949385ce
SSDEEP 24576:oO//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oO/LNiXicJFFRGNzj3
TLSH
T10355125A32DC10F4E579903D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b1dcc4696d20ee989dd2ca9ca070c37d4e01f7d46b459cfb8d4901fac8acd369
MD5 8ed9e5eef0de04cc14269108ffaddd37
SHA1 bde69cbdcb572442ed060fd5eaf205ed3e9b66a4
SHA512 a2b4dd4f1d3c8d1157868efae865e03ce76094b36bbccc176c34ec048b1f896a5208bd42e2e206fae5390468e7ec4ca788cd4b0c68fe947134db207dbde2d022
SSDEEP 24576:37NM9YqZqmWMUkPjZM48Mv6bEhsM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:37cBWMpPjN8DbEh9LNiXicJFFRGNzj3
TLSH
T10465AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 870232a12dccb393ee37b6345f2120531ae5ac29326cd3aeeafca996f80db1c0
MD5 e764be8a9aba94bbbaaad7a88aa746c7
SHA1 d0d66dab064aff2b1ba37b81b862904c3040e06e
SHA512 fcb63986c80db7bed7178518364514f083346f6eb3577720851dfa5bdc2ba8c65ac9f7e64817fff3b3e9dc3dd50d1e28dc32903596ecb2152cd7aaf77d345df0
SSDEEP 49152:gF2YuHNETovAvNYf8kmsLNiXicJFFRGNzj3:16BCf8k/7wRGpj3
TLSH
T173858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 d1227d5b90133996c805fa129c81e07856ed9dca4f171f080c48c86184319122
MD5 1bfe88ee5e57e65e0c12292e468749dd
SHA1 4968224ad3c2360a0248f1b1438a91fb7ed5eef0
SHA512 d703f4e5eb6ef9ed4b3c622371994cc800973377de127c3be7632835b015a52edb009a80b71f5217dfb0e6ad69b7cd48e3d7b35599ab4ef9c9feb499f01421f5
SSDEEP 24576:HAFs06+Omlf8NXEbTo7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gFs060loXuCLNiXicJFFRGNzj3
TLSH
T1BD65BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 2e252e2e287ed072b361ee1f3f09997a84b770ebbd93bd43389446c3eaac94cf
MD5 bad6defaa393e6ac9f33a4ff457271f7
SHA1 e847ec4d5c63375ecb35875f9631ad0766f2190f
SHA512 7badd17f8558bb565fa2c4e91619340caa3ff518719cdc24544eee08b82e6526f4837c4b6314f1d27d553d306fb51688faeefc8cf2b2976107fe81d0d6e8d998
SSDEEP 24576:lJnJ5D3WXC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lJnJ5DGXCLNiXicJFFRGNzj3
TLSH
T1FA75D02DD29810F8E4B7C274825A1655FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8924df2ad1dee10efe65c2b351b2cc9f8708e7e0e35345e6ed72e0db0e71f6de
MD5 ff74fe8105a2f29c6ced5215334d3678
SHA1 f2dd8fc7fe06a79c8a0aae8534cfed127d8b6736
SHA512 2bedec10a63b5db30692287b98010067e9e41fc44d92fb428aced0cb963231d27610ea80b9f3e15080fdb31e033a19a54264d8bcddd06ba485be4c2d64f1b616
SSDEEP 49152:3g06DIKdwc+eQnSt65aVALNiXicJFFRGNzj3:wW7wRGpj3
TLSH
T1BB956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 32ec1a34fadf1b8a48c239cd06713db6b9ec4b69e133039eccb8bfd87ae65a53
MD5 6789faf5a3f4b81f03e77b7639cd1c53
SHA1 95999e98da70000f5fcec4eda450aa1417b18648
SHA512 9da61c5ac047e0101129d06943e8f171f8d19a606b2590e7995d699fd04c37ad40371f6adc717d60dfe97a11a2d2d82256d86da2e1dc8a68c5bf07cf4c2af554
SSDEEP 24576:CpkPVMM7m5AMLtVM9xkSZikEUJKYEji/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CpktxIRmBdpUQLNiXicJFFRGNzj3
TLSH
T183652359239C60A8E67AE03D84204148D3B5F8349B2237DB51C9D13E9F77FEA5E3CA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 743339d15e22a50f42461bcf6b9c52f67338bd7ab9ee913a2dce9f0de8bf0e5c
MD5 2739b58b74105ef0af317ae95162b2bf
SHA1 8944eb9a6afd05c7e3f120adcfb23d64f7e48b7b
SHA512 9750f9d964b881d3cf4f9114aa493c6bc841dcda8109df77db0d0eb03436369013a4f7dea7f73a27b4214c75fd9a9a7ac3ea6fa9d2035a151e4eb53bd585d8bd
SSDEEP 12288:mEP3Ri1DiCZ6jVRjKhCf0Km5lQXZKWKG4WiHLgiGHt8aQUZ8+CjSZ//yS0SvcNUf:likPVMM7m5AMLtVM9xkSZikEUJKYEje
TLSH
T13605122D27AC70A8E626E43D84614249C7B6F0309B6237DF56D9C13E5F67AE91D3CB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 627edf12f18f09ef1a5bd1768d6227e6f108adca9299aded5fcba1af2b1b4be6
MD5 522982f37a845dcc691821b503914e27
SHA1 2754ff14c011f411b0b572713f15ea8f4f8da3b6
SHA512 7f65c9dc6f671e0ae2520ca4ca8b2e6427331c38382c99117bb52459b1fabea2abecc5d32b9821cf788bbfca4682d8cc7f0e692b75b14d6bbecac3e7f80ff71c
SSDEEP 24576:NIyt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NIyLNiXicJFFRGNzj3
TLSH
T10565124553C860E5EAB9013CCA774064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 567c84d2e349699fa42e5100843e73973cb6dad724b914e003f05bc424a86c66
MD5 77a9f6a0487c311861deeb1af875647c
SHA1 323c008480f162e70e240af9aa9ad8cbd935caef
SHA512 af1bbb93523dc2e49dcd021952b8f5a3ad0d57bb48a0fa90634ad2a3ff86b64481c2c563fea1e8ec9deb6360abf64f12f09c1ce121149ae1fabc065cc46d036a
SSDEEP 12288:yybiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10055239A118964B5FABD003D86354824B1943E3C9B1618F7A1947D3ED339FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2950e73eb9c385c25bd7adc1e37a567acefe8377e5e5bb46e34470ea844c6419
MD5 d731d4b97dd5c426779228b4f91dac2b
SHA1 567719b307ca150de61928d9421c0b25fc4436e2
SHA512 c6cb56e28c00c1d6c8d3e7f2731abf1702537d61ffd7e7b48b8de8d94c4bb9b156557e2f21b4a1c2b8a486a78fdaff8b650445ad0dc74ff25d68f6d636f3c94c
SSDEEP 24576:tQ9MxZKdcz9dw3E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tVKZELNiXicJFFRGNzj3
TLSH
T19B558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 8e27c6055ddc1c74be3f76789e06245496cde751decfd00358b18f588eaa0a68
MD5 b1b44e78b64ebb3a54d711712f528110
SHA1 226c6c7a92d88a7c2f622a7626b84110e1cc245f
SHA512 06de6612f891bd84dea57e26317c62be4f2b14bb82d7ebd27557a03ecd569397c107c631d663e96c51e28ca480df4bb13ad62019dfd682e43183f4a8d3196d6d
SSDEEP 24576:fyocDApp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aocDAppLNiXicJFFRGNzj3
TLSH
T11C65E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d88e13e4902523162105779555b74e0ae2690ced49053817e9cfd5e9b354adca
MD5 6107a2582ed5112cbad4d97f4a84d171
SHA1 c5e43d0126baf15678c01990f5b26d9689c462fb
SHA512 c3c0f1337e00a884d60ecfa81822bc5b8ac586cfae6541b623ef8ab543dc809d4bb92b7a7b8b8062dc92b7f8d5bbe9aa0cf2abea2e4ce5ec024c4f76a7257878
SSDEEP 49152:PWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKpLNiXicJFFRGNzj3:30zuNIj7wRGpj3
TLSH
T1E2A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 01fa2cdab0140ccebf3dbd45f47311c9dcc80cfe79c8d05c03e3899a1ec1102e
MD5 4d32af919251601d4890c5d10c8cf719
SHA1 294894d0d6269c71d5ba2208558972ecc81aec90
SHA512 0810779286f91296bb5abd96efa3adbbecc792c9efa48489503e05e0ccb2680cd839c8df7adfac3713d2acf14a67e7732539983e1de5d748ce24ac4f61386e69
SSDEEP 49152:MTDxR+N5YzTfjMvtxIRmBdpUQLNiXicJFFRGNzj3:Au5ukdB7wRGpj3
TLSH
T1C3A5E22E67F815E9D1BEC5798A238512FB727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 d9845b8f7ae83c45e70786e2a3b4815cfc1f267248644db7f621a83d9e5ee7ff
MD5 9bdb45c5c75997030bc45e23f397a6a2
SHA1 3b6a26335120848160198f5ce20bbe41d9fb8e45
SHA512 c6fc88b5b75bd029dabfe18feba9812660af58646f1f03a1e4c1f7b7af8e5885b3c3216529bddd7a938579da94c0cf52447bbd166c16638942f9aba230b40f55
SSDEEP 24576:51QT7EcpfxR+N5AWAz3ooiYhjMqbePVMM7m5AMLtVM9xkSZikEUJKYEje:sTDxR+N5YzTTjMvtxIRmBdpUs
TLSH
T1FE75C12EA7F815E9D17EC5798A238512FB727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 5686218fbe44e573b8cf80a58b7439ee9d2d05395edb3bdce740830e5248d1f8
MD5 633e30315d54a0d2534221f6dc5ab883
SHA1 a3fe274cff8943d6231a913f522ef7c31488740f
SHA512 6a234d789aa6f472a062f9658b9be8cae2f8e41a3f555f37d000c1440d5502b7c06696b786142bfe7ba5bacf58a40d41bd60713ca3a9f2b5ca6751e61e2d4f2e
SSDEEP 24576:XhbHjPlPVMM7m5AMLtVM9xkSZikEUJKYEje:XhbHjttxIRmBdpUs
TLSH
T19F05122E13BC2498F672E47D8461564AC7B1B8254725B3DF22CA813A5F27FE85C39F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 d502e71503a2425c82bdcc8f326fa264fa504bd658e2e748ee5d95e433bce80d
MD5 6e91bcb47422bfc92b2d2feafd974e6d
SHA1 1066f608ee97438c38027253a8c5959c45e8280c
SHA512 79065fe5a1a423ad2fe20410b131e7f8faebc0e92569e54e8cd106c16e7686d2983102558d9a7643a43d27bca655da4a102162688f6286125fedb01b0b2b081e
SSDEEP 24576:tTMdOz0FFS+UmSL6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:X0K+UmSL6LNiXicJFFRGNzj3
TLSH
T1D375E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20b871f85ef7726b.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\20b871f85ef7726b.bin
Size 12KB
SHA256 af691bee4f5547a03f14b0b6d775f438ee504fdf1d33dfb66a193baf209e56b8
MD5 fd8411b4c9e720c3d1b143953dc8d1d1
SHA1 90c6206e1280096263198b618c1eccf99c766e5c
SHA512 fc2c1c63a0e20039433cd9550d8cfd88b1e6921219fe520af3dacd420d9b81376f78393563e1a7ba4977107564b8520bd6cde14566b8c65fb727ec0e614af0f4
SSDEEP 384:BI+CR31U4/CAQUa5UCv44VUEDjA0R4rfSkCcEpMJ7qjF:BPCRhCAQUg6EDjA02rficNJ7qp
TLSH
T1C242C00ECB5B9904DF265180C82E304557389F3342B5E6E44799FA97A6D253DC0FAED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 645bb692808e4e4929f3017662fba1b65c55bb77c3d87b0d31e81f3790e5ddba
MD5 0f0a8ae6b434d63e3c77a500eb4399c9
SHA1 f9ac6c582b05fcc352ae4b067c8ec3940e99330b
SHA512 f9aa5c725224e143036d8e97927d52b2db9941d2b923f8c23cf3642d9381c5fc4877cb136724aba868d8aacf2e92602cbce6a449c7c5865a7e6f950c4eb0f4df
SSDEEP 24576:V3YgnJcRTk4yti+R5dBR/i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VIgnaTk46pBR/iLNiXicJFFRGNzj3
TLSH
T19C45B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 56ed632b13af1600f18744a75d5c3604972b411320c7ab9c44d7df1eb1192618
MD5 4c8bfdaa06a15c50f7c640b486239bd9
SHA1 597f44830d0c6c79010d0a87b403bf3684317d6d
SHA512 f2337b3ec2fd9e5017c9b3f81ac0040210ceb7163726c8805f54f937f77c66ee4e365ddc2f142d4db2e4fe3a5d024beb62d6dd6ab0c2c761fb22fcc980466c00
SSDEEP 12288:q4KXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F155125A13D830E0F5BA5139CA364014E660BC3957255AFF31D0A97E9B36FDACE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/884-98-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/884-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/884-170-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/884-92-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/900-1-0x00000000021A0000-0x0000000002223000-memory.dmp

Download

memory/900-51-0x0000000140000000-0x00000001404B2000-memory.dmp

Download

memory/900-9-0x00000000021A0000-0x0000000002223000-memory.dmp

Download

memory/900-38-0x0000000002D80000-0x0000000002DE0000-memory.dmp

Download

memory/900-37-0x00000000021A0000-0x0000000002223000-memory.dmp

Download

memory/900-0-0x0000000001F00000-0x0000000002028000-memory.dmp

Download

memory/900-8-0x0000000140000000-0x00000001404B2000-memory.dmp

Download

memory/900-23-0x0000000002D80000-0x0000000002DE0000-memory.dmp

Download

memory/900-15-0x0000000002D80000-0x0000000002DE0000-memory.dmp

Download

memory/964-168-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/964-166-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1092-383-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1092-171-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1136-73-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1136-85-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1136-86-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1136-83-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1136-79-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1732-123-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/1732-117-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1732-178-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1732-119-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/2224-139-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2224-356-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2224-146-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2224-145-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2260-407-0x000000000E300000-0x000000000E308000-memory.dmp

Download

memory/2260-190-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2260-380-0x000000000CD90000-0x000000000CD98000-memory.dmp

Download

memory/2260-195-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2260-229-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2260-211-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2260-409-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2316-131-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2316-384-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2316-189-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2868-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2868-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2876-128-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/2876-182-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/3740-107-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3740-106-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3740-113-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3740-174-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3864-157-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3864-158-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3864-151-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3864-374-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4052-183-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4052-403-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4124-88-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4124-165-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4156-400-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-389-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-387-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-388-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-390-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-392-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-391-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-393-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-394-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-398-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-401-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-402-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-395-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-396-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-399-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4156-397-0x000001E829AC0000-0x000001E829AD0000-memory.dmp

Download

memory/4264-493-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4264-426-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4264-425-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/4264-419-0x00000000007A0000-0x0000000000823000-memory.dmp

Download

memory/4316-462-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4316-492-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4468-43-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4468-56-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4468-52-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4468-127-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4580-449-0x0000000001230000-0x00000000012B3000-memory.dmp

Download

memory/4580-441-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4580-443-0x0000000001230000-0x00000000012B3000-memory.dmp

Download

memory/4580-435-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4580-450-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4620-136-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/4620-332-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/4692-382-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4692-162-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4932-385-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4932-175-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5040-386-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5040-179-0x0000000140000000-0x0000000140216000-memory.dmp

Download