862dc6e96c9cb09320855d60b895792a5ec97dad344f55f95632807b06b5704d

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.9MB
Sample261102-nvkteaeh49
SHA256 862dc6e96c9cb09320855d60b895792a5ec97dad344f55f95632807b06b5704d
MD5 af291272de2b35549e588b2db581903d
SHA1 878f6676469b0062ee9f8bc115626955653f5d30
SHA512 aceef9185f78e650ce8c29873c489d6b5b8c7c19005eb8c5130be5e0bba62e2f8f52751eed46184c1b1e280029d250232ef43d268b1800475e4f6b832e3b1a71
SSDEEP 24576:CvH41soMoAXDNiaGGbCeyNtDPAZRUkYagJstji01sk0wuqsObMnQ/tbw/2Mkjy6+:CXzNiaBCe8tDPAZBe7lqs1Q/lFTjN4
TLSH
T18295BF1BA29781F9CDA6D178C852CD42E632780543518BDF22A0935A7EF76F04E3E778
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1228	alg.exe
5436	DiagnosticsHub.StandardCollector.Service.exe
5364	fxssvc.exe
2432	elevation_service.exe
5476	elevation_service.exe
2520	maintenanceservice.exe
4780	msdtc.exe
5996	OSE.EXE
3180	PerceptionSimulationService.exe
3536	perfhost.exe
4268	locator.exe
3780	SensorDataService.exe
2756	snmptrap.exe
3172	spectrum.exe
5228	ssh-agent.exe
4648	TieringEngineService.exe
5008	AgentService.exe
3976	vds.exe
400	vssvc.exe
5060	wbengine.exe
5252	WmiApSrv.exe
1692	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7f90e8d9227ba850.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd130d5abf6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009437525abf6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9f7d25abf6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb29e259bf6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031ff185abf6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b4b655abf6add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e97efb5abf6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ced36e5abf6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e03bf559bf6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5436	DiagnosticsHub.StandardCollector.Service.exe
5436	DiagnosticsHub.StandardCollector.Service.exe
5436	DiagnosticsHub.StandardCollector.Service.exe
5436	DiagnosticsHub.StandardCollector.Service.exe
5436	DiagnosticsHub.StandardCollector.Service.exe
5436	DiagnosticsHub.StandardCollector.Service.exe
5436	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	5364	fxssvc.exe
Token: SeRestorePrivilege	4648	TieringEngineService.exe
Token: SeManageVolumePrivilege	4648	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5008	AgentService.exe
Token: SeBackupPrivilege	400	vssvc.exe
Token: SeRestorePrivilege	400	vssvc.exe
Token: SeAuditPrivilege	400	vssvc.exe
Token: SeBackupPrivilege	5060	wbengine.exe
Token: SeRestorePrivilege	5060	wbengine.exe
Token: SeSecurityPrivilege	5060	wbengine.exe
Token: 33	1692	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1692	SearchIndexer.exe
Token: SeDebugPrivilege	3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3252	2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5436	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 4200	1692	SearchIndexer.exe	115
PID 1692 wrote to memory of 3332	1692	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1228

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3516

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5476

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4780

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5996

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3180

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3536

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3780

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2756

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3172

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5228

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4416

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:400

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5252

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4200
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b49ce1a36654cc44327eb90c6866e6d2b99917d7bd02b75aefe8b89ed509f4db
MD5 508d5d9806f2fdc78389c1a30cf81d77
SHA1 7be6ad367f5994e2afb7c4388ae61ffdd258be4b
SHA512 6c59ded71dd68db62445d97651038025c3910654fc13b49f9b27aad43751ac77d66a37ad6487112b16625356ba7d45e30f379c596563c91a0a32b88582aaab38
SSDEEP 49152:Gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn/Q/lFTjN4:43q6HjBbLm
TLSH
T1F1D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c93d881e948389fbe1b8364a72afe5bccb5eeb1df318403b671c0d1a771f8c16
MD5 4968e3c6dd2de0096da305c50eba5c67
SHA1 af51090aaec47d1c65fbefaad4b916632a23a86b
SHA512 f7216e580df97be327503ee5a926500a938dd95c153a3333bca5da10a0d730ef01d92dbdc4668ca3eae74f77fccd50286841e1b9273dd6806b3b044198340eed
SSDEEP 12288:m1XLsswWkxy2lRq2czA8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:EXYfDtczA8nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T17F65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3836c0141296adf3b0a09de061d1b467a00c31fb52ce0e3a8c428a9d88091f2b
MD5 6aab7341679901d8214c828e75946a97
SHA1 6d65a2da88dc61d8f06a3e67c3bfb2ffcc306723
SHA512 3508682d91b76a3e22aff0be30abaf42d075d07a5dea5fe2ca07f3675afaa9d5e0c1cbd7b3415315a2c741ff024d39920ebddeeb6f5989f6ec611d6afe6f71b1
SSDEEP 24576:B0Le5ji0hmxLrMnnQ/tbw/2Mkjy6Fr7g0ob:BPji0AlyQ/lFTjN4
TLSH
T12A859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a42f2e64c71c13235732419c5074496053019b0e3badc4b6a6e22123dfdf88f6
MD5 a7d1c1a5910fd2754bdd46aecc28386f
SHA1 270fcab3bb3317a5543a3630ce83acc5394dcfd5
SHA512 ff24ce645ffc746b9a014fc3fe875e6bc8570d23e09b783156fc51e89a2579154cc12414e67981f6cf8604f2a5123b1c8e02a6dbb71c2eb44cca5c68b4df77ac
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWE6q8wyuZnQ/tbw/2Mkjy6Fr7g0oI:0/ezSC6vUzPvxHjy2Q/lFTjN4
TLSH
T142755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dbd97dd97e3061e51dbc8ca0ed779ce2de7627b38da20967f51e78e6d448d640
MD5 5e17c282f232655b045b6e2127ea475b
SHA1 591b33dc6905c5b4f3b015e95976dd5c8788af9f
SHA512 d4f8eb19f4ddff67e986986b3ee2c5a961659ea8735801678352192836a9cdbdba5a8501c781075d041d1aadd0d20e4002a19309f5ed33c4ddc03f755bb9d7e1
SSDEEP 24576:VVbqPb88hv/l+6InQ/tbw/2Mkjy6Fr7g0oD:VVO88hXl+LQ/lFTjN4
TLSH
T12C559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 656a71d6af3b3c00646eabc1c9cd5b454c1444c987e0bffab8047ecdddbf8ae0
MD5 ef75fd03c666e9b666fba6679cc239f0
SHA1 ec36681d9566d644feef54c9e282314409b63d53
SHA512 1319963d43f1d28805e2f20312361788b6cc560d61e57b10d68cb51ed78087180bf3c4094f7fda512e902092076689df7085850580aa66537ca2e1e6af69a443
SSDEEP 12288:zzTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:zzDnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1185523796A24F897FF2B06B15CC284826B7B0EC1BFD4AB4E6744362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 231cb297ef88c1dbc0105045b0d328d264ced0d7bfc532f68399b677bc3e0fd0
MD5 52948b14b7a01a119193dd718da248b2
SHA1 0f0437cb5a2687b46725dbcb01a9075622cede72
SHA512 d31cb40bbb8f98a8268c489b416eb7b1d5155895d4073651ed434ac5566e0cc6c70fc279ee674939b37295329650bab0d48e4979110d9105b6db24e0fe4efa82
SSDEEP 12288:aeBNUbTVO86UQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:aJIUwnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1C375CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4f0534c466ca6e48208c796f3a4268db9583d9a691366cd6c277d1d8fa47439d
MD5 82a49bdfe819f859494629eabfd0796b
SHA1 c20e3bbd37b5e00137ae0e2e58abc646ea2ba53c
SHA512 ce2a61ba38133411383d45bcc3e4dc421e7651d866dd69535b6a84de4eae86e22d4b396c08c94916f004a876e1f7de9d26edc5e9af7d31a84031d5f40e46b5dc
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THO:0QvGAdlCEL8c/yRNw5CeLm
TLSH
T14F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 db2ca8b98ad9088bbdab76ee4e8ef8fce3c98a9ade8d570ab86c268b01b9927b
MD5 eb48d7c1b2d5ba2bd76b624a02bc353b
SHA1 4f619aeeac8238b42f2d605947f4a2d2bce81fca
SHA512 8185754fe33ab819746e0de5199bbbf9e1bc2a65145035104370847787ac67b8dd2032923ae22bf2e6a302d78dcb24f2003681008e128676ce17db1b09ee056d
SSDEEP 12288:MAwSfxL/2Dc39DLLmt0LDQewsAjCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg7:xQewsAjCnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T15775E031FE74E436C77F0DB21B26C706583D6A604FA12AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a5df930278f2c78b76f0a13f0bb9fbe21f67f1974b83d76440fe032ed249ab85
MD5 4f3b25c65caf71fcac8edcff25993619
SHA1 25ee105f95428a867f7e23f78e4a593e42593c29
SHA512 3b3b4c74735b413dde380034458723b1ea698c8c3302135aee306c4b9f28784956e776a343a81902a99f699ddb43d2d8426bb3c5eefa9a36ba2658c568e39787
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVL:CUEtQevvqc2W1cpV2EI32
TLSH
T1F0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 812aab2590492a6d7c5103af3fdd5ad3d5eb51ed11afda000e805264dba4b589
MD5 08f62497efe2cd9b956a844c1927ea03
SHA1 0073b260048834272e53591b8c049f6b3c7aed75
SHA512 b9e27b1186fc8cf1ee596f74b1d25463ef01252bc91f17aeeeee37985dcd720d7b447512d15bbe9599d15258b34c6444b6f824df83d17cceeb332e83183d442b
SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/ziQ/lFTjN4:woqtVjnmyLm
TLSH
T13AD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2bd6fdd703732e27f170534ec1c2e37889a589f6e0dd9ad9126cec43a7973450
MD5 1d20fb968cae5756f2f24277c34e5961
SHA1 a7074911e53d143fd0d6d097ab59366b5978c3fb
SHA512 c5e594f2139eb8586195cabdb2a46c6d5cfb0c4107aa0d1ed4975b386dd16b5a844e3fbdb8e03daa0d7a3a5f7cc6e82699ee27c4217a8a3d93264a27f18e8659
SSDEEP 24576:4AhGLJIFoiwtA5l7S53dnQ/tbw/2Mkjy6Fr7g0oi:4AMyFoiq5NQ/lFTjN4
TLSH
T1AC35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 643c88cc8392ef3cd357cb08c9ca6e7ac92b92b9ef3c52ef59bf29819973f03c
MD5 ba4eac9fb98f0fe7bd58506e956fb982
SHA1 1ddfe5c3cac63007b6ee36e998b7becb0691a9af
SHA512 5b3382244e1f8efece1c82789b403524cf64e72c07437735f9acd92bffae765a0f589d55409d20c99d69fdb3d379019d3abfc5d1b704e4c1b44b21ab9562aff3
SSDEEP 12288:Ymw5HEjsChN2BFgl0WDm+CpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMS:VwuHOWWnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1BC65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 067af0026dae9659783681f09ab4eab161ba0b29190bbaf5b13167ccd2e4e6e0
MD5 a3436d2e4181334671768a8f803edc1a
SHA1 15bc77cc3828ff7bae148c39acbf368d250eae92
SHA512 4e04e32f73145d5fd82349c0f7da8e40053181d7a8e642d9d0615e845fc286d12598f6b70b2d16e636116621c7be307696db86830f76f297d37c1959d94ea218
SSDEEP 12288:mXZ1IySGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:2ZuPnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T13E55126933A4B0FAE6674278CCE28646E773388267B193CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dfa5f57db7bcebe0a9d5d8830af5bf4f66675e5c6d5ce7f787883042211e8b18
MD5 629ec355a4fc5d7b9a5406deaf5a4dc7
SHA1 968ebb23e08c352a09af1780fcc04a43a9dead7c
SHA512 61879e7e63cc6851e4ae3cd0d003bdaded090d951deaf5de6161763a782b219ad61d9bfe83d43202bb32db2063d1776443d41719dd4823313147f2f72ea571fd
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:bQRQyi36YOcPQLvw2gAf+PN33Lm
TLSH
T104667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ad5e2ab1de653ad5967a371bd1332627a4f1ec7b25f3a8ed840537870116e497
MD5 d64ede98392e764ad2f086de8eec0248
SHA1 914247141960e33c5a7d692f09b49a70c5e11f64
SHA512 c609ab14b7b011d6d63d8fe4958b89454e6eb879f7c5ba0df545befd3776e4cfec6f0c10a4acfad5328f104ebcc0730b71ac3c40ff25c7289d5a4c81c931a690
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:yQRQyi36YOcPQLvw2gAf+PN33Lm
TLSH
T123667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 31c72387a2475ed910e7d64a0696a1482affa5de57f87c730205b414797c3a61
MD5 4942388b967a44a0f530ba53e993532c
SHA1 5378deb38f40be717d813f542a7dfe838ffc9059
SHA512 9e5cf2a03dc63a702bea9847615db7d055b345b03b72287f91d2007dbaf7ed08337c72106d1dac5f97d0af8ad2b53184dc7c0b7dbcf54c81d32a701b0530fc21
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0/nQ/tbw/2Mkjy6V:968Qg55nhheWu7PNU3/yQ/lFTjN4
TLSH
T1C1B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 326773710b82a227f0d2931b67a90c77eca1538a69bcf527d80286768554711f
MD5 568f9186f235ea68deb3618d3194b984
SHA1 a46cd9aed537356cd2355cc5353eff453ed12eea
SHA512 6ae0703e47257c515288520bb193bcab7ad2fa96de951db2a95ea142de5af9de9b8637df44ac45aef6fb6981d10d220f22074ac5c0d70544203cf022802fb8b6
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99w:Vy5112gYy5azzVvL69nLKnhZoLm
TLSH
T190167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d042a1b514006e74ca79b42136f4721a4e345171904cbeb3072d6ac1253e3eef
MD5 db018c33d450af9ef83438a5e4207825
SHA1 ae8920f35c3fedfea6740c0d35e4c7d02df85aa9
SHA512 0c3937a60a8bb91c4a5cb92a65f815fcd2e874c71622c61b34b4c39a70d53533f1619097e8290dbb2802a881317f4c5265cc0a5b129b505679f829f2132cb964
SSDEEP 49152:EB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glsQ/lFTjN4:eu6JmVxd2dPLm
TLSH
T153D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fb32d834893c9db3c995072ebcea6962f3262ea071e9f01fd2a416da5dc1ccad
MD5 cdb3ac3d4b37f675a08adada43ad0135
SHA1 50b53561c0cdc9d09c84b1bbe15eb3acd69ff74d
SHA512 d236c72db987e9f417b78aa321b0d31c127519956d28a1f2030d76cee34df8c2924df159a252f9ae407fdfb8772fb9a5e916e7d9a2294076a78dd436771fcf9e
SSDEEP 49152:y1hpsNoJpF1A6UU44CwH7R4xQQ/lFTjN4:ymifPbRyLm
TLSH
T150B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 24ec053c6c169f6756499a24d15fc4746298e09a9c2672f61ae7c52a52caefce
MD5 e2558edc9bf5c241803bac8d0875cdab
SHA1 2feb8e2516c5efd225000706d0de50cf6a43158a
SHA512 1ce8732a315e566decbb3ddc93020d50347caceb834306466d9f81cd1895cc8c3fb71871208ca7a19b1e88e434f0e60c446085819372f828836b991c5db1c61a
SSDEEP 49152:ZSuZQIY0Be2KRRVtOnks6NMHqPQ/lFTjN4:35dKTi61ELm
TLSH
T126C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 061183b3b3cd5192bfd2b7d111633e8e22cb4316973ab162e06d0017da0eb06f
MD5 899af7d9d156479e33cc911f16c0c16c
SHA1 caab10513304c049a3d4fc9db3c6a0142c761f23
SHA512 389d8a2a44f329f29a5df72d156250b628c331811e2f95f39b579d0304575c2e521c5f47ab1f441d1d3125e101de15fb4415467e29b5265731859fce188fade7
SSDEEP 49152:rhtSn8EApI0figngiDn0AP5w8Q/lFTjN4:qX2iyphmLm
TLSH
T14B95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d62310a191af0601104f4bcbbd85e92c866be797ceb3188c4f6599096cf09a16
MD5 dc8aec96897f79ff2f6005e1490021e3
SHA1 f2d42599160a4c10853e74c3e5650655038f9639
SHA512 7411f357cd7efbe5f746a74e660b5c9a6a400d512fea2cfdd66316f6488797ca9655781026ad6037b518fb03765a6faed7dc6c7269b4564471cafa06469f9987
SSDEEP 12288:UbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:ULnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1FF5523697964F98BFA1706F14C828182A77F0EC6BFD1A38F77482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ef4bad98c5bba1739fa951e57ede56ccaff54bec19131e4a037b0369239fd5c3
MD5 f971e8062ceab698e84fb98c7c508921
SHA1 e94c89d24dbbda3c833f0cf01fa728b0dd1d7cb1
SHA512 f59f4f4ac07542b6172ee3d03bdd189d68ef4361e53016b4ab88f873096d2cf7a95ad509725591000baa2de985471ebb947abbef9cbe4b0c18970e798cce6666
SSDEEP 12288:9uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:9unQ/tbw/2Mkjy6Fr7g0oX
TLSH
T11A5523797964F98BFA1706F14C828182973B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 14f94835e9a0d5c3821364f2837cba5a6ecf26d978bf62260b025034a14c6504
MD5 8bc1c888b23bd514b8923d56bcb917db
SHA1 c587524971466343326c9b6b1aeff3be8166e4c0
SHA512 78c2fc6ef2f3a47896cb2e19d901a8e863ca463b91d7769353aa7961e8ce803e26a3145dff26a28a1db208e95083fa454dee614d9df3349f4444dd40c84fa3ed
SSDEEP 12288:g4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:g4nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1925523697964F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 e66bc304f4e6870691248bedb20827e52d23ae9774c9c9601bc3ff5df1a0689d
MD5 36a1d3f073a242ea771776b8a3fb526a
SHA1 fe494ea44ae2e15cf65da78e054d5af255efd7de
SHA512 dd7f79990fea8337582cb8017bb03a5bbd77aa96e63c0e8acecf20e3fa00674a8851da6d9a3d04135ef3f3f9c098b8073bb36d55a01f1caabd5f322a99548ba1
SSDEEP 12288:OVdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:inQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1105523693A69F4C7FD2742B4CC928142E7BB3DC5BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7c87e1cdd1872248f9fcb6cbed03332cd1a6f0ee9c2a115871d63c9c1aefd52c
MD5 7c96ea6af595df588532a210b90ad44a
SHA1 aa269d3711815c3f81d86b8acdfefa8741c9ae61
SHA512 5f6966c56856eab8c9b977bec6bf19594d33384cf55a05faaecd367bcec79ebe13e21fae772ca2af8fb942a06fc32372d61ce2fe058c6f2eb85e438ce6b36e42
SSDEEP 12288:T1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:TVnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T15B5523697964F98BFA1706F14C8381829B7B0EC6BFD1A38F77481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d2da5f6b521040e8483ff623ee39ad145b840a470f10824f2e9c64a46e9da66d
MD5 821b02b153d13f603d0ddbf838e4f19d
SHA1 38319c7d508d6b4649fa52d19e11fe726a7604b2
SHA512 9b1b42090074dbac67289e254ba0fdb69f118601c2abc1d8626b418675f81dcac22901866cb7cadc028bd8eeddde8d1b91d6acea7e73b009ac7c311bd2a3518d
SSDEEP 12288:MqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:MqnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1925523797964F98BFB1706F14C828182973B0EC6BFD1A38F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2ec29f73bdd119392b2717a11ab7f132aa3c9bbe12c5d508381efae8541b5120
MD5 f02b5ca8064bdc07ff455c006a0872b3
SHA1 5a74af620ef5c938948ba23f503f26f730b9ea31
SHA512 c932fd90edf6a988bf8b40e4a9e37aa59c0a2d7d9a2308bf33c17a7f7b159d05d2139080e49a805ef29f234800953c2cc6266e8e9ed106affa2d13a3e50e176c
SSDEEP 12288:PmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:PGnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T14F5523797964F98BFB1706F14C828182977B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ac85e3ca831c97ea8915cc8b356447753aba63d43b73d03d6e24d9c18c3a9d9f
MD5 9c8f0abaf33313aa2d647c47573f52ce
SHA1 eb4ee7d1e81d3ccea1ff99e8dfe999cb6154fe1c
SHA512 660fa0bb2960c63a63222a72b965d78871ebb17b2bae9072c2d23752875d6242c24b0859e6afc298e6a722a7f390e024929576a1a28cd7250fe7d582d8c9e80a
SSDEEP 12288:NiZwbDzzFEoS2cPvyOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:QZM3zFVSOOnQ/tbw/2Mkjy6Fr7g0os
TLSH
T17D7501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7b7df21af0a9185add12683fba9ab37f73823a304037b0f1a4287a0f9a2a9b8c
MD5 db1e9dd36195a7d1c0075baad0e5d684
SHA1 d6644554674ab469445d5232d44cb2c2d15a87e1
SHA512 60b337867c02bc8f62cc958108a79a96a07d5f4d54afccbe4f4fb72955e3095338b62c82201ec1d98537b9251a2abe2de045740f3367221fe8f0ef0b76bac3ce
SSDEEP 12288:w/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:wfnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1285523697964F98BFA1706F14C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cf4e59f15c8aa17b38a60586911b00072baac98e657939a25ae1f91c1437af70
MD5 61154df7f6b74e4b0e3baf7a3e471558
SHA1 dbb68aa265d648478802d79ddced442eadeca6ad
SHA512 abdaba395abc339424a82911c3ff6ab46604156d156871f58f592c58f8e4ea4e930961051e59897b746f36034f840015986ac39f99709f58f022c08853023642
SSDEEP 12288:djGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:dTnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1EA5523697964F98BFA1706F14C8281869B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0f686c493a1974bb49c86b8831271469f02a5aa5641c61a493107a5b1f5eb809
MD5 bb4c71ec1ca699a744b6da8e3bbb9ac3
SHA1 614d733771cfcf0899848828cb5c67fa747fbf6d
SHA512 2efc867524c858dd2a263b7e6ee5aecf4d2b218f4500d9aeb22645bd24d7e34b5b713b712148c0194c1063bc0fdc73efc4ec49cab03d2b645e956c29b0774f87
SSDEEP 12288:AyPz5L8SGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:xzySnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1EC65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ba2076c5c43547fa37711abe6411ac7b636d8fefb339f799ad8e3445304028f6
MD5 e5adfe28bb9550dbeb2d61a4268c4a63
SHA1 a023d2678da38a4bf8b9ebda6096b34d54010c18
SHA512 351711d02e841093d4806d55cdbca42c011514c3ce4c4d0cfb70c6212af51333f4053d9d46fda5e42ab9a8532b6ade1c2745a952bdb89f97ad87b9ff1ae1afda
SSDEEP 12288:G/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:GfnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T11A5523697964F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 63bcbe04daeae0ba8ea3f5d854ca92cd4256d14ec9bb3ef6cc55a4281f50da46
MD5 f55308ab91c506d543cfc06cde69c576
SHA1 754bdd44c6db430e6b877a82d2b17f663967af40
SHA512 385c2ac259c171be6c7d9dbbec611466383374bac6d813fbd5e8e815de74650f0ff16cf3c7e1b6d584c77ec077ab934a97f6cb6113b58ec17cddca600295ba3d
SSDEEP 12288:k/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:kfnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T12B5523697964F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 855ea436d07dfcaabdeb0e41b87a59f40130c87868c2d34a596f929250dd6b18
MD5 324a2e1d83b59ff359b322d9524263c4
SHA1 87bcdb43eeb6b641283231601aea6ca80ce4e850
SHA512 736051af92058dbe626a9e7f185dbac3be1c411810eb16f144a48fce273b4a5f0639a77525941659b456097d7969c63a7d9496e3b43739bc5b33c03a506a6a9b
SSDEEP 12288:UyPz5L8SGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:NzySnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T12965021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 cbe75378fc7f9ed41e60d7383f4cf0a0bd9f9e46f38b5e472b77de9e7924985b
MD5 80c2180455d18b7288e1de9f519a9430
SHA1 bd6e68cdc48035bdcf856e6891ebd334de943e00
SHA512 39fd2c2e7ab954dc62a065585c268647d8983b39ba96d7d9ad4a370e77d4e9eacf117ca0824900e719ee015d8ffe9bdc9912548641d93d96dda8c986390993b8
SSDEEP 24576:/cP4mcvIjkGOxhKP2l71nNKbrh/8KBXnQ/tbw/2Mkjy6Fr7g0o+:UP4m4IpOO67W8KpQ/lFTjN4
TLSH
T1DA65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a016a4a9a6e46f1e91ef23ac86f47262f014c59551afea3fe3ee1984c464e82b
MD5 28077ec8c1974f579af730069ad94d28
SHA1 ff797b7bb5d5f8216fb3b305c691a78417494292
SHA512 f72504edcc924a27e00d4c70f6d5a05b6844ce220a7c627a9dddefaa91d8f7684c10c2eaacd061db082221b118f242d484fff87d66939e83220d9e08b091cdb0
SSDEEP 12288:7ssfvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:3PnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1D365F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2fab7d28a8fb1a20e145e4c1a18e442ff777d51082f7efbe54b0f589261ce55b
MD5 fe2a34f7043577dac5cd13505461e567
SHA1 d6e7d8e8813a5c3039e09251b781202d84c9fa48
SHA512 1c3a46590bb6fcb17439f84330d895050aa7f7c9f20fcaaa16b0a3502b0e63d1f6a8ed6d7c499e658f36dae94549db81738ffc9d760b0efb69520a3b012663bf
SSDEEP 12288:CPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:CvnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1375523396668F94BFA3B06B05882C152673F0EC5BF90D78FBB08222D957C3D00EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9148629643713f90d6ecfedbe7f787bad20fba65d27e46e082585b2d4b997995
MD5 f59f44db5909b6a6e617f70ac1932a3b
SHA1 d611bc9327b37dbae03675e6412e8f34e0f10fe7
SHA512 54d2ba7b5ad256c2f8093fd469254580255144c3bf2c2d1f82f299871b3021fd89a3edd9c0baa26b73283318d5d8d5f0ac6cd7f1f6af486eff0ecc7031654901
SSDEEP 49152:0a0h2GEkuAe73q3pp46zwwQVQ/lFTjN4:0a0hNYG4JwVLm
TLSH
T1BE859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 a897974695f7109e064e6393e93e0d5bb2e103012aed262ecaa6faf10ba1e363
MD5 10cc8b28883cd91b1eec20f002fb62e9
SHA1 c1d4ceb78e93b2abf18cfbdc034cce5765c440bf
SHA512 f255f9e56e6fa438438ae2c1c7bc7a63dfbe38a8ed5270625ab7e291ea0820e79a1d8fadfe37e15d359186937bfa6d37b5912c97a4ac7d85fd5f6344759f1b77
SSDEEP 12288:+hbHjfXeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:+hbHjPenQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1AE55027D26AC20DAF63692BD88928546D7327C552B11A3DF2385423D4F3BBE40D7AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a1537dd3ec0c5693aef9d784d8c217e919402373a7f095b578ec46df69cc83a5
MD5 458b6c7b0d361dae0698a1c455c7d9b9
SHA1 c0f81acb0c9395894629de574f2cf5749bd20ee4
SHA512 615c6de445028a1e8038a1cd9213912d8d726fe0c79fc2fccf5ac1880de074f2ea8af5cd8ff3a8250ce457ead60c7137194365ea77af728d3e3718443058fccf
SSDEEP 24576:e3YgnJcRTk4yti+R5dBR/WnQ/tbw/2Mkjy6Fr7g0oz:eIgnaTk46pBR/WQ/lFTjN4
TLSH
T17045BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 232f84dc31c63bbe627ccf929ebf05bd125c756d40ea6f0115bd69fcf6e7c488
MD5 c8517665073bf7415878ee8df09436af
SHA1 ec34045db43142b7b5618b1318304e33c520ff62
SHA512 9861792942a886ea8b2b1be31383aaf75711b95f4a4c016baf58cc81a18f8b7e844f0584d9c6c531948c14b626b8a2af7769b4b9dbeb688825af8d0ab25d1824
SSDEEP 12288:wzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:wjnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1115523687618F98BFA2706F54C838546673B0EC17F91A7CF7B482229967D3D40AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 c2bbf2e1219161a8565b263ea3a79716a1f12b9c68443631701e8e26bcd00e13
MD5 3af3a75e01305aebc15798c6f311e766
SHA1 5c3875edf6351364c564b090d9f85922821d8a5e
SHA512 ec66c3114fb0e9da25be3bcca01084af6fcb1f4944eefefc68e1f1d4557e22825351430d12ba871b2a5920db10710a829f0182182ea71d8d303d1e503e4de19d
SSDEEP 12288:HOb4A4LWOsvAYFT8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:owL3UT8nQ/tbw/2Mkjy6Fr7g0os
TLSH
T16F75F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 e202e427589773ff6c9354794fa1bbc21ddc7956b3141ddd1970d000e0970ff5
MD5 ac00e2b5007ac611417b96b8d2875b23
SHA1 b0344619828725fcd7f5fa345253326f44e0694f
SHA512 1e48f633248aa5db7aa4d8a5342a9ef4b2e6c970027e4503b4dee722303a13c5baa2d32c3c037faf46ab91ff748396d61c8fbb32ff9a9d8bcabd397886f318f0
SSDEEP 12288:UpFtCOwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:dOQnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T16655022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF85C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 700804a2c5d26ed75dfe8799bf7d41e596f186f68ae47ff2a76f12000b9b28f2
MD5 36af5085554977bbc02a7b3beb6cbfe4
SHA1 2fdc61539236fd36f8d8472c1781a6e153d483b6
SHA512 6bc92f53bf243686441e7321b05b5b959dd8de549ac6cb982156ff33c44b30c99e269110d29e052610f612f89cff138f9f6a5a33786d5536b3a6793fcae7907d
SSDEEP 24576:p7NM9YqZqmWMUkPjZM48Mv6bEhsfnQ/tbw/2Mkjy6Fr7g0oG:p7cBWMpPjN8DbEh+Q/lFTjN4
TLSH
T175659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 abed34ed94fb35ae738ede1c1fedbdd02024caa02a0443e83efdabe60273db3a
MD5 019be39706faeab51c450d350b8a0f65
SHA1 05b3fa68bf1b79cb447280e28c30ef3644c70140
SHA512 eae15f239b1163bcb473eb64da8c69121115d3f8992c5c7d1a0e1466c73beb39e1475d7de274819868e8b69b70032e9ba2e8952ca5e84c959ecf1d770cf5fa02
SSDEEP 24576:RW6BApg2YuyuNDYTabvcdvNYf8km1xnQ/tbw/2Mkjy6Fr7g0os:RF2YuHNETovAvNYf8km/Q/lFTjN4
TLSH
T1BD857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8250f189f3dd3735432e4e47c9a262f0f71a5d0dfc9ee4ec4b8533a88284ed24
MD5 f1e0f7f399fd3fe44e49d5a0f389646f
SHA1 25398e9b44fd574e94dadad9248a1fe03858d866
SHA512 f4e6b0ed3d6d27835c93cc035ecdf0fc7f78b42a5942014edc516e7fa8965e15be4376550e53b87f6e474c64a660ed65087f0bab4c0454b9a185c0ee69871fd1
SSDEEP 24576:4AFs06+Omlf3NXEbToknQ/tbw/2Mkjy6Fr7g0oS:9Fs060lVXu1Q/lFTjN4
TLSH
T15165AF2F66AC00D5D07ED17D8997C91AF7B1746307256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 18a94b3bbabc7ce1fcdd290c75126e79c6992b4c4487f98ff810f719c62908af
MD5 b38ddbca9205edf08d4a84b43e732144
SHA1 4c7e3e99a96f830005dd891a9d70220355690a1e
SHA512 5aaafeb6c5c098dbfec46662880432d129cbc77e1daa596cfdfd580bf53f401febd584c9f7981e521b33c588ee756bd06227d109e903f51abda732b3aba28ea0
SSDEEP 12288:BCJnJ5D3VkrqzxfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:YJnJ5D3Wa1nQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1DE75D03DD2A810E9D477C2B4819A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 66b257dfc54473398e7c4c6f4be01245bb897f652a25e3eafe735a4acfb1dbed
MD5 eedb74ef8c0083172f246239d6f6e254
SHA1 7e4e71e85f3ad9915d35cb4240c15a5333251754
SHA512 19c9694b68ff69e1ea8ac6ada75392a8ffb73fd3f7d1632e42555d66b4d6065665704795596a601e25c653ff1d157f4ae35cb90758f657b4828410e84670180f
SSDEEP 24576:9EPghm6/7IIXdwcXrif7qQncjlP65i3VuWnQ/tbw/2Mkjy6Fr7g0o4:Kg06DIKdwc+eQnSt65aVLQ/lFTjN4
TLSH
T15B955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 96eaf377347464e20d62b27ebd11da8e9b1bdb0c75d9a4124eeb2cbb7d061933
MD5 403a110eb93e652f543e6dc52266a89d
SHA1 249d18470b364b9c22fd88b38f6edcbc0fc73766
SHA512 15c1c8923ac3b053efc9fa825fbbbeda7569cecf27332bac86a3e98e872fa3fe95fcf6bd24ec15f90d98ea48c35e065b98a4f36d8799e729eab0248a4fa7ba48
SSDEEP 12288:HEP3RSpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:MS5nQ/tbw/2Mkjy6Fr7g0oL
TLSH
T15A55126D37ACB0EAE52A517D88918545D373F4A12B5267EF2680823D4F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 2986b31185f57c772cf8d2ce7d1489838d8947915685e00d04560738cf6cd831
MD5 465fe59030168506d609adac41974638
SHA1 e6d394a682061a61603ada0eb922609dbced2a75
SHA512 930090f947fbe7dc3e70043e48457f46734199b50f1329917217b3410119c35e55c013a0ce22ebb2cf3e1611fc9ae72d15c53210bb88654f181aa56a3f8bd92c
SSDEEP 12288:TjkyuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:TIyunQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1D06512187398F4CAEA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 b8ebdbb10c9bc418225d98c2601c55530b669d487f9630e4df44c9204544835f
MD5 56af83f711bdcb84bc2055eb37660691
SHA1 8e9bc63ca6089ae97b447bebf6f386d09e59766e
SHA512 b95fbdcce78873278a949e50dfa71d1cb0c42d2d3c11f4836b77960b198c864daf4587ba0a9032bfa496e25ed1b392c590c5f027e6062307161238316138e08f
SSDEEP 12288:z0AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:AgnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T12055232C3665F89BFE2706F448928542973B09C17F9167EF36886239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 496eba4054afc44e671b98dbf094ecffd1195e676896d71ff1a9544d71c9cdb0
MD5 b8b761af1392e487dcde17fae806533c
SHA1 7918a196c1806c9e1357bab60f64a6de71277d91
SHA512 42d048c90532376c217826bdb4d6ac52731070e9421b9f9df4eb0e12da64fb7882acf2840fdfbe6365bed31ac30207e8a211da98e5e62c02408311ce2181dcd2
SSDEEP 24576:UQ9MxZKdcz9dw3HnQ/tbw/2Mkjy6Fr7g0oE:UVKZHQ/lFTjN4
TLSH
T150558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 4072016b8ba59caaf4e578d927fdec7484e9163970baa1f85702fa424f2cf1c7
MD5 c5b4c34ab2e7609c9803dd5d3026b9e1
SHA1 4e84f28447d49f13e0b06610c72be0d448e74131
SHA512 2f2d8bfba4a9703c5b26b6b998bd0b407846f0327dee26865f01b6b105c6983581829c77971c32702ebc879c710689c818ca96ce2cfecda800726a0e04e9e878
SSDEEP 12288:dyoKo20Rple9pCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:dyocSApCnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1A365E01FBB6990A2E136813C88818745E773B4706B6267CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 54138496779dc6827bc2cea1d375af770803360f8ff334d3a31660c2c6fcc8c8
MD5 474389ef44a5beb0fa00484fd57a3663
SHA1 11d24558089e6aaf80ce58b0a0e1b73c9a5e521e
SHA512 8ae615daac8b5b21afd436c45c010db0a1f7d32a691a55dd1a72297d0cea6e92aa575a5da4c5890d6a0e3f92725f6319d1862f36ef9b3579f8401bf6245388a9
SSDEEP 49152:/WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKCQ/lFTjN4:n0zuNIfLm
TLSH
T121A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 334aefbc098df2c3e7eb26dbd3a44ee7714a8068965992be5b559627967bf627
MD5 c2cc6b74bb51ff6f9a1f8af885132537
SHA1 0bf03e83e857a9e273a1e5ba1d6b6eaf82fe9c02
SHA512 ff7acca6226f13dfa095b81fe4802c3cde7bb75363a862f2cda3309c515f0ae2db305ac9e6cbc79b77770251beaae0d97fbde5bb4e4b4b53d2cf372eb4817202
SSDEEP 24576:m1QT7EcpfxR+N5AWAz3ooiYtjMqb5nQ/tbw/2Mkjy6Fr7g0oG:rTDxR+N5YzTfjMwQ/lFTjN4
TLSH
T1A655B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 b9c024fc9be5729811324474a401eb18c9609ad31b84c03cbaf5dbe53307148d
MD5 d7b0673fb26caa639b678ab3cf591218
SHA1 7449120109d2ce742320d1c5d699a2b863593620
SHA512 499f4b951e246e4de9d0cf2400370e003a7d9fa7fefc73f36c69327cc2a657da83910e98493731c606eab89d12836ea31734e061e64d474d634c3a660c2499b5
SSDEEP 24576:3TMdOz0FFS+1mSL9nQ/tbw/2Mkjy6Fr7g0oz:F0K+1mSL9Q/lFTjN4
TLSH
T11375E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 e0fa7023f52c0a869987c14a39e831ffeb97cfaa556045f651bcbd3336fa48aa
MD5 b968adf8f23762ba575f344d25657a34
SHA1 1596148444212d813ac82a8ae7baf4993dc72c6b
SHA512 f86f9bdd85257f1ec906f8bbd807aa556f4e083a529b2c8fc5a1db488a56a27fca018054bd598aa5891e78342021097730ad4cde15d5eb9c34cefa9e5b046535
SSDEEP 12288:84T8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:D8nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T15155122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-304-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1228-14-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1228-465-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1692-312-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1692-484-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1692-192-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/1692-169-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/1692-349-0x000000000D290000-0x000000000D298000-memory.dmp

Download

memory/1692-153-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2432-313-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2432-39-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2432-33-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2520-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2520-65-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2520-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2520-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2756-295-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3172-109-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3172-296-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3172-115-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3180-286-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3180-88-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3252-1-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3252-0-0x0000000140000000-0x00000001401F4000-memory.dmp

Download

memory/3252-9-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3252-351-0x0000000140000000-0x00000001401F4000-memory.dmp

Download

memory/3332-356-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-352-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-358-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-384-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-383-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-382-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-381-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-380-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-378-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-379-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-377-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-376-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-375-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-374-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-373-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-372-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-371-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-370-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-369-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-393-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-392-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-391-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-390-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-389-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-388-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-387-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-386-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-385-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-359-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-360-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-361-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-362-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-363-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-364-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-365-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-367-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-366-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-353-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-355-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-357-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3332-354-0x000002231E150000-0x000002231E160000-memory.dmp

Download

memory/3536-98-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/3536-287-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3536-93-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/3780-368-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3780-294-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3976-303-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4268-293-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4648-299-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4780-284-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/5008-133-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5060-308-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5228-126-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5228-297-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5228-120-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5252-310-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/5364-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5364-483-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5436-25-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5436-482-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/5436-23-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/5436-24-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5436-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5476-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5476-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5476-283-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5996-70-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5996-76-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5996-285-0x0000000140000000-0x000000014017A000-memory.dmp

Download