a0d60233f5c624b6fe82e77570910b40d7abca92ac912f10fbc3095b260c6c3b

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_b09919e66dcf916c526f5665c2232b9a_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.8MB
Sample260506-gseq2se17k
SHA256 a0d60233f5c624b6fe82e77570910b40d7abca92ac912f10fbc3095b260c6c3b
MD5 b09919e66dcf916c526f5665c2232b9a
SHA1 7aebdbbdd86acab858fb2042c7b929f5a2486cde
SHA512 3c32f4fcc5691fed26e284c3ea93c67f060819fe6c9bd23a27b81609b43c120da2323051441fb6210346a506aa1d4f62d62e7e417ffa0029dfc62d0223c59b56
SSDEEP 49152:GqgLkwBTyhjBvqKHjUCQOrhjuwJSt3cZZM/DVAaTP/P3BjjLNiXicJFFRGNzj3:9njBSKHjBGt8MN7wRGpj3
TLSH
T1C9067C47E6B941E5C0BBD0398A469A57FAB1384A873197CB47A0475B5F23BF09E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4440	alg.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
5088	fxssvc.exe
3036	elevation_service.exe
2368	maintenanceservice.exe
1876	OSE.EXE
2676	msdtc.exe
4112	PerceptionSimulationService.exe
4512	perfhost.exe
1724	locator.exe
5064	SensorDataService.exe
4668	snmptrap.exe
4480	spectrum.exe
3896	ssh-agent.exe
1108	TieringEngineService.exe
2368	AgentService.exe
1412	vds.exe
768	vssvc.exe
2424	wbengine.exe
1076	WmiApSrv.exe
2356	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-05-06_b09919e66dcf916c526f5665c2232b9a_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-05-06_b09919e66dcf916c526f5665c2232b9a_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-06_b09919e66dcf916c526f5665c2232b9a_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-06_b09919e66dcf916c526f5665c2232b9a_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\39dbde8c14bf40d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-06_b09919e66dcf916c526f5665c2232b9a_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-06_b09919e66dcf916c526f5665c2232b9a_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-06_b09919e66dcf916c526f5665c2232b9a_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-06_b09919e66dcf916c526f5665c2232b9a_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000185ef5541edddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000615a52551edddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084455e551edddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009e9df541edddc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000944901551edddc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4696	DiagnosticsHub.StandardCollector.Service.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
4696	DiagnosticsHub.StandardCollector.Service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4060	2026-05-06_b09919e66dcf916c526f5665c2232b9a_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	5088	fxssvc.exe
Token: SeDebugPrivilege	4696	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3036	elevation_service.exe
Token: SeRestorePrivilege	1108	TieringEngineService.exe
Token: SeManageVolumePrivilege	1108	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2368	AgentService.exe
Token: SeBackupPrivilege	768	vssvc.exe
Token: SeRestorePrivilege	768	vssvc.exe
Token: SeAuditPrivilege	768	vssvc.exe
Token: SeBackupPrivilege	2424	wbengine.exe
Token: SeRestorePrivilege	2424	wbengine.exe
Token: SeSecurityPrivilege	2424	wbengine.exe
Token: 33	2356	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2356	SearchIndexer.exe
Token: SeDebugPrivilege	3036	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2108	2356	SearchIndexer.exe	104
PID 2356 wrote to memory of 948	2356	SearchIndexer.exe	105
PID 2356 wrote to memory of 3816	2356	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-06_b09919e66dcf916c526f5665c2232b9a_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_b09919e66dcf916c526f5665c2232b9a_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4440

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3104

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2368

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1876

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2676

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4112

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4512

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1724

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5064

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4668

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4480

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2812

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1412

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1076

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2108
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1652 1640 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:948
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1844 1820 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 80e44e608f7edd357708c73dad6a1c5af08ede6e2cb4f4547fbd812756b8e4e1
MD5 672aa6da44800be2e65724f72f410272
SHA1 8f9e96cbd319a0ad4a58ba65c3a1a6462d812839
SHA512 a1222759b5ea7280e5b132c6f3ebfb38b8422792804a31c0390b08e44a6ba4a887c07851e0d2bd84d3c7aa381434ebe1e3365f364db9d4970e6ce36fbe25ef0c
SSDEEP 49152:Hb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnULNiXicJFFRGNzj3:13q6mjBD7wRGpj3
TLSH
T11CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 05621dd761795e4cdbaa26a7ae6f6a43f8cf662bedd62d129fc93e3540b62d51
MD5 e475d96da5be4d0952d0a4194989b9b8
SHA1 e961cea183d293f5c880ef73c1de0d3131410fb4
SHA512 aad0f44d0a60386fdb522582bd18a5bce4291ca54b9afbeb88f9f3fd65798b21998d6344aeb11502cab03a2ef862564d3cf073c1b1a3b1233e625c8f0aea3517
SSDEEP 24576:YXYfDtczAX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PtceLNiXicJFFRGNzj3
TLSH
T16275012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 98dc1476a9c95505f4810796b7ad64488ae9852cb20ab3bd06a375f8146d2d45
MD5 ac1a27ddedf408eed7686e63a56d0ee1
SHA1 dddd2901c4fdb048b7d3a883a2b678830394f993
SHA512 2daea86fef24153f348cedd874ff7e24cb20e0af108ec133f16dab91e974ddffe1c99802e5dc2c6d78aaabf927466f8f53dd3aaebe1265612cd47bc853641cd7
SSDEEP 24576:h0Le5ji0hmxhrMM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hPji0AzVLNiXicJFFRGNzj3
TLSH
T15785AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a2a3e5a0bb4abd2b6614eee679db01510e75544bb74f50e9245ca6381ec2e2fc
MD5 24565a8ed45cc1df4155e71848c7eb27
SHA1 a1ae04836b1229cea7d59196ce8f604145a4a7ff
SHA512 7f657baba47afb9966c19e0ba42764b4cbedea34ad02f29eb3f0f43755f10400267caf61a025de473e3c3bb51d07e74676a921f3b9731e870cb89703f53d4e18
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWj6q8wyuO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5/ezSC6vUzPv+HjyJLNiXicJFFRGNzj3
TLSH
T1DC756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 56347a013d9ef180d59bc486d1fd4b9fca28af45d46211d197fb4d23f3e8bcf5
MD5 16eff3336721cb263a5bd723dc95aee9
SHA1 f968b3fe2f63362374aa94702b34529105d2d32d
SHA512 e56ad257bb605e264ce1611ceb2517e611d41cf926eef3150acf27ef214af18db69d773ecf86f1a7b557729e54849f6e99cc933054cb6df7d599a1e6ddcf84a9
SSDEEP 24576:TVbqPb88hv/l+Bz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TVO88hXl+1LNiXicJFFRGNzj3
TLSH
T195559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 cc31f6919bcfb5cb51174ac123dc4d68a64242fd8557e32659ad5129432aea86
MD5 6e3de13dc2dc860c8e4e621ac1ac3f5a
SHA1 7254b77f66ea9626ccf78065813eaa801c785766
SHA512 e11b65869be9aaa62eb7410c83556d5b7df9e0e4156f6d11652f590653d508f73faf368b73e3ce9a127ca4b91bf9e192394a2c957af5bfbccee7a5b426564b84
SSDEEP 24576:DG4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hLNiXicJFFRGNzj3
TLSH
T1865523D3468854B1FBFD003A867A5828B5845E2C8A695DE3D2543E5E913CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 986e2f17c58037a7e444d2d4331d07199f8c1ced3221a3e1c59d4d545d46abdc
MD5 f090bcc2071e7bc4181173981e163d60
SHA1 0579b485d244b915638c969e0ff469f0749e5aba
SHA512 2df157d6b243c65b606a0dd97fbdc728ff2526de95cb6a13ed17d44aa4b263859b049691e41cc711ca7c12d0e0d5a44586c6a9157183cdaff3b7b57629b01de4
SSDEEP 24576:hJIUL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hJIULLNiXicJFFRGNzj3
TLSH
T1A075CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4a87fe9865eeff0406704e314dbdf603ca41599113285d942e0f14274b764793
MD5 d06f07980c50b1098b26a5365f9bdc91
SHA1 466475db16bc8239f3071c4e2fd17c712d4c9992
SHA512 6de58c59473fb5d2fdd6360a1e97619ff0125cce38e74edf94631111368d268525ca572717be691c8f6d634a8e0af0e26df889d97a864134e621ac5de9bde784
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THP:iQvGAdlCEL8c/WRNw5C+7wRGpj3
TLSH
T12F266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 2a74285a6e5cedaa7b6dd3b5dba59ef9a6a33bad8df8792aeea20ff2364f6795
MD5 baed6ff83f60fcf21b916e186ddee41e
SHA1 48ee92110293f51e6af1c520ee1ae4d7fe7214e1
SHA512 8246f6830bbcce6ef481f14e5d1d5294a84ccebaf000069ca309cbd8d5b069fe1a1c193c43e437bd7093ea46799d9ef6973f5cf709ebbb840ef3146840b24628
SSDEEP 24576:DfewsAjF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TljFLNiXicJFFRGNzj3
TLSH
T13675E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 95a89d3d5467efc56c29bd32e9c4cc3791cb77de6bf8f423e25fc5362a5b75f9
MD5 e7b173107b1ca8fbb17aec8f640d5663
SHA1 e73fd79ec3c66dd0515555deea8ce12a5fae6948
SHA512 68f10fdbca6b1dfd1bf8c699c3e657f301f4881ac0c29599b057bfce2f41a4b6698d2e6f85454c99a1ec18bc63de57a980a39aba785ae4fccac73a991c9655a3
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHRF9:cUEtQevvqc2W1cpV20I32H9
TLSH
T18E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 88114397e31cf7339a2e4b59982811e915fa40a633f9a5218bcd79e04a4b7eb6
MD5 7aa0c933add97b4e4ab1e5c8520da13d
SHA1 5d1e2f9b6d298da5eeba240bc756e0b817a489c2
SHA512 4aa783ebe8c3e132896b3fcd9989364f076307d0519c79337b0e2b58ded3fb1cbf6750b7fb075bf4420d9504a0d47a8e8e9baf1b47c04be7a044a467a022ce8f
SSDEEP 49152:3CbRquA/m2yL5zLfFiV+XenmE3/zlLNiXicJFFRGNzj3:goq2Vjnmy7wRGpj3
TLSH
T107D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5832660147e10bc5b22623065115557e164612e166ec632fc9272b764ebea977
MD5 6e114a16b483dc1f204e216478cd18b7
SHA1 1ee28ad8aac853c676b159b08e5efb3399091c03
SHA512 5d7adc779314c691d5643bd062d8cc3d2bbd5219324cb4c2044c2cfc618fc7f280f0c7ded5ad912876e358849a620021d26cbe21ea8357586cab1ec891c8675c
SSDEEP 24576:tAhGL6IFoiwtA5l7S53S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tAM5Foiq5iLNiXicJFFRGNzj3
TLSH
T160359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 bd556df2167f0f5966bf0bce810debc23379be602a39bce90e557dc94de288da
MD5 22c0e053ee7e90446818dd1ef2ac6df9
SHA1 039ba6fd4bca24330e54727ea76b7b2c4dbcd740
SHA512 bded34fc116d31fe0035001c2046d3cb7f2be02f8af9e43edb7a4f888175b689855d0db82ae50ddfe39a658527de5b99c32035eef43d142496be5a78341c4025
SSDEEP 24576:swuROWp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:swSOmLNiXicJFFRGNzj3
TLSH
T1FB65F08632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e81fde837cef3c397312acf5e3186d993f0b23accb299e6eeac262286490ee63
MD5 aa5251533ef70be373dbdc5a79bd03e9
SHA1 760e70da180ea33e5a213bc0a2c1e59a887d4e44
SHA512 70ae1ea82b563b1f1fe9ab792456ba142faf697a7b81f7f525e7714cfcc41eda1ed4bb58c9086bb8061fa989cbec9058b965e9f7a36c29790fab30cf041b4099
SSDEEP 24576:IZuE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GLNiXicJFFRGNzj3
TLSH
T19155129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 211a4ba5c799a5b574414cc88c72b52889504b5964299031b935326616d66765
MD5 741e76c003bfe5cecd4da785482d5717
SHA1 99df7cd679655c1c94577de809fc30823232d9bf
SHA512 9169aa6a9b27b647d910255a90ee04a579e7124a2dfb5b21f9d5112beac1f179194f4082c77aafdd2f02b3d0f4f1c338255dbb0a98dfef79fb5d65c8e8355b33
SSDEEP 98304:0QRQyi36YOcPDLvw2gAf+PN3P7wRGpj3:bQyiKanX+PNDF9
TLSH
T152667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f2722488c22e62016dd80fdcd6a45eccd41a664684dc3e475596ea3633059d59
MD5 97a9076ad0c8d87029bf78869e31da30
SHA1 b45be8576684d25b793663ad801137602ae20c40
SHA512 a0e3b078dfc33cc037e751ece99038ee5589fd765ea27ae219e82227ddf0a203db389035b64e7d1c8f43f96f29fbe06ad9ea9cd62076cc1c59028689cc3b7b93
SSDEEP 98304:PQRQyi36YOcPDLvw2gAf+PN3P7wRGpj3:+QyiKanX+PNDF9
TLSH
T166667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a563107ac9ae5ab1ed06d8a20382c85cd507ac7b1e161c6b215e316756973366
MD5 c8699b57a156a0531444e10afe3bf2ea
SHA1 826ffb897423eabec79b54c40a2dd77106af0f7a
SHA512 c32bb4e6d7bc6cef09a3f8325edbf7c9346b49b6a51807219304be836c7880902570ac39fb836f7a410a243443c2fc6ba138032aece8871e7f09f0b66287d806
SSDEEP 49152:D68Qg55nhkeWu7PNU3/VLNiXicJFFRGNzj3:9thTRc/V7wRGpj3
TLSH
T1F1B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9771e70133ffef758c42c95510929b7e61958116c236c3d4187b07c49ffb8069
MD5 3d8d40f3f1ec4a2f2bf6a6a00f9c125c
SHA1 dc5f2bd304ac4ec037bc54bd0a72ae00415c35d2
SHA512 2ddd58d41ee4b9fc30296378a9ab88b0aa956905ee5161e7492a38cf4614ec2920707bb67cbc56fb3bbc206101e404e073c573110b2b2ae05bc3c3d4fed9fed6
SSDEEP 98304:3y5112gYy5azzVvU69nLKnhZ47wRGpj3:KLIHRWhOF9
TLSH
T141167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.4MB
SHA256 962b530c6167cb87636949f275e7e52b81375081186602c1e101862fdb1892b9
MD5 3b812e71580e65908547e38da7f7d280
SHA1 e9640ff16f6acc9ee4064651334a8322e70e87e9
SHA512 8e6512b78e4b17f87c18f15bf5287ed060a633eb959f33b082db36304f16f50f2e87f25094f9c4428c255d8153e6bcc745e0de7324f9620bdefbfc9f977e880b
SSDEEP 49152:NB+taZ3usBWOBr4tEGN0bqx0z+n217aau1glILNiXicJFFRGNzj3aLNiXicJFFRI:Tu6Jmrxd2dI7wRGpj3a7wRGpj3
TLSH
T1F1F5BF13F1D901E8D06ED078874A9233FA62BC490B35B6EF0A9077562A77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.4MB
SHA256 99e2ea9313f1c63be1838915ce2ca804fd8faef8b60aa089b4951732991642bb
MD5 c9717d9663d6811165a0f27a04de3918
SHA1 1123d25d0b6084b0ff1e241c98087b3f43f021da
SHA512 cc20f5e4a91534a154f49dd1be4e1e3b60c472041face8badce95650b830fcd4117ed39ff7ccf89e28663b7b69f19a518ea4e6db06d8a9b1034e35f2034d4064
SSDEEP 49152:nB+taZ3usBWOBr4tEGN0bqx0z+n217aau1glILNiXicJFFRGNzj3aLNiXicJFFRI:pu6Jmrxd2dI7wRGpj3a7wRGpj3
TLSH
T1E9F5BF13F1D901E8D06ED078874A9233FA62BC490B35B6EF0A9077562A77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d22edb7862baf4879e6b01c739b7d13eb833f08558589245f3534635cb10d9c2
MD5 db967ae39c8e2dda6abc242f556a096d
SHA1 c46774102f692e50f540ff6847a5c69b09620833
SHA512 86aa5e9331f935ec8072d66a1a23b1cb82df28877c3b8c88dc8b2456b622cf68c8efe6512afb42a4bb4df6ca287d99af4a8570c102bd6074d187a2e2a466f9e1
SSDEEP 49152:i1hpsNoJpF1A67U44CwH7R4xrLNiXicJFFRGNzj3:imifPqRy7wRGpj3
TLSH
T12DB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a3f9fed55be9581c1eeadfa0043429e0b7e4b919435e79ad5730e7474117e0a6
MD5 04461d5bbda72642eab1f32d824e2d16
SHA1 f17b3a9db139ac8f18a70543bc4e57baafd0d9da
SHA512 7eccfe581ebda6c0137abfc8209fb8d8b3d09b16347ea15a3524363b9f8681a06f28d615cc43158fe866adb3616eacdafa3824f7a1c06ab7a524dbaf96f3c311
SSDEEP 49152:GSuZQIY0Be2KkRVtOnks6NMHqELNiXicJFFRGNzj3:I5dKqi61E7wRGpj3
TLSH
T1DDC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0eabe6a63f311d7f0508bd68fdb34dd904d8ef3e198f236af8a856b86ff2ecb3
MD5 707b1d2b30e55bcf974da4065d625cae
SHA1 905e3e8f1b35c636135ed33b2289d323d002c1da
SHA512 03031dbd7d93c20a7e511413114392b66fc1e5f27b239e33fe07d00b1cc624c8068e6cc53b78c49ede5e105a4d1111f0b8ac0644e22abe2941d49d5f62e1a8c7
SSDEEP 49152:ihtSn8EApI0figjgiDn0AP5wXLNiXicJFFRGNzj3:DX2iWphG7wRGpj3
TLSH
T1D295BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a3cba7dda535748d27178416f519b6dad45f987f9a3ae2b6591d8c0132d90c2f
MD5 505604621bbe379b1e27c850f378060b
SHA1 23783ee994f2ef48daaecdb6b1d2517b087fe786
SHA512 e62082c67565103838825129318d6e9d2ec23d47cd894a6922ea7137b88e53f781b47606309315d537cfe009bfde97824ce82fb20bbb6230d266e001698867dc
SSDEEP 12288:yGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1695523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5565a856896773b4ad3880bbc91bce45be749e705a78da1892aaf30693e0c035
MD5 d94b9ed827950051964743dede483a76
SHA1 4fa1497af5c78260fa11f710a47fbb76e47f2bce
SHA512 1a881dcfc0f3066afd0bc8aa78fe52922d8f4b20b89f2986fb2b130843f44c69bcb5e13ff04ef7e8bfe60d7c82b9f8f7bb8db1f7a5c1aad405f8f1a4c21ea516
SSDEEP 12288:ZtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19C5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f57050faf56a47e9e31401494def54e15b1f89dad86e7196af2223eccead804e
MD5 57b726c7fe39677000bf0e719f32a164
SHA1 8f9931e9df728e68ef38303b6697abf3a175a1d2
SHA512 8c30fd403b769b8f48e61a1546cf0eced03157c7ae70fb77d19c3af2c1aafa0e4790d691596fefdace31586d6d60dc77b44f276d2b4c26e706d1d4fe3d7a34a8
SSDEEP 12288:F3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:FD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D3548955B1F6FC003AC6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 44361c083944ab376676c6cb8e7b339fe4ff9b053c2e5d49c5433185e7801859
MD5 90b359c2618c5285f4fb9f0407f76b62
SHA1 97ac20a371ba83db9d05e58f1dabc3f834110bcc
SHA512 df44d19bcb378a8a792b98ef33a3c142ba823e921c244d9af399578390da38d16d8266f0b0896d965d9d9303b4d5fd0e362a388e21c7703d921546269a7e8cc8
SSDEEP 12288:KVgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T163552393168901F1E9FD8039C6764428F2A47D6CD7325AEBD3003D1E5A74FDA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1cf75a6dd78a8a46e486d18cca8a0a06d95e1e46abfb7c87070ad59064898c27
MD5 0063a63e234ad00c7fbde7c0c6a63897
SHA1 415d5de710ccf151148389f99db6761884d31a0d
SHA512 8de6685a05faa2ae5cd3a4ac0e87f84c18659bccbfeaf4db144564549a39e29fd995f1540e2f52d5c9dadb5f6e6b0d8377381843ab09defe8af1eb21659ef568
SSDEEP 12288:/IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1825523D3548955B1F6FC003AC6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dff31662edee63c49ebe7967217b5c090b67a4a0a6485bafe934b7cb5a1afa6c
MD5 c97dace47fcfda22437ae115c6d9c569
SHA1 ca37c10038326bbef7fd8f3ff108491b200effeb
SHA512 747f04fe1d764501c7b40635147f5f5a3b76d8f5e7498b384501951c70cc75ba71d9cf318cfa82fe651513b788ac007159242a25d7b8f6dc58d994a495e47ad2
SSDEEP 12288:lRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ld/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1815523D3548955B1F6BC0039C6764428F5882E2DEB5619E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 195a9390ba745b728719838b058b61a04f6156c00b9d1b94a62c9d3dc544f14b
MD5 cac1616693eb4c1febbd51e5af4d09bf
SHA1 c030b5331d3f90dc91e5c16f2c9acfee03c0670d
SHA512 4921c348b680cca5dc63a44ccff3aaef914400dd03a725e7f97001121723db4b4b4aeb732017ea4e832d330723a5b1a2c670ec280d5f1e538653229c7d8d23a2
SSDEEP 12288:SViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D3548955B1FABC0039C6754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e537e938f1cf6c2bc8b774e9bced75c4850a90d065cdc3e017f5ed5afda979c7
MD5 27fe8a834a8140eae89acf5e6e052e9b
SHA1 f252b6696f549873b545cf5dd5cbe88d31358c6e
SHA512 ef228b92161ca044d7cc8093e284d09add67040a57e41b7042a0cb5d8462a0148654d6e3de03b8902fc6779a2585e8dd1c2854d6cd551b79b212ff87761cebac
SSDEEP 24576:JZM3zFVSOR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JZM3zfNLNiXicJFFRGNzj3
TLSH
T1BA750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f3dc0fe75e2f126f249432cd4b5e9e28f99079f95a8b97386d82bd094f3cb451
MD5 5d7103618170816e769ce53ec83404e8
SHA1 a09eee305b18cba6bf88d1cdc3e594d1f85bf0c1
SHA512 d259b7e5f85fd1584b1d894ae644a3671ceae181d6d8590011df6342e9984d98012ea08fafda3d4f370199ddd65324bc7a17b5a682e3122d8c49d7e0883ba979
SSDEEP 12288:4SiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:40/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1855523D3548955B1F6FC003DC6764428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b0e48dc5e8cb7f4029e86e3726aef7ce19101a6dbe71ee26bce637907f3344ed
MD5 f12aa8f42cb698508e9d4ea52f6e68b5
SHA1 e9fca9b0ca278fb68328076e54a75d74155e59a6
SHA512 f4777ba7af02896cf845b4f3261c4611ec8733902bad2a42721db68fb9cb6a3b3710d26e841207053afea4723c8a5743e2155c61f7b3be435f835403f7241778
SSDEEP 12288:SeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:So/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BA5523D3548955B1FABC003986754428F5886E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 afb44b38ea88b6b579375f08324824a905be118d8212e8ac59036f50c32198ba
MD5 ad80dcc8fb3905e0db6bd10c51423def
SHA1 d6b5524be0f33aa62a2bf7e5cce63c087ba80a39
SHA512 1e9cc62c12f449f9553e3341603cd67025f8ff345c507147fd3ae87f89fa9f4a2476d1982062ca2a179add81e8bfd460566da65ce2d8591a86649d7f95f25475
SSDEEP 24576:bzy1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bGLNiXicJFFRGNzj3
TLSH
T1F3650247629530F9E17A8139C9620915F3717C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 29c21972529a93debc35f5547542b3de49d72513566f0f44b409730553a91f3e
MD5 aff1185e1ac2f2389250172628c6b4e4
SHA1 4162684af9e0f619213cf3afd40ce6e0aa874d66
SHA512 c107909c6c7c1366f938de16b62fd703abef2fa3e1063f053474387aa6c66cf5ca323e830555119827b480d6f4104a6abaf1935d20742ef7b9946d0dd7e70cc3
SSDEEP 12288:0SiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:00/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13B5523D3548955B1F6FC0039C6764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8a7111170f6ac721a4231547ddb4463c5e1a601e8823d6e9a00e397b3c51eb67
MD5 773a71063b7e265e34890472c86088b2
SHA1 2641b409b9a4423c70b97cc0f51b6e0a83f59a23
SHA512 484a8050725e2f79938b0c9309f1139cc84fd0363770345a20f17eab535de4c512ad135d5689293af96e148ac57d2f51112bb991e521a2f93064607c7e7dbe40
SSDEEP 12288:ESiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1225523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 400cf30d3c2d96089ebc413b2dee9f888ffc86603a6c75a187316ab2cdb3fff1
MD5 2342f9810b89518d265c796f78277b92
SHA1 f41ab71df4c951b68f2f401e984b081a23a6c895
SHA512 126db29ea642da16346bf26b8af1709d3ae84a92620f4530c20f614af80d47907fd1b35468494747f15efc54ee21914bc9e532053e0a6ac252a5477a19719991
SSDEEP 24576:izy1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iGLNiXicJFFRGNzj3
TLSH
T1F6650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 cb0b1afba48b0ed1f41d3afbae720a708a910efc62fabbaa5caf38a46e774cc5
MD5 d265316d3ff29703037adde4cae0ac02
SHA1 7f2a2a2b1a55f85c7db953bc3a9ced85925ea398
SHA512 8f58a26d8eb37e23ead7451dd00bbbf275236341d2d386d1c8d8ce3393f29a35e2f069feeb1f0b7a041b6565deaf71876f51658fd0bcc60fb0b261a0c31293e3
SSDEEP 24576:NT8aLl3z0zDT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NT7LljOLNiXicJFFRGNzj3
TLSH
T11E7502A5B39018F4EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 b2bf19285318589227d710d352c9b217372ea5499b1376796f4a54c3ead27f2e
MD5 6402e2395f4d31535bca3562d58be4dc
SHA1 9e68af0f219b210685c50d0fbdb312cbdcd43dc7
SHA512 dd05a390b4f3c986b0eb8538112ccd9a6c49a011a5219ae9d0e4046591a4f04c5a29acb4784584a4d3219cc7bb85aa00fc1369d138d3133682b622e61888a372
SSDEEP 24576:H3rd9CHKy7GZv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Xrd9CHKyaNLNiXicJFFRGNzj3
TLSH
T13F85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 7292d49e591861f82e422549df6416c7f1a9465169e8752e8385a90cc40893d5
MD5 2ba6a29ac5d5702941922a84c3898817
SHA1 c418b22ba7302c141aed66a76387eac62c68fdb4
SHA512 462c699de01ceeaca62791e2672891ab9ac69e9ddd2240069b3feb490ba8e20f1bd7fd6c90895c04574233dd094c45f969951f1929dda8f27e9b9c83f1d118e8
SSDEEP 12288:EpsfCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C965F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 57f3adf745df4041906c3bb417ad26b867db0be6d5140b91cafbc2a0cbaf9bea
MD5 8f43955bb20d26455faa110331a49860
SHA1 1c4a35ae67a2f0d199ae69924a8649c1e137d59a
SHA512 1bb33b10016cfcf77b1be262944b60089ad619c55ded2524ce43ac8f89244d2cc3c38f5f6e7c37470e4fd678ca0318f6ad59c78b8d5cb0e7a5177d64aee8895e
SSDEEP 12288:uiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C3552392528C59B1FAFD1039857A9438B54C7E2C9F1598D3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 650b62400a72622da5b796cdbadd03eaa25aecec552bdce7529d2d6fa6a17c75
MD5 ac5b91bf799df41b503cbeee21081775
SHA1 a01681bcc009a0d1cf2d2a95e7f53a78868bda96
SHA512 d726ff43b544a0c189c1fc29f49f3a4a1371e366666a9250b0dee6e9b4a0dfca49dd119cf8eb9fa86035ed3d535e73e97b7d79d01b32dc1fff95b36113ad5e27
SSDEEP 49152:MRZwQCyiHiQEaaPnMjLNiXicJFFRGNzj3:y9xvPq7wRGpj3
TLSH
T18F85B01E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 c0e801d4940c0e0215746601efc19ee3832ea887819f7a5f28052acb41aaa4d8
MD5 601107c8b2abe6d9776360a126496f76
SHA1 305f9137b735e64e5aa045be0f8af80352eaf3e0
SHA512 8993aae7231ec766d846577626e905e68808a129179df802fd8d247eac26018c017f3aa15de64f8a02f3d7fe5012011e51d1f082d223eed5f709440c709c1677
SSDEEP 24576:7bxA1UGs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7bxA1UzLNiXicJFFRGNzj3
TLSH
T14255126E129C14F0F5B9903D89A68005E3317C2A572197EF6190923E4F3BFE99E39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c2fe4ac1153c6133b76331df1890b9622e45b1f0c147f49ad6b70ba2abffde6e
MD5 c8b457f79e9b838a48c04494078ea31e
SHA1 1fc63dc6de71304f17e3e5b384d26809a45f6156
SHA512 97ad6c9d7fb40a3016080d4d4d4910b96335cbd9c56994760486a408621626e7e137c85aca6a7d589debd35f75d15f57c90b27735c6a9b7d9f10b4353adb1cb0
SSDEEP 24576:5jsmP0yHaqrVqHra44KDzMsrnJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5jRP0yHfVqzlAsrnJLNiXicJFFRGNzj3
TLSH
T19C45AF2EF2B910B9D4AAD136454107B5FB71782D1F209AC70170C635AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 1dbfb2a1fbd119689dc92ab523f283a82cfcb22b3193e997e95f18c8c85016c6
MD5 d4092668e76744e3649fe3f92e5d621c
SHA1 ffbd9f177dac166d54c75b65c436da14129f6fd8
SHA512 ff34796f5f58283ff4fe7feccc838275f5f9de1d127029c4478d72b8db6a33226c72ed3c7e8aeb465cbc3aecb0284192468d153e2ac0e835b4863167ef29759b
SSDEEP 12288:XsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17B5523D2518955B1FAFD003D867A4428F5486E2C9B2619E3E1443E1EA27CFEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 504a64cb3324603e25ed1ec318d541e9618bcb2a33dd09e18ccfaa6bedbc0b3b
MD5 0998f05c8ac000e523377376654a16ed
SHA1 2869f0123724926e37807d5c76d9a5dadcbd4599
SHA512 de02dabb8682b759e4d91b97218912d08bd1ee4a77818fbabb636cccd9b99e896bd3e3ff117194cb844fe2694c9903fad6cb3e14a8269be4a53b9a301926c0b3
SSDEEP 24576:PALBUTI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PALBU8LNiXicJFFRGNzj3
TLSH
T1C3750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c71fb138f9b18961f3e31392feff9a7ef0b41a4d5104b39cc046b5bece15a51f
MD5 236a4fe3d763d2346850f6e7f7481210
SHA1 0f4e3920725ff50cef17bd465adaff090ca3102b
SHA512 b94afae3c9d895ea2b8b067feabf726b3093f94d29bfa6cce0dd005b62dc431ed917b274fcb2c7232553e3cbeb1058529b44f28426e683f3cf08433c04fd7dd0
SSDEEP 24576:nfYNHN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nfYtNLNiXicJFFRGNzj3
TLSH
T11B65F12F62AD18E4E57B913DCA828109F2727C66171192DF01A0827E1F27FE9BD3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9d4b0092d2ce2b341b8673af0c6e88665255071edbea02f1669193a140c7953c
MD5 97101045336a2c4080a23a743d94cf40
SHA1 3475f829f398306ca01ce34a268ee05e9bfd7275
SHA512 6f99555c006492ae5925216eba398cb7a453e5cce0030d02c9c751a54a25123e28e2c6aec9afa7b764e8cd1044cf30901be938f68c6ba4eb8a3b74153a68ef11
SSDEEP 24576:BnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK/:BnXoJJYH84VVS6AmETJas+cHBjSSKHPs
TLSH
T10465BFAEA2BC04E8D5BBD13DC5C24506F5B178651331C6CF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 af6f96aa563d1643a818e61691142e1820d59aacddc962c84c292fb22260c283
MD5 568d2af9233bb22df522f7421d8389b3
SHA1 3bc3bf87a7a7cb241740e8286975aba3beed7a5f
SHA512 b0a2fcb27ca975651e490e02d0d6d5610f6ed8e4bcc6b408cac4f693911c6042b0d5e751ecd5dd9c8bb7d8bb9df0c16b578ffef04cbd276a86fea7de78a72e9b
SSDEEP 49152:CDLL9TuJ0M/TYW2P2LNiXicJFFRGNzj3:hl7wRGpj3
TLSH
T174858D5EA2EC42D8E4BBD6BD85B79046FAB2B855173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 be9098c9c02739376711ff738700e1addee099713e216bcfdd6e758c0e8186a0
MD5 885b1cf6f562fbb0177a94d6267c3bea
SHA1 6af511d839399c140abf56c69f4c56273815a377
SHA512 5b7b2c081e8f7050b52199d18dd2a91fa11b1f33226c780d04f6324412c6f762d1918fd62cb93b9fd3954ab7e86cd0f58623ba0b83f7d646d7a2f0806f0609da
SSDEEP 24576:megJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wI/TwSfVcYG3K/cJHlnFR+IGNe8j3w:mngOJOmPOHkILNiXicJFFRGNzj3
TLSH
T10855CF3FA7BC15D5E07EC13DCA968816F6B1782603255ACF0160827E5F2BEE46E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 28f618f94a5b055dec066812efd473d626f485e68ceddc9ba4069e2e3c6c324c
MD5 597665586de3f0650f7dab7743537fcf
SHA1 cb16d995ad119a2e6f67385aef1bdd750f2578a0
SHA512 ecbe8a9bb7263240ebd2a180c5be3cb18cca986887fefd42f441f91d40572b3ad23c4c108578e9a73a60c596d9cccc961d1afe0caa9a8c3f7997a200194c398f
SSDEEP 24576:8LJnJiTk3R3waE4JrO2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8LJnJK8R304lpLNiXicJFFRGNzj3
TLSH
T15875E07DD2A810E8E4B7C2B4825A1656FF31387C2B2169CB55B4D5353F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c1c305c61ca23d45dc7f9cbd9a76a77c227b3f3d20824ae35399dd1f224d91d0
MD5 2986b84d7c62eb350243cde340bb22b3
SHA1 d0dec4e7de004ce1622e33984aa56d386020931d
SHA512 3a7420565a7bc23051c0cd461635153a29de2a5d5a8cc6156cfd32fd8586042d09b7aa248229bcfa3022baa52b10403434d5a9008d65a7980823f0a5af1e8269
SSDEEP 49152:o9GqCzDScAZmlvTcFg8Ph6SLNiXicJFFRGNzj3:Kt7wRGpj3
TLSH
T1F0955D05F7EB5298E8B3C9F1C96294159B327C509B34F7EF4A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 2a577c5ed586f71d061c3644aee41801397280e80c86e90373d2017af0beb630
MD5 4381ccc7a40a0251ab69330186e99049
SHA1 39d4e2ae28f22e7ef25817bbe19ebc39fe49c2bb
SHA512 118d3cb38be090269ce788c3889670bfc5612b70760cc45cfa09b4f938c4903b03f78a292d92575a5236f6254bcae58c7058024fe3f6be26a76ed9a56281b72b
SSDEEP 24576:4lYJeXm5jUuEo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4lYJeXmRUuEoLNiXicJFFRGNzj3
TLSH
T1BE55129E268C30F1E27E803D85A24414E361B879571217FF91A0A57E8F3AFE65F38A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 6e30fa0eed014f3efa82d7e53cdcdba90303b7ebe5e4435a6f09bba6f22af625
MD5 d5d48b4da7a2124ed826447c905b4b0e
SHA1 4428fbdf84e643a24a1c4d8a3d071e5d6b110b50
SHA512 f67b44d39c5a4cf1a4f60379f2871c983e524986cb1421875e203a39c695df0e503ba6584e484ccd1bd4db6675c23d76b9117fa16374cd0bbbc45ec1b7c35de0
SSDEEP 24576:wVtyZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wVtqLNiXicJFFRGNzj3
TLSH
T1E265124522C461E4EABD053CCA734064EA747C249F2147EF9190BA3F6B36FD5AE34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 10e0bfe672513103b1657968108926dc6d8bab67865c5b1c4b4fb4119cbd07cf
MD5 02251debf6bfcc7aa139c1e87689ccfd
SHA1 ab71e6538b1aa927cbc761d40ebc318b91950d83
SHA512 1891e60d9790423d228923af7eb619d67ee50bd9736d6c4e9e41f758eae5f78bc38471aaa22e7873cb5e18c2803b7175eb01968647c66cfc3bd64d50ab8faa4a
SSDEEP 12288:NP+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1255523DA118964B1EABD003D86364424F1887E3C9B2528F7A194793ED379FDBCF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1b4966590790deaa61498652203379092d3bc600d965aaa8e7aaee53372f07be
MD5 15dfe3bb86179280fec640af515490d0
SHA1 21947d4d7780cad1320946075ae6c56ce1f8b9f2
SHA512 ff1c615b98b2c0b2b654998e5d739a3b710f7288924fe87956b3132a4f25b504def2b91d87c0297d789e70a8ce9cf1ec16ffe6688954470b128b66c6b421bc7d
SSDEEP 24576:nC+TyQIu93VAumZr7jmL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n/TfIq+YLLNiXicJFFRGNzj3
TLSH
T1D0558C1DA7E919CAE2B6C575C8A34493E633B872137186CF2044C07D499EFE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 1efc4072b4305e1cab10e64ada7d81e2fe758c066c9907801b1c330eec442360
MD5 187020722ac7e9d24819124435a25259
SHA1 2aa1570447b8517a04445b84af00ec21100d4617
SHA512 fef3f4591e60b49fa6cb111515d6ea425c4ca333062023b12fb3af803e0f2dacf2ffcea68c7693fdd885f2a308fbaa5048d1d5192d7c49c726d046ce54c0d0af
SSDEEP 24576:9LQikZs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xQikOLNiXicJFFRGNzj3
TLSH
T1B065F10FB3AA00A5E1BB813C88554115F6B37834571267DF4290CB7E4B77AEABE38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 98a5f30ab50c319e229708d39828d1db97abb51137c38805d4819161f2c33cb3
MD5 5c8301269956c92b4bc26f47d0a37959
SHA1 054367e43ebbf24ecd8d66e813fd743f33d44590
SHA512 6ac45bbbd57b21f0432a669b721ed61eff7ee5d5e8cace62b5504861753fb6a95fc37d5ee0df4e9f2ff26eb6496fbb9121b5451c981dbd480ebe445349ccc203
SSDEEP 49152:NpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPZLNiXicJFc:OpC7b4+80GTkK7wRGpj3
TLSH
T168A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dc421f7576ccf3d72ffe1a17d489edf3673faef42ce625b1a244f570ca10d433
MD5 d2b46cdb83b699783ca89c5c2212984f
SHA1 e6ee7a26cf424325baa3359426b3462664cee59a
SHA512 f82502203f16a0c400b149d0bbfcf4a56a6ccc5ed77f636ab1fec881a4972199081244f3f9bd393d5f67e154e5477f00ad3663b0e3f31743744c7f272b51ab69
SSDEEP 24576:9SAwJPE1IDAo+4Kt+l4413lUQh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9qPCIo4Kol4jQhLNiXicJFFRGNzj3
TLSH
T15155B02AA7F956F4E17AC774C663C511FB727822133163CF9290913E0E16AE89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/768-334-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/768-566-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/948-459-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-465-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-450-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-449-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-448-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-447-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-440-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-446-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-445-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-444-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-453-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-443-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-442-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-441-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-436-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-454-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-439-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-438-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-457-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-437-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-435-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-452-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-451-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-458-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-455-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-456-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-460-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-463-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-466-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-470-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-469-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-468-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-461-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-467-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-462-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/948-464-0x0000016FFC850000-0x0000016FFC860000-memory.dmp

Download

memory/1076-376-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/1076-572-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/1108-325-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/1108-432-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/1412-330-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1412-563-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1724-288-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1724-426-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1876-76-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1876-70-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1876-88-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1876-236-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2356-433-0x000000000B9F0000-0x000000000B9F8000-memory.dmp

Download

memory/2356-390-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/2356-569-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2356-348-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2356-342-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2356-406-0x0000000001E30000-0x0000000001E40000-memory.dmp

Download

memory/2356-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2356-422-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/2368-326-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2368-328-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2368-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2368-68-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2368-63-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2368-61-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2368-55-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2424-364-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2676-260-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2676-333-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/3036-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3036-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3036-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3036-233-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3036-235-0x0000000000DE0000-0x0000000000E7E000-memory.dmp

Download

memory/3104-234-0x000001FCC37A0000-0x000001FCC383E000-memory.dmp

Download

memory/3896-431-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3896-318-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3896-310-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3896-316-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4060-41-0x0000000140000000-0x00000001403DE000-memory.dmp

Download

memory/4060-36-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4060-0-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4060-40-0x0000000000740000-0x00000000007DE000-memory.dmp

Download

memory/4060-9-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4060-8-0x0000000140000000-0x00000001403DE000-memory.dmp

Download

memory/4112-361-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4112-266-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4112-276-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4112-272-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4440-15-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4440-231-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4480-305-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4480-296-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4480-302-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4480-430-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4512-279-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/4512-284-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/4512-278-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4512-379-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4668-306-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/4696-17-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4696-25-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4696-26-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4696-232-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5064-564-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5064-427-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5064-304-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5088-31-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5088-81-0x00000000011B0000-0x000000000129A000-memory.dmp

Download

memory/5088-82-0x0000000140000000-0x0000000140136000-memory.dmp

Download