728f1ea5595e6ccd97751ead24e60c3f2de798e438dfd152bc804bf2a3ec272c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/05/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260516-c716dadv4m
SHA256 728f1ea5595e6ccd97751ead24e60c3f2de798e438dfd152bc804bf2a3ec272c
MD5 aaf6bd918df299adfb3ecfd4b124a361
SHA1 b2b4719253acc776dcca26d0d4a9f161ff0f1adf
SHA512 abc241baf858f09edf3b362ad945a7723a5263bf21e0afaaf254c39e8d87913c1824992548c1b591a76e6249475be6c8f70d5d33d46df59307e2e2ded8a0d7c6
SSDEEP 49152:DiF0hMRxuamFJQDN4qMvWXLEPU1iwgMO3rEcSqEEeXzTqzvcvLNiXicJFFRGNzj3:A3jO3riYcv7wRGpj3
TLSH
T1D8167C07E7B540E5C4BAD13D8A979657FAB2785A877197CB07A0871A0F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4436	alg.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
1424	elevation_service.exe
3868	fxssvc.exe
2164	elevation_service.exe
3688	maintenanceservice.exe
3028	OSE.EXE
4600	msdtc.exe
1264	PerceptionSimulationService.exe
1676	perfhost.exe
652	locator.exe
2076	SensorDataService.exe
3472	snmptrap.exe
1528	spectrum.exe
3176	ssh-agent.exe
1496	TieringEngineService.exe
1644	AgentService.exe
3036	vds.exe
3648	vssvc.exe
2460	wbengine.exe
1524	WmiApSrv.exe
2820	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2b8a93e5a19fe9b3.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc	2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d435c309bfe8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b21ca508bfe8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1dec808bfe8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088919b08bfe8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a396609bfe8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5b5e008bfe8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e56de08bfe8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4368	DiagnosticsHub.StandardCollector.Service.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
4368	DiagnosticsHub.StandardCollector.Service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
644	Process not Found
644	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1380	2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAuditPrivilege	3868	fxssvc.exe
Token: SeDebugPrivilege	4368	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1424	elevation_service.exe
Token: SeRestorePrivilege	1496	TieringEngineService.exe
Token: SeManageVolumePrivilege	1496	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1644	AgentService.exe
Token: SeBackupPrivilege	3648	vssvc.exe
Token: SeRestorePrivilege	3648	vssvc.exe
Token: SeAuditPrivilege	3648	vssvc.exe
Token: SeBackupPrivilege	2460	wbengine.exe
Token: SeRestorePrivilege	2460	wbengine.exe
Token: SeSecurityPrivilege	2460	wbengine.exe
Token: 33	2820	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2820	SearchIndexer.exe
Token: SeDebugPrivilege	1424	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3452	2820	SearchIndexer.exe	123
PID 2820 wrote to memory of 616	2820	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_aaf6bd918df299adfb3ecfd4b124a361_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4436

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2164

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3688

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3028

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4600

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1264

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1676

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:652

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2076

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3472

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1528

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4100

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1524

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3452
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2b6c11a5d4cf5d636c1765649f205fa12c68cc7ae503ebbefea815d389ad194e
MD5 a1dc0b3ac06d81cdc108cf7d6d56fb8c
SHA1 a58cea0b126440e9d30eb407e004774607cbf86d
SHA512 7c2b44f6f798ed2c5809a4b843ab78a5feea9cca16e886049138583ffe4096ab2489153ac0702f309b58ab8f90bb8067b733db40159ea088f7be5ed383ed48b1
SSDEEP 49152:0b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnPLNiXicJFFRGNzj3:u3q6mjB87wRGpj3
TLSH
T115D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 d39419034fc6a9b9e1f71ff76860cb4e680da8e3e3169f790545e0f6efcde8fc
MD5 0804090bf56f6386cfea60968a62a7d2
SHA1 241e91ac72f3fe59195cafbe4b5f3162878f295c
SHA512 6850b40c26c2c6bee3c770d45b2948de24862d76b67877c82a18155362173bbc395949fd448bc84a3c32191be888918f47e4db0011d29e5bcfdacbfcf5184541
SSDEEP 24576:4XYfDtczAQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vtcBLNiXicJFFRGNzj3
TLSH
T15F75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6335d805bd0714bd9c6f100f57b61a4466195ea209cc501307a1553cccd58e82
MD5 b758a8321a8adb486020ee4539e5d172
SHA1 9568f5fcbcc3312169cfcfb1abf9d77436fd0831
SHA512 95264a268c8506e988bd42c3b69bde612f10b9a8c7a17eee8aac879d8cc4b3d72dc182888de6886e1f92129c1e6154c81580d6618dd91ea5224a919babf4dfe4
SSDEEP 24576:u0Le5ji0hmxhrMH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uPji0AzWLNiXicJFFRGNzj3
TLSH
T1AF85AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1e71b5d6497470a0db55a8dc6f0abfe983394293241fb0a6cbbbe5d8def07e7c
MD5 0b3b31868a15245431ff8f68b111c136
SHA1 a05346852d6b2324e226c86177284bac3b07701b
SHA512 a81f1aee3558be0749526847768fb0a991796ef6727fc4d49e4c1b8191da1af8eeb592ae6295c7d46c39725b1f4f7ab9211a7a0a06a4493ab1a154d6c1417454
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWj6q8wyux/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5/ezSC6vUzPv+Hjy6LNiXicJFFRGNzj3
TLSH
T1D6756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b18991d6f85d7c66bbc54380cd94ec7efc3f5e45295ffbe8f9f6793d34dbbab6
MD5 762cb979ff8a5abba904e44cc644a271
SHA1 d181cee80415d6d44f7af643cfde2508d43a7121
SHA512 d0a36e77152902d82f952bf5fb5528c136cf1d624b62dffe91ebb49a8916603a46802a2bd61671393da17c3494ceb2e80b178998569651105dd5937c9881a001
SSDEEP 24576:wVbqPb88hv/l+Bs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wVO88hXl+2LNiXicJFFRGNzj3
TLSH
T172559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 68d3fdc380f21fd9b0ed72d617af158de05304a2fe1d2bddab60176d7963a7ec
MD5 7ff9a30869c78f0b6f2ce9b5dcb278be
SHA1 eab360d4e6d2c7e7996d2ce7b796dbe8932539e0
SHA512 c5b27e924543e6ffb5a583cb74f0fda11e49ffcf50bd429b651d96499f9183843c01756649221d77706b0882ca0aa0f86a9f747f7188dc6b9a93a130eacc77eb
SSDEEP 24576:kGT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bLNiXicJFFRGNzj3
TLSH
T1DA5523D3468854B1FBFD003A867A5828B5845E2CDA595DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2e1a05940522597a54e5a496014237422e5c65107ee7f7ebf9d73161015196a8
MD5 c6915b1c4203acc4ea1ee07a86b54dff
SHA1 24132283f314facaece83792ea13bb78be07d4d3
SHA512 c9ea7b1d7cbd732bdbe72d75d0b0d86ec4c44c36781ee24ca045199e5f3879d15e320f9265d4a58489fb444adb003b69500847edef839770ab9434b56ae5f430
SSDEEP 24576:oJIUk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oJIUkLNiXicJFFRGNzj3
TLSH
T1CE75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 055788a2d6683192986e3aa0eddc2e09e73b6cebfa5068302be9ceed42bc2fcd
MD5 f3fc5bf8f46ce1ec58dd6a8fa6d593d8
SHA1 a58bac4f69c20554cda3effc7dd356b0c05b9d38
SHA512 88408906b037dfab5f73452e6406493b4143c943ff2ed98352598a406802f76bb540cefe9b9d0a96c561a5eef1b3a2b37a7e767069a7df60081ad6aff1d1bf7c
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH6:KQvGAdlCEL8c/WRNw5Ch7wRGpj3
TLSH
T13C266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6d70d8b3da6728ee0614cef79dc8dced4e65138584afed85503bd70fce224eff
MD5 dd9268f07e59d877cd0b29c5745e3ae5
SHA1 a1c43505dfb25beee33aabf06d47405a237de77d
SHA512 ad0c4ab2f63115c7f87dcf245b9309f67fb95b111527187d8b66e7d6a071ef39c8b4c020fead5c9e148ac7f54fb97d6a83c0d8bc52703f717a388cd9b8c8bfe5
SSDEEP 24576:lfewsAjG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5ljGLNiXicJFFRGNzj3
TLSH
T1DF75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 89832e31fe40ff5594858169d46fd7252c8c664b7ee3f16fc04162a7a8dd6451
MD5 2ecc6f2ab47591586234853f1c7918a4
SHA1 db0014c3088d8870b152f019719f38c907078090
SHA512 adbeb54b03f4b945d37b9004e5820ee8741fdb1067486bf94c3a3ca294d77058517a2771d21396e10b64715f399699a29ca96f848b48805f600a89042a4c64db
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHCF9:fUEtQevvqc2W1cpV20I32W9
TLSH
T1B6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e867f2f269c163e98bec36e2ccfbb12d4c980b860e948449005317b1483bb49d
MD5 9afa2e13b999be0dac0d27a824a16827
SHA1 8b504b921b40897fd3b7397005d02c1fc7c3e4ef
SHA512 98144a37142b7cefc63e54b990383edb4b28f1a50b9117cf39289a806fcb2bd0840cdf91d57faed59308a9e2a7e962517a4224ec3aa62e1f3672949ce310f104
SSDEEP 49152:NCbRquA/m2yL5zLfFiV+XenmE3/zmLNiXicJFFRGNzj3:qoq2Vjnml7wRGpj3
TLSH
T1E9D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3e3b3d6c5646cb07c44c98ee6be3950c8c6af4fd081db2823ea18744c03f86df
MD5 6181b381b6c49185a780bc07457d38af
SHA1 c6bcf859d200abdab21fefba7e8626310f958f82
SHA512 4c6b2a0f6e47064bbe196e3b105303a8e66f7383f1328eb1950ed13d159902284be987bb885720a07268341e81303308c7c04731c4506787b4ddeabeb50b7a76
SSDEEP 24576:SAhGL6IFoiwtA5l7S53F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SAM5Foiq5VLNiXicJFFRGNzj3
TLSH
T109359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 34f0f572b778f154b14c562e4f5d90619e25bd86661ce5942dd7d728e060ddd8
MD5 00d3dd4052268199e74daa5a813e21c0
SHA1 02bc970ef4d1733511270991a53b57fbbaa2ebcd
SHA512 f28a7a85a39d2739e9e0191afaef943ee037782adc47e66272cc0136702ca47ecd1e86f082ba47938ff58381988faa32868faf956e1224003ceda3ecc0937e36
SSDEEP 24576:gwuROWa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gwSOJLNiXicJFFRGNzj3
TLSH
T1DD65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 454abe4bd11d2039695897b03619505222b1f6ed7102173e2d274f6bf5c5fc8b
MD5 ea70319b4a6d4997d79b1208941ec95f
SHA1 3b65b5190ab13a55642d1d1f25cec1bd99c3737a
SHA512 71946100d9f5fa49974617adc3411b9b26363d27cb5554b93e5d869b26fb900d67c2484b424ec6afc957384f4756b8965ea8442430f5b08b1a051438021cea7b
SSDEEP 24576:bZu//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6LNiXicJFFRGNzj3
TLSH
T11555129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b3056c5c117600b55ff99e3c2183f52d7147f20255f2c6985afd5067244ce289
MD5 f77fba3a0d6a9bc4eafc6dd13a125fdb
SHA1 d666eb3f0fc8583217b64fe71d43c50345165cd9
SHA512 d8278fc5467aac086a063ac13cf9abbd8d9bff42d3983cdf6f3c06c165501371032429bd1afab15895a96555031b28f1557be961198f022385b0e58833142cd7
SSDEEP 98304:5QRQyi36YOcPDLvw2gAf+PN3I7wRGpj3:wQyiKanX+PNEF9
TLSH
T13B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7a397dc05b4d462f9e013a5e855f7f08d484e338697a3bd8dff92fe0c1289baa
MD5 30f3a5a2ccffc5c6324765bd9ff31a48
SHA1 46033639158a600c9861225c59dbcb9c5abc5063
SHA512 e0540247b09b9654e20597736187028424a3fe9903da94419090158d2583cfa4de83b0774b96403f18fec88408e4076c498d55d07a82a86d768e3912c346cc4c
SSDEEP 98304:xQRQyi36YOcPDLvw2gAf+PN3I7wRGpj3:oQyiKanX+PNEF9
TLSH
T11A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 de87052647e8e9ae08b94bce5a38053c9b4c23034452a2d6edb0d9cc1c9d54da
MD5 51db80cd50e995cf88d996c744521c1d
SHA1 ec57adfe321883b317eed936a4a5b6c6d2ccf4d7
SHA512 0e924c75d5e38efa15225ed4f208b0630f0cda1f807761a64d6632582a69e6bcca06023410e68948c35af65d3f4b3547520fb8c3869bb1102df46d7561825b58
SSDEEP 49152:468Qg55nhkeWu7PNU3/WLNiXicJFFRGNzj3:CthTRc/W7wRGpj3
TLSH
T15FB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4d0df78168c2af5fd5333a9a30446be76764b76be91c068c8f8e91e086631651
MD5 21c80b6f137c0e550dd875014a960f5f
SHA1 2c1e9a5b8b195eba1a78b2f971a8762653df400c
SHA512 fb2208edc019df31559aa4aae107511ddadef6e8b0294531d8753cb09cfa2733ed1bc4801105547dc1d3fb131ce8feaa4ba0d6f8b18f74638c11e44a42100fbf
SSDEEP 98304:py5112gYy5azzVvU69nLKnhZT7wRGpj3:ELIHRWhxF9
TLSH
T163167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bff39f2b66de36c027c7474ca0eff2fee6d1d32bd64919a9f27b633ed0815e27
MD5 d468b1b0f9d5591132623637b6fffe47
SHA1 facef42a3842419f9d7e8494b04331792fca465b
SHA512 bca5330273ba05932d004981445fe00fd9439e202cca7a93b5ed211c6abc9c760d02907199cfafa2fd7d7fd559d77ed480798e0f9bb24173fd81b665569e0874
SSDEEP 49152:TB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glgLNiXicJFFRGNzj3:lu6JmIxd2dg7wRGpj3
TLSH
T18CD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4ac1796d32739f605e9122d6788f735f791b1861c8458d79dce915339a953daa
MD5 b09211e579f7be2a00d3509b4135cfd2
SHA1 7d8f2e8a156b9a79b4102c11bcb5194014a970ec
SHA512 d8984c07e6938e56a9822b4177845055886baad28a1b43a6df4e7663cfd02207f8d01d690c30dc87c3c1c143f77206efce0b16591112d20bd2f6191a3f085d04
SSDEEP 49152:J1hpsNoJpF1A67U44CwH7R4xELNiXicJFFRGNzj3:JmifPqRl7wRGpj3
TLSH
T18DB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1166b1fe2f3bd612a0b0a0741620233b92c2904465bb96f416e41a9859c75574
MD5 98c823c93e3769fb3c3f8c46ee3b5ae6
SHA1 ec395cbad77b82eaad9bccb8f5f4739a58791d0d
SHA512 1a507a89ee14f0a6a378daf859dc2ba66c21d7076d0e6866e0e35a8b8744ef1ec4970d0ec92539256c10ca90827dcfd4207d5f6ef20d1f1c492802516930278e
SSDEEP 49152:lSuZQIY0Be2KkRVtOnks6NMHq/LNiXicJFFRGNzj3:r5dKqi61/7wRGpj3
TLSH
T1BEC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 785878df5287adc484026ea2af8170ca91db4e884818bbcaa8a2ddc3e0ad4d94
MD5 fa0c65b34172ea0042a6dd24a8a7fc21
SHA1 c876d012d1869f37735d6d10cf95f07e919230cc
SHA512 fe039f8b70ca638d4bb20eaca3f38376149d50a7d51c909ee2936109a9f853173f7ac6050df33e39fa84c76550c9779682362877831a6f90b01f26325236c4be
SSDEEP 49152:fhtSn8EApI0figjgiDn0AP5wQLNiXicJFFRGNzj3:OX2iWphp7wRGpj3
TLSH
T1AC95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d20fb61130dff4794ff55fd463d15430d9e9d0f7098da6e45baeef9b114481f2
MD5 b5bfc3b5008fd7f3865ef2ffc652d315
SHA1 df9d7eb4ce8214d116535dd1a56eff337590d813
SHA512 d4d19a3f8124f39cd135219d76cf187e3a2f28306fb45a97e88286e808c88a64a1d51fa44a9eef6bcba92ccda77c5a22586e4d967dfdda1097bf4a18d13c7ca6
SSDEEP 12288:J/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F85523D3558955B1FAFC003AC6754428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4f5a8dc83a9faa176f4ff305ce1c0c101315568ab78a5163b908de360c9e5720
MD5 05612f8699f3b805a24c34e397a53e5d
SHA1 0926e947b028100b84c8938c92fc06fd2102d263
SHA512 d169d82c7a7df4ce10a46f878371940c9257f1f95be49d6dc0576fb6341ad804e9ccc10f2e44d86fd765336484424fa1f1f3709e955d601218323bd7483b5cbb
SSDEEP 12288:vwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10D5523D3558955B1EAFC003AC6754428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 59681b3106d565a557ed791ccb85c286e00de48a08d8c687fb8c0b7d10610929
MD5 23a5bcca8669a000346daf71b291f1bb
SHA1 a482962f35302f5ce6825a56a1de7c904d788514
SHA512 8908224c5a8560c8793ba06dd074ea6da7b0a63029420a782e9f8ca6a371e8d10088f88866200449897037550ee42d49810309b0230adc0171d4a21211ce3709
SSDEEP 12288:ZaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Z8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1425523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5f58e68142e4ec1e6bb84617d5b88451f1eb42db1f2114ac39e8be2b2adcdb96
MD5 948749b9d204b72aee3a50822544dd35
SHA1 b4eae21f6128339bf56aa2c2050fa987aecab262
SHA512 502e5b0c8c852609e2bcd7bd8f560a3fc0bd55b1636741d6d3e205743242c905a2af371efc52d96c032d633c245e694d6d20ce719f405157d3f6c55cf53a0fe7
SSDEEP 12288:YV5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C7552392168900E1E9FD803DC6764424F2A47D6CD7325AEBD3003D1E5A75FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3ebea39fa9d02200a26a6e6574e3d784fd849c8af19d76d1c4054691e6c98c8a
MD5 fd8fb94bcf6e9edeeea1e2bbe2cf7345
SHA1 e0ae56f9e49d0a5348ca6cfd3096cae831a05c5b
SHA512 7a04dfbc08e6ccfc22f48ca5bcdd809358c4c5cc81411268735c11d2980d8ae38b7bada371047aaee2157a0f19fe0fe60c822385b73eabfc0d67f90fd8c89f5a
SSDEEP 12288:7BiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED5523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 11bc780330ec4291eb97703dffe8711bbaab10c2b924a89d7f85df75c82b5579
MD5 adf77ffe776a55975052b3ebbc63442a
SHA1 dc3280a6d0c38947803530405a752310218d33fe
SHA512 028e9ed2e3c71782e18db9241745e07c89f13bc0a0189ea070d15ae86c80e3dbed931f2f2cd73e60308085794df9f42e1770a3e50a58e17587c736f02272a2bf
SSDEEP 12288:Q0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1275523D3558955B1EAFC003AC6754428F5881E2DEB5619E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cebfe762789c122c67a8df05489d0f7ee736a39559015a599dde97d806aa62d9
MD5 a75a4a7299f9d602a22700bb3fc2291a
SHA1 66f8e609c87c1f10e8ce69cbc4385b27fed72d33
SHA512 477c28e89129aa55a308ff40c60033bc1ebc11770f8bc8146786f2dc26da579c5d32a74125b7da9607766772e0c8a160eb6c85253e9c084792e1ba21b17942d7
SSDEEP 12288:KYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D3558955B1EAFC003986354428F5882E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8924bd6545442dd1a7dd83f2ac3523f7c324fe21fc777a2809453362994e6dfc
MD5 42743dcfba1b89bc1aa72ce268383271
SHA1 094a61dfa9cd67f94175c4af784d12628931d57e
SHA512 612fbb4ffb67ee8282fa6ab2f7e64521ec8ec7c32ee90238a10c82e10353da5aeac23ecb824ca1359401426c0871fec7fa2c255202c20139a413839ebf6f9dfe
SSDEEP 24576:5ZM3zFVSOC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5ZM3zfOLNiXicJFFRGNzj3
TLSH
T114750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8dd04d9ebb8a62c6f9663a94fa8b199f7c129f185e116bf8af7294b8c9c11166
MD5 d28068e84db847f68a3dc36a63de94fc
SHA1 04575b6dc42d06bdb6d380ca682f0484110f52cd
SHA512 587f984db709168ba7a4ffb360b3da83c02388d1f28b609e9e1a7a777dda201528c351b3324d45b124a7fc4c771806c0274710c3e64f0d14d4f0f67922719058
SSDEEP 12288:O7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ov/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FC5523D3558955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 329e26fc6ffb2badc2c467b37d8fc093f89126e5bef47ca142235e00fe668e50
MD5 0d264aa236df0f7732531b8a20551b4d
SHA1 d11d204e382120f7f9995f3c163f5ccdd90eca1f
SHA512 57bde6b1323801503a1a4a496a6d92a20bdb8973039e4a89766abed1a53083172a3c7ba6a64d9d8123e6cf9c5f9ff7fa3cfbc146c42bdee8618a5d4ff70ee3c5
SSDEEP 12288:13iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF5523D3558955B1FABC003986754428F5882E2DEB5659E3E2083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 6f16444a7dfdfad6f0dc33e1e1c6c053488f23710f222d10a87bfb3361cbb9da
MD5 dfcf67de2d7ce471704b99703bf6dc45
SHA1 3bac9048ebfd2ca013f4d307c2153e4f828e7bb7
SHA512 8e6c0a963077b7aa8ef3277fc61fe5943ce103387f4c4e256337767a9f4deb62c91442e8ec76d58edb8ea251911438adbd7e841f86a356fd79b583175240a7c2
SSDEEP 24576:Tzy2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TpLNiXicJFFRGNzj3
TLSH
T1E6650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 59d53cd12a927803bc7833050b4b58fce57e0291421359d4899d8dbcdcedca8b
MD5 c5fe41c9320c4d0afe20640719e36316
SHA1 0d2b624c45bb1d6dc4dfffc000cbd7dbfbdca9a0
SHA512 30905657876efd43a00d67359afe999960fa9aa2cb58d2e406f0dba73bd67c9101708c89ed04285750aedaa8806f00df232821bec09849428e88fd965fca941c
SSDEEP 12288:97iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1945523D3558955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 05aa1988f35b7642f0d666dc5a2de45b9f5f934d2eaff33dea4cbeacb2cb8470
MD5 4856e64c424ab9f7d1bdf26d8723dc49
SHA1 3af2925bae53a412005b6942165f9c220616c3fa
SHA512 22f6d06d75414d95c9346b629b519462d4b5d7b15af255f822576930aa52c9c4a5936c7d04b24f233171e993f211e4ad005678a3e51c4acd5b9ff9ba55360ded
SSDEEP 12288:M7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1945523D3558955B1FAFC003A86754428F5881E2DEB5619E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 b6cffcafe7434999a384393ff80fd2cfad2b4072d58037d14348ee98e40ff2b5
MD5 1de4b93a020299354b0fc33b9db339cb
SHA1 6200ee4a93dc733ebfe103eb4d6646bdefc9d358
SHA512 69f625a39622e05dddaa85fe047d6cb576f3df94bbde3fd3408363548b2250b6ca4decaeae1d4360037486e3039e047f7d182793ffa217e3d0548fade81ec1f6
SSDEEP 24576:pzy2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ppLNiXicJFFRGNzj3
TLSH
T11B650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a1ff0419d7e814643c9a717c55d6a01aeb01c7342f33335c7ab1a298ebccd8d7
MD5 9a22e7b4c684a2a47c946b9c7c51b5ff
SHA1 d81c7c6d5f73d4dc44426fe785eb4f2f661a99d6
SHA512 c6dabb9a53f3c786f15641120b9e3531203eaeec25586f84898a539ce5a1068e1e8ceec783bd25bec0210d5fe8a24dac2d62da36344264001f059fc061cc47eb
SSDEEP 24576:QT8aLl3z0zDM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QT7LljxLNiXicJFFRGNzj3
TLSH
T1C77502A5B39018F4EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2c26d176a0fa3362e696bb575c83ecd00b4f51cefa6caa5de4ea5b0f030c5625
MD5 e05e430514dbcb8fe95cdac4b1ed3ef6
SHA1 30be01892c19fb2b6732c39cd4855caca8729cd0
SHA512 2f6b8bddd0b9d30e4bd9fd24bc9bc99e341ebf824460506040669be8c003923454bf3bdf6945db1db6b81ef80a941f75c4264b9a2eb64571b756119149ae4b17
SSDEEP 24576:43rd9CHKy7GZo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Crd9CHKyaOLNiXicJFFRGNzj3
TLSH
T1C385CF90F3E414E4F1B78A3589764511DAB67C5A5B31DE8F03A8261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d709efc24b4032089ca7cf05b27143bc69577a4e32338e16c69c574ca3e6455f
MD5 6d0b54cf03f0bac59426fc152ceb6f3c
SHA1 734fe05529d9143a4d36e1208bea42d7c099a0c9
SHA512 55ddda98ace58b85598b8dbb1fd14c0a89d650007fb9408385efdd37f51bcb10458eff67c1259ebf85d7b53cc5f37b3b9ae80a735da546e856d3e0181531a1e5
SSDEEP 12288:m6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11B5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 faed50230089ee808673a82ab57453277962a5ddb4d483be4c2821e6faa27e25
MD5 3c250367a465e7c8bbdb3d9f80c687a3
SHA1 34838604c5f52f18b4450a0575d3aced89ce1712
SHA512 5d02ead0cf3dbce6bbbec85dc8e5b655bf6b93553f27d247b5c6292daa456ace276743d44fa0b0641acfb4c7e4a07f9e90927628ebadd500acbf8483e793de40
SSDEEP 12288:gsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A05523D2558955B1FABC003986764428F5881E2DEB6619E3E3443D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e37d6e4273284b77376eeaea3ac2d84be099d7ab1771a9ee59d1d2a588c54603
MD5 d87394626b086093b02ceaf3f5dff06e
SHA1 71fe8cc16b95bc7bf01e08bfb1b603be42c0968c
SHA512 1cfff02bd6f45bb45a3d305d7f77afaea7c22fefb589386df0f6d354f3e05ace96b2bfe46dd9fe91e1c56dabbdbd00d17b1698e93f3dea1f5813ec363e5ba0b5
SSDEEP 12288:G1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17E5523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 43f9b5098b00ce13bbe81fd1dae94908ad791b30c065a3dec3cca82ee6b8a268
MD5 0d502e8e3465fc2636a054b880f638b7
SHA1 b16e0ef723e3274928c9f36b054cfc6d79b48b09
SHA512 5fb02ff737f0ce1323eea74f5e26e517fb6f8f0aea9f70157b5ed851398b207fb536ca0bb150eb56024fb2d7bb6a1f7a6c1eae9d6f1f1f2b8536cc7a2e56085c
SSDEEP 12288:bpsfriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10865F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c8ca0e3330b7e02da009eb1248805d776369b29ee85370d067c70ef0b14d4e2b
MD5 974e4f9e155fbb33506448469b3895c5
SHA1 b3be663539c339937fbfa78a30971a3a33f0961c
SHA512 f868c0ae4aacf6bb7027882b18f8d8c27b40d277755118c10aaebc9c05187383c436a2924282fb92b168a7a127119ff451c0b775456b82d2fa2764a773435749
SSDEEP 12288:rxjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F552393568C55A2F6FD103985368438B5497E2C9F5598D3E2043A1EA138FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 88b8b3c22e564372cdf120cc74b1b01a4834ff6a7474674c5b8f398fcea2a958
MD5 54e24efbce1f22f58d1e8174e554a7c9
SHA1 c940e3aa407bc6f9bc2fcef5b6c5e6fca66ec3fa
SHA512 9d1b817bacbc378893306b3c99f96e9ba7a8f72e3e0f608399f7eb5c441c0f8db940c2c5d615a26bf22b1084b00ecf1027b81d89e8d745523f6272dee6c700ec
SSDEEP 49152:pa0h2GEkuAe73q3pp46zwwQTLNiXicJFFRGNzj3:pa0hNYG4Jw07wRGpj3
TLSH
T15985AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 c3a4a04f7f255fe285cb551c0c25a4812070187fa5f55a911e895bbdd25b5951
MD5 60ba22bbb80e11df7e7662324129b81a
SHA1 19cb0e0de37a252635d425692e1a198d8c6fcc8d
SHA512 9a51e922644e0632bd7792833e0e1c9c7275591e79b626f3d72ef57af93333f868f23c53cec3a984021b749622d78c7ef050cdaa6d3de5ed8b29626562f9774e
SSDEEP 24576:KhbHjPQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KhbHjYLNiXicJFFRGNzj3
TLSH
T1F65512BE129C20E5F6B5903D85668409E370BC29172197EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 05a5622dc49dd94dd329a8164ff5419abce69832ac0c6d4ec28abdd5df78c547
MD5 bf9b52d62bd213ea92f920f4c0b68f2e
SHA1 f521804e1a0fbc587f14830ba05b8fd1740f1e69
SHA512 a91449be295b355e9e85d59de8dc1cea7a9593c5c3b799b1ccf829c5b73c534774bb8cd27c2613362579a2901ff9ec1dd1fb295f51f9bbe970251b0599701a28
SSDEEP 24576:w3YgnJcRTk4yti+R5dBR/o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wIgnaTk46pBR/oLNiXicJFFRGNzj3
TLSH
T1E045B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 6f40695856db0f431367c025c03950a25eedf6d2fa852c8e1b80cbccde87e278
MD5 aa7142efb679ed6c6bb66831fc6ee6fd
SHA1 cbd988fd4de0c48f1bb59bb81257c64d5ee3cc34
SHA512 19db9327892c776ea38f7f8c75001e962c7a1dab182ea30d1365e57699bf98823fb8cea716d620fb70a6a2d1bfaea51a3dbf0bbb149ca6a61001790929d68c6b
SSDEEP 12288:StjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:SV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13A5523D2518955B1EAFD003D867A4428B5882F2C9B2619E3E1543D1EA27CFEFCF38563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 5075dc1ad929b2245c24eb224722479fbe95ae42a930349c5312033798c998af
MD5 09428f3965440ef49a3dd99437538894
SHA1 27149d90a93bc47a5c3faeb652eed70cf62c83cc
SHA512 41dc83f57d8144024ca3d89926bf602ef1037f398043a4d783de975fe58913bc34ddfe50421e78ef1f97489d069fa750b53bdd8c3ee1bc8f13336a669042099f
SSDEEP 24576:JAL3UTC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JAL3UGLNiXicJFFRGNzj3
TLSH
T181750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 dcc67b83efd2f551f548a2efb95f121cfad6eb0daced5ca5e9b35fb25f4921c0
MD5 ada361803c7f8cb6de47ee5259cdf2cb
SHA1 81eb8cbae094c0820f18f024434a6083e33f92b3
SHA512 495157227dffe0927e582841f098bdadd2487648586e8d3d9cb4ea473ce2b0ca251a715af046bb958f32cf3f4c7859ffc65dc7ddc27561e21f7c419a2540b8cc
SSDEEP 24576:ZOm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZOmLNiXicJFFRGNzj3
TLSH
T17255126A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 05fcb53d3d431d00c5ce0a45a4dfd429ed2d6af8a20d7ab31fe95145dfa67c8d
MD5 29b4bbfcaaaf5691fcf789d69dda6ad5
SHA1 5c5989e70e6fd2b409d2ab067eaffbcdacf66615
SHA512 cb3335df9ef832cdf15e29ba6972501e530e59d9e7805c5a3248def342a29caa9058df3a47d5fc5996a23c674e0683ceabd17e0469d52932fd95c15fdcc94f0b
SSDEEP 24576:A7NM9YqZqmWMUkPjZM48Mv6bEhsx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A7cBWMpPjN8DbEh4LNiXicJFFRGNzj3
TLSH
T17765AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ef57258e3f00a9f3305534f9a729a4bcae90b841f1b68444339f00d9741ab2b1
MD5 ec11f4a22f2928174ea3a3a208abd547
SHA1 592c21ccd28359a6b2314848702cd9adcc416aa4
SHA512 30b28c91e92d7d79ed7e178fca7857594f7267df609d94de26a4cff0aa98715caf9fc0e8bf1f15bcebf87ca99f26a04a160547e406a7e59b16017af4486dde0b
SSDEEP 49152:gF2YuHNETovAvNYf8kmRLNiXicJFFRGNzj3:16BCf8km7wRGpj3
TLSH
T142858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2acfe9c8fe7ab7a23a1d1264ce23ba83b3d52715f2743cd96530c357aa079611
MD5 b58c1b7523ce10742d701c5306bf01b4
SHA1 99d0e5e5fc66530220c4dabceb62d5d7feb6f128
SHA512 02fcbf7d6a6bf88922e4691c6e8c54e0589df9614faf9776e848feef5ead2b809df2993779e7097ddf3f213205432f79c863628f817b0cc3b06629081e9ae94a
SSDEEP 24576:ZAFs06+Omlf8NXEbToq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eFs060loXuzLNiXicJFFRGNzj3
TLSH
T1DF65BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 10329ab9212d312fba36b10888d3b68e6f6cf5875e08835ff7ae3ed0c52d579d
MD5 a8c39d451158707bd338d87a58286700
SHA1 a9bb1918f704a40e977440062596feeb8ca1e535
SHA512 85cbaed457e8a923bd9334d2add1e195dfb7833b6c57b44234cfa0cb43c73c472a2c9c0e910720b81910ceb3ab7de99a3f9fb64c69922c7afff643f087463f82
SSDEEP 24576:GJnJ5D3WXz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GJnJ5DGXzLNiXicJFFRGNzj3
TLSH
T1FF75D02DD29810F8E4B7C274825A1A55FE72383D2F2269C724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 def6b5328f29f418ddcd2bcb465c3debfeef5d5d253cb89608042dc6fd4eda6d
MD5 5596590be447a56734c3e56f4a2a3e87
SHA1 7f57834c65e353f7e023f12ec52d159e1571ad1f
SHA512 451efb5830e3013bc2fd1b321f6f10d002034568368d8f6436b836163005221106a4bc105db0ddb83f10a730f38e8c470c1c014133341da3c7382926cc9d753a
SSDEEP 49152:Ug06DIKdwc+eQnSt65aV9LNiXicJFFRGNzj3:Fv7wRGpj3
TLSH
T1A4956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 2110b10dc49ddbaa34effe5970b9cd4a1fd181e127715b2039c6c746fc406e18
MD5 e58ae176c2a2829fb875dbe9ffd65c94
SHA1 93d188bc3fed3afa34f45eea52f6d4bfa404a9ab
SHA512 f552dce2f7d9148811587d7085db6edb7cd12d4283ede66646977d5dc4fe1b06e26fc3bcb852926ed31410d6ec4dd12eb8c966476e153d23a348885168325714
SSDEEP 24576:qnX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qnXLNiXicJFFRGNzj3
TLSH
T1B85512AE278C70E5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 b221e6a9fe7f05990c64465b39eefa34fd636f87a1e7053f88448ce231550666
MD5 904fff90c1576d7cf946976f54ef7cc9
SHA1 6cc698c14762c93df9e20b9b66e89a62c42a7473
SHA512 cb2d5ab68d25b304defed1a4ca7636d13f61133b460f29c124c740f9cba46e0a1d59a18cc588079ca33665be7264bed68b2aa02a3d3d7c1f3ab44f2de82eb5a1
SSDEEP 24576:WIyI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WIDLNiXicJFFRGNzj3
TLSH
T1B365124553C860E5E6B9013CCA778064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 073c0bcad1bc033b27a2ff5721ec6cc0c30c9e29e53ebd80222a8e2e8b943394
MD5 40aea15e8198fa6234e9ed672ad46279
SHA1 fdf49c9983104f8c50bfacc61cd500c4ab8c12c1
SHA512 a96bad22d1838af6d2280944796ca7aa574101a7e211653712b15494e6aacde4951a0cbfc697894b73238ba73ce24c315ff45d19de09275970671a1c04561480
SSDEEP 12288:RysjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523DA118964B1EABD003D86364824B1943E3C9B1628F7A1947D3ED339FDBDF38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8865ab950bc55228fbe83c98eca8d9d8690d035afc349ff9091b36687ff03dec
MD5 45cc821feaac02e16e1e5dbecd8a6395
SHA1 b230898b4d7331d10d946c176d820b6d35d217a0
SHA512 cd3e7676d519fd1a30f9cee8fcff78aa7e0257481b8d64159c9a93991599898cd1bef985ded5ff1cc23189c6a5889b927ad07556a80b696446e45386f4529eab
SSDEEP 24576:tQ9MxZKdcz9dw3Z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tVKZZLNiXicJFFRGNzj3
TLSH
T1DF558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 906adbef93ddbc9e877bbfbd8527998d81f4556cb4b83407777b6f9d003ceb9c
MD5 93f53ce5fcd37c8579a5c58234a017bc
SHA1 c4fe4ddea980035b7b5709064d30ae3603fecace
SHA512 87cfd69a8de85421a85fe3f9c262450fb9326f3a2295086b640504cf8eda3ad44fab6a6ad2b0ff4207ad7a0ce100e8c4673cdd214d886dfecb9fc62937d91bac
SSDEEP 24576:JyocDApc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kocDApcLNiXicJFFRGNzj3
TLSH
T15C65E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b77c6f238c94d1a906e486f10abae231d57f419dcb41dcbda1767416e7bbe01e
MD5 a708dabb49685c24c0f79aa986f4ca73
SHA1 74ac4f088f136974c1c3c9a835e3d68bcf7f29bd
SHA512 d791f06d207e034ca37e228ad60dd60cd205e3797e8a5a2296bade1e5417102751386b4dc813ff6d226e9af37e87d97525f99685263bc31e19fc18b4ee55d582
SSDEEP 49152:qWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKcLNiXicJFFRGNzj3:s0zuNIC7wRGpj3
TLSH
T14CA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5617409dc04a2d1c8bbb240fb743c6917fd2f687a446df554577a2ff40a701f1
MD5 3e4c095890caf69f3b7e4f341f67391e
SHA1 ef2e2147d41759838310eee328ac1048bf829306
SHA512 e91f2230a07d40cb624df147ff74854f4addbbf02f44d9b805a6bfe7b90c675a213bfc8c4d1805b86de805a805bb7f5eaf92ba4f8905babaa53d32cf4990e76f
SSDEEP 24576:w1QT7EcpfxR+N5AWAz3ooiYzjMqbX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NTDxR+N5YzTBjMSLNiXicJFFRGNzj3
TLSH
T10455B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-421-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-441-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-450-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-451-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-449-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-446-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-448-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-447-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-445-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-444-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-443-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-434-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-435-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-436-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-425-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-437-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-438-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-439-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-424-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-423-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-422-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-440-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-442-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-420-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-433-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-431-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-432-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-430-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-428-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-427-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-426-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-410-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-411-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-412-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-413-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-414-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-415-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-416-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-417-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-418-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/616-419-0x0000014156270000-0x0000014156280000-memory.dmp

Download

memory/652-279-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/652-409-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/1264-407-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1264-258-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1264-265-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1264-259-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1380-9-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1380-36-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1380-8-0x0000000140000000-0x0000000140404000-memory.dmp

Download

memory/1380-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1380-39-0x0000000140000000-0x0000000140404000-memory.dmp

Download

memory/1424-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1424-241-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1424-42-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1424-48-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1496-335-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/1524-498-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1524-379-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1528-290-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1528-289-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1528-296-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1528-493-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1644-315-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1676-408-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1676-275-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/1676-271-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/1676-269-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2076-282-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2076-429-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2164-65-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2164-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2164-242-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2164-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2460-346-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2820-363-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2820-402-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2820-347-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2820-499-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2820-380-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3028-81-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/3028-204-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3028-87-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/3036-401-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3176-301-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3176-308-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/3176-302-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/3176-496-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3472-492-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3472-286-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3648-345-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3648-497-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3688-77-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3688-72-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3688-74-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3688-66-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3688-79-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3868-52-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3868-93-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4368-17-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4368-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4368-25-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4436-240-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4436-15-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4600-251-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4600-406-0x0000000140000000-0x0000000140210000-memory.dmp

Download