db46b39fb72359bf307bd5ef60e65e035473bcb02f38a438b26c6372bd6796be

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.5MB
Sample260604-td6mfaat7s
SHA256 db46b39fb72359bf307bd5ef60e65e035473bcb02f38a438b26c6372bd6796be
MD5 7a337af0e5f0d9ac3bcb7f6f36093cfe
SHA1 6a3e0d124c1823758026be0efa1b025c8a2aeb48
SHA512 89a1bfa6ab796ffeb95de4b5756d677eda89a7d7f8ef41376579eb60985f3faa6bc324dc203b2506e4ea82cb4c5613e5032764dcf4c930be2d86a53c8ab9a7b4
SSDEEP 24576:7jcp6covGUdMLkbmXCYBOQ8QprdUHc0/T3iaV:7ADCtM/CqT8M2xz
TLSH
T14D65F15AB3A518F9FDA3813DC842A902F776BC560720D6CF03A066562F37AE05D3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4044	alg.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4876	fxssvc.exe
3432	elevation_service.exe
2960	elevation_service.exe
3216	maintenanceservice.exe
416	OSE.EXE
2200	msdtc.exe
1752	PerceptionSimulationService.exe
3536	perfhost.exe
5064	locator.exe
4240	SensorDataService.exe
1196	snmptrap.exe
3268	spectrum.exe
1596	ssh-agent.exe
1720	TieringEngineService.exe
1636	AgentService.exe
3700	vds.exe
2828	vssvc.exe
3252	wbengine.exe
2012	WmiApSrv.exe
1648	SearchIndexer.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3864	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b1b61bf0fc4568d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180031\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f90f42213bf4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000503668213bf4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
2960	elevation_service.exe
2960	elevation_service.exe
2960	elevation_service.exe
2960	elevation_service.exe
2960	elevation_service.exe
2960	elevation_service.exe
2960	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1292	2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	3864	takeown.exe
Token: SeLoadDriverPrivilege	1292	2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4876	fxssvc.exe
Token: SeDebugPrivilege	4688	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2960	elevation_service.exe
Token: SeRestorePrivilege	1720	TieringEngineService.exe
Token: SeManageVolumePrivilege	1720	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1636	AgentService.exe
Token: SeBackupPrivilege	2828	vssvc.exe
Token: SeRestorePrivilege	2828	vssvc.exe
Token: SeAuditPrivilege	2828	vssvc.exe
Token: SeBackupPrivilege	3252	wbengine.exe
Token: SeRestorePrivilege	3252	wbengine.exe
Token: SeSecurityPrivilege	3252	wbengine.exe
Token: 33	1648	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1648	SearchIndexer.exe
Token: SeDebugPrivilege	2960	elevation_service.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 3864	1292	2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	81
PID 1292 wrote to memory of 2612	1292	2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	85
PID 1292 wrote to memory of 2592	1292	2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	87
PID 1648 wrote to memory of 4436	1648	SearchIndexer.exe	112
PID 1648 wrote to memory of 1636	1648	SearchIndexer.exe	113
PID 1648 wrote to memory of 3588	1648	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_7a337af0e5f0d9ac3bcb7f6f36093cfe_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SYSTEM32\takeown.exe
  takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3864
- C:\Windows\SYSTEM32\cacls.exe
  cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
  2⤵
  PID:2612
- C:\Windows\SYSTEM32\pnputil.exe
  pnputil -i -a "*.inf"
  2⤵
  PID:2592

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4044

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4196

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3216

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:416

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2200

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1752

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3536

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5064

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4240

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1196

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3268

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1596

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1984

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2012

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4436
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2868 2864 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1636
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2876 2872 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f966b6e13afd6cbfa987f1ec4829a7b4c1faf8f20352096e2b3de19924483967
MD5 7e3cf8ce22b52e707e9541e74c54768b
SHA1 5cfd50bda2b6cb66d231de2d7c6de47a0a35a9a4
SHA512 ad748d524d16ea13162711fe814a88550bfec8b81ed6dfa14a2759cab0565d0dcd6c82eab9a7f45b0358886948fc29f6e40046a8b7a603d7fae72aaaf038fe98
SSDEEP 49152:Db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnICqT8M2xz:h3q6sjBs
TLSH
T15CD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a28a8891073890882b28170d7d025748ee1ae8b18bcff81946e8845fdf3cc121
MD5 f300e99f3e022d6ab79375860abd23e5
SHA1 1437d6cd6838971d5a7961c004cdb95e8c97d3f1
SHA512 c91c2243aee1e1f63613f4f592bd65638042b1548556f1c74094e4e99d27987f35aea82f0926f2df3814b522b63ecce7dbaf22e1d59e844c097147d1e0312425
SSDEEP 24576:EXYfDtczACmXCYBOQ8QprdUHc0/T3iaV:jtcOCqT8M2xz
TLSH
T13D65012973D404F9EDA78279C8A2C511EA73BC844360E7CB03A4A9655F737C85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 177490f3f0e7884881beb02592907ee5f423553ad61fa7bb5f7b7035f674b681
MD5 d4b471028baafc1ecc50e937c63ee3ba
SHA1 166bae76027c8df63adba586e5a47f64a243a808
SHA512 93195607ad101990b8f6e81ff401bca1edffb23d0043eb46f97af71adbc569241171a934eab9553ca453f177a12d4196bd7100a3ef7c9a82fec33a03bacc92df
SSDEEP 24576:W0Le5ji0hmxWrMNmXCYBOQ8QprdUHc0/T3iaV:WPji0AY3CqT8M2xz
TLSH
T12D859E26F6748331D073C0B9C5D2A68AED72348557308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c94f4b388a3478232228439e25222be534917e5657b6712aba7ac8d451dfefd6
MD5 52b59711d541b47d7d0e5a370e6dbf3d
SHA1 6123a05b87cd0cd51b3b363e52f0e35037b77e3d
SHA512 367efc3e579e1c8e05039cfc77021311a53775e280537cc1853833b3d15ba4e8bcc7d493dc9822b539b7e1f6b6ac4926b9106953c2b4b9d152fdb07fcc4d9a8f
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWn6q8wyuXmXCYBOQ8QprdUHc0/T3iaV:v/ezSC6vUzPveHjy7CqT8M2xz
TLSH
T1F7755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8c71d19f48a047d1cdd54e4072f7ced4ef2edcc26143b0983970e14bbce7d71c
MD5 b191bc58ab25eb83f9cbf9b951db3e90
SHA1 5dd928dc33345b2594c476aa62e583f41d7d2eb9
SHA512 a5f7e2836427e11ab5660dcb91b14b93d252712df434774ba6ceb5106d820b418d7eb3961b19712fec56f62d2a3a72ede75d347f85f4ae71f93699de68ce191c
SSDEEP 24576:CVbqPb88hv/l+YGmXCYBOQ8QprdUHc0/T3iaV:CVO88hXl+GCqT8M2xz
TLSH
T1A1559E66F6748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fef2560a1f1781870688c1b61496b2fefdb14fa1e48292fa31830dde420c134b
MD5 06fa3a43408af7df521d61d593c64706
SHA1 c764506b8fff092cae6766852b149a85e30dbf13
SHA512 627f9f2c0dffadc3ebb4116a054858bd6d236a0c9ad9f32ff8156423a9180944721e583fb7a729a5e5f4558b2921efef3d154d59b8b92a2fa289086b3ec814b0
SSDEEP 12288:/hRmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:/hRmXCYBOQ8QprdUHc0/T3iaV
TLSH
T18C45239FB35870B2FFE94271645BF8113A6EBF8C940A655AC1507D80A6FDD80E82C84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 9060739fb8ff51b6df28dd0c17d7ac4cb6032d862c42d859d413c7e7d5bd4734
MD5 ec7b146a48cb4ffaae394f52f286faee
SHA1 b50e97e0cbc636feee2a3c7fe2d9a484105fdc7a
SHA512 30500a2726d8ab19ec595a75870dff631a8ed1173fa07e0beaeee1ad723217b925d6e4836803782d095f2032cbbc666e3a231902d85587806b10052f72c84bec
SSDEEP 12288:qeBNUbTVO86UumSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0A/:qJIUumXCYBOQ8QprdUHc0/T3iaV
TLSH
T12665DF3BEE28FCE2C67E8DB95A91C600E77678704B12A3CBD164920DDE239D05E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 baae3e116cbe03a3c4024a6ca39c70aab35f767eae9acf35a1b8a5799b10a9a0
MD5 fa7f76585aa01ca5cb2cbf51e04bc772
SHA1 c3a9dc3eacac847d33e90a49bc20150f462ec5fe
SHA512 8f8ed5e0691292f2a26782e9a21bfe259cc9b2737495e88591ee2e0725ae7301ab68a2b495630288573977d3707a8a9784aa2da22d7a24b8769c76ae713575e6
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THc:9QvGAdlCEL8c/DRNw5Cx
TLSH
T10D267C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d0bbd65547a9b709f08e8032615c716f31fc5719825bc8ecf3ca0df2a9d7661c
MD5 865224b1c9a106e9596fecc07d089b44
SHA1 128e5c8d71a03c82b45c5c90a30269c1c787cc72
SHA512 35c92b99fc55e7d52dff196d2c286c73bc1881babf1b6fbf56b8968ad5ca173c262d41a1955f559e43005ac24778a340f1aaf4c5ac8fd65964498168f5769341
SSDEEP 12288:QAwSfxL/2Dc38DLLmt0LDQewsAjwmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kvJ:lRewsAjwmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1FB75E031FB74E032C7BB0DB21B26D716282DBE604B511AC3E3A89D8D59746C1277AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f675cb6885e709a0e06d4c541893129828a53008dfd9af0ed01caa53bfcdfdf4
MD5 b83571e1d9517940759809f7e02c9d0a
SHA1 73e7600b503ef29f2d74bfa6a66d575506a996da
SHA512 57d213463ceff940d060e30ba8050e9499e35672d1f327d570be4f59199ecd59a222e6c952e4fb2a4dc1b6917b630cbcc5daaccee010b8dcedbf642661d7cd61
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHu:KUEtQevvqc2W1cpV2tI32
TLSH
T1FB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5b3855371ad19b1016a2abde931e8211957c410797909461d9d06260d5598f19
MD5 077b552b23d48aca6bc66fe0a4f73d62
SHA1 5e221c4605448176052c3082ca4736ed2feb2e05
SHA512 66fcbeef13aa78d972ead4218b03c218a3880c6187c1e3009876fdca32ef23284d47b4029e83575cc728ca7f3bff8d702da07984427148ca7c6508596ecbe3c4
SSDEEP 49152:aCbRquA/m2yL5zLfFiV+XenmE3/znCqT8M2xz:voq2Vjnmd
TLSH
T1DDD58D0A76B8C1E4D1F6C37886A2C647F37178154B35ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 aa1eb0cd1f44e5dcf215a08b82b963b901c812e1facc8a4ea278f5c706c9c831
MD5 5a6407a3cb9a65d419440f4814efa802
SHA1 da3ea5a9ed1f495be6dbdaf45b1a75a9f0ae5fd7
SHA512 3d7391b143c6e75fa92a7a462a5eaf0f8600cae3865ac1666ba08f25829735fc4418a1f84172253eac92575f49591bc206aaa86cefe03a1616bad2dd1052c939
SSDEEP 24576:EAhGL3IFoiwtA5l7S53TmXCYBOQ8QprdUHc0/T3iaV:EAMUFoiq5yCqT8M2xz
TLSH
T15B359C81E7F951D4F5B3AAB899B69571EA76BCA95E31C20F2160D10F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 bc53a686b6f15671ef6971369f0ba901e4501b07fd481d9d2013fc30a25d318d
MD5 afd9c8ba870a42bddb26fa9c6b064176
SHA1 7bde8b7afb9e9d5e3b3e54abc5160358a4c3d05b
SHA512 1e91d7fd9294f3a343cbe8572dcf40ddaf4e3c066a3ac7eb50c49e48dab6781548c10a4dcd661cd06da4b4096775514ba41be78620148abee7200760008ca80f
SSDEEP 12288:8mw5HEjsChNDBFgl0WDm+C3mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezr:5wuKOW8mXCYBOQ8QprdUHc0/T3iaV
TLSH
T16865F14A73A81CF9E9A782398497D432F7F7BC012A25D71F4360C65A6F37650AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f6bdb41cc1f9de6dc5795d6f5bbee966dddb97d1cb7d38b7b603d9ee3768dc61
MD5 6bae1ad18f6a2aacbb353dd6393a4305
SHA1 6ae9d221ee82f2f402f092741db2c64410283c4c
SHA512 88dcd45b3d36ff1028a9894b2243ec61e4dbbbf6e33d6617696977f72af48cdf137ce496a8ac7a05a08f966f175efa0caa7b34d7e4afae461c1e3a7c6e084c60
SSDEEP 12288:9wZ1IyAmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:2Zu1mXCYBOQ8QprdUHc0/T3iaV
TLSH
T1C655129F339830F5E6E2423998E6A901E77A7C95633643CF422466546FB7EC05D3C722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3affd5b3421cd04a700a912e21ea0d3961ed0e056ca279a239d2bb3aba728d22
MD5 4eb240c7ee8fe55eafa9c5677bc538be
SHA1 2d17ce7c7e7703e7a0ae74bd89c41289a164fdc7
SHA512 be7f838ba4d55504df40849d32d31efdb0915cf89ca7c8d8989c5372b5a0d604d9c41d340543eb925739bdae31f6c9365996cc6a4684959fc8aabe880043e62f
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ug:QQRQyi36YOcPbLvw2gAf+PN3A
TLSH
T1F8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 045ae1d6571d6687322dd4204e305cc4be8e1c91d106c6d4c1376698480bf694
MD5 bf3ff93e81e8d1a4358ce657f34ff7aa
SHA1 a685e08298915fd7fd90219e1b16ef6f58855edb
SHA512 c0f7a5bc101ceb3089e0be66204dd80ede179d6a9648b858e85b871fe8ddeed71b325d9b8ffd611adfafbe7db64f1fb1175edabfbbcef2f2b959f110732481a2
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ug:pQRQyi36YOcPbLvw2gAf+PN3A
TLSH
T176667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9139999bde1c11d0778e7ef2a86f1e03765ba256998c6641fec0901c3315f8ef
MD5 19cb72d5c4536f559b2b94cbc25ef7e8
SHA1 dbe1de348d20d84a03b19b66bb0d8c1d6796439b
SHA512 91dd89d8dacc8fa69462ba0ab66f21f338003bf87bae86baab2e48dca8d0ac06cad7ddf89584f547653d22d74eeec4f2f058df16c9dd145ad58d93867738ee90
SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0lmXCYBOQ8QprdUr:W68Qg55nhceWu7PNU3/3CqT8M2xz
TLSH
T116B55933B2F600A9C44DE1769F4A973196D27C758FE1E3DB811172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e1b74e7e014de12308c2756affd43eac8edee855fe9d6d29451ee08705a50184
MD5 8730c0c6cd976a62e2df455a6ea9b707
SHA1 1c2caf7269302c16fc85fe8f07ef37a6ba4d69c9
SHA512 68c57be96ee4bfc559de0a39b05c4a4582a971706f63f7b719b33545194381beb23f27f099d035b9475bd34f78ec307e6536006cde553705c6a87a774097b4aa
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99q:Cy5112gYy5azzVvt69nLKnhZT
TLSH
T125167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7bb9a1f6827f38c3ffc7317522c08e2b45aefd4be31f730fb7e9a3640a562d46
MD5 d2c3c9fe604c28a5f1f6272555fe51ad
SHA1 95daf38ca514b8134966aa0b4e165a3650fa005d
SHA512 d2e54964acb3e4551a23abb1ee759e085806d41465c14cb44a636ab314530f2628bbc5a3eb0d03572bee7d1da9ec9290e8a61c522e7e79b1ed49b1297247cec1
SSDEEP 49152:TB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl9CqT8M2xz:lu6Jmdxd2do
TLSH
T120D59D13F2DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5287c0c1a279e172cbf45f96403df0b9c7a772fc6a33a7800b62b411ca7965ba
MD5 03b54b0f861279124f3e9ccdd90bcb1f
SHA1 ade2c4b75f3821e61a0ca6c6b470f937d13c5edc
SHA512 8956fe4033fb0f21dac11ef8a117022b9c9a87ceba0e9635951133160f6175debec98025499818ec359736f2434d24de921979aad17970eb86fb11af2321c3c4
SSDEEP 49152:91hpsNoJpF1A63U44CwH7R4xhCqT8M2xz:9mifPWRd
TLSH
T1A7B5BE13F2D900E8D06DC17887569232EA62BC450B35B6DF0A90B7962F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 350f7d0b68c1cd3095dce49eef3dd6771d5d2bfd45e05f712fd003f6940999b5
MD5 b06afea59ac6de6cbb881183b982ba70
SHA1 7a1a176ca00a00246ce54d4a97910e6cdb2f9f37
SHA512 3ed6c8c9e75fee40ac30d61a4ea618639e7ca94d431805ed1f635b265886d3cb438d3ce96fcf457c95891b98b398bb42abdbea005ffaab94b959022ef0dde0ed
SSDEEP 49152:rSuZQIY0Be2KcRVtOnks6NMHqYCqT8M2xz:55dKii61X
TLSH
T151C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 076c8e0437d87e48a21de20cc1dedf63ee56a5dd6b49d310d2dd29b7bdfe522e
MD5 aadf94c44c61a3537fc5674ae1918977
SHA1 9a7194f5642142aca4c54c831c946efb2839fbe5
SHA512 f2737c8ea1b333df6fcd384ead2a226eb5a64831c6d61ad750deb39b7e1fa814a49bfded1c856126be92b92c16eba6ff189d8b0f046d73c5788364d83c7029e6
SSDEEP 49152:UhtSn8EApI0fig3giDn0AP5wtCqT8M2xz:1X2imphp
TLSH
T18D95BE13F2D900E8D05ED174C7468632EA62BC150B39AAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b7d2abd72a353048e594b3ff584588a7413c92dffd7474bc11adae3dba9aac41
MD5 73eee153d41db2c7e2e939d7ca6d8c37
SHA1 a4027098f8129edeabd3ed975a851605083781c7
SHA512 292338ac75d285d9437daa5556bd0ac18eb9a6f71314fc3515b5e3b15057075176063d73bf6f390c35e838cb82c602423e1652d5b2e385acf334e8d74d5dc1ce
SSDEEP 12288:V5mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:V5mXCYBOQ8QprdUHc0/T3iaV
TLSH
T10145239FB35E60B6FAD44272645BF4017A6E7FCCB50B219FD2487840A7FDD80692C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c5f70158c0e2cabd8bbb4e3ee4b29ab1511d0ef01b80f24da68a2a62280099fc
MD5 e9cff21196b44424b1d257ab31813cbb
SHA1 854ebc8a8a4c59e77f208c3752372d61b67817d2
SHA512 580c453b86bf8e7082977b89fc3bc9f5d944ede2682478bcacc1ae2d8a33a8d4a44353b2f02d73be7cc7d2e747a7c6d9e0f2453445ceed9d972038b465f7c154
SSDEEP 12288:b0mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:b0mXCYBOQ8QprdUHc0/T3iaV
TLSH
T1D945239FB35E60B6FAD44272645BF4017E6E7F8CB50B219FD2487840A7FDD80692C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c2b0ad2c6b92b03b077f4a2338d37bbd954ae2fae3f435e22c76a2984e270dd3
MD5 fde0934248610e09ef801f7a42eb3311
SHA1 bfcef6796ac98b5ddf6e90822008eb0e32b0c41e
SHA512 c029c6720f5f6d4feee5b9937ce866a161b56c44f587cfff5127152c5ed19819194caca010ff6b387d8e9c568b51f31ec2c55f3bc718f30f1ea4555e81851e1b
SSDEEP 12288:n2mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:n2mXCYBOQ8QprdUHc0/T3iaV
TLSH
T17545239FB35E60B6FAD44272645BF4017E6E7FCCB50B219FD2487840A7F9D80692C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4a6c8c4cabadefca2ea2f875d763445e58803dc11450047b00770063021105fb
MD5 e3b21f4bf5913e15d5e89c2bbdbc696c
SHA1 119336c35e15f307736b5d357962654ff73784a0
SHA512 9505e1d71234eed80ecc170232745707b4b69e0358f2660ca8521dae5c1a7144d4e388cc83412f35985415b5bf253723db5ef6099559475829f8493f1c043ed1
SSDEEP 12288:QVzmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:OmXCYBOQ8QprdUHc0/T3iaV
TLSH
T11155235F735920E2F9E5C2719857A411BABEBECCA226629FD20039405FF5E80AD3CD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d0cce4e5a309b0a3790c49cc78b38609d4c941239c29547e664c2f02ddc0c66c
MD5 381a59abacd7b3eb629dfe93d83d1463
SHA1 efe0dbee49aedfa596c6c97ed1638f1db71a8652
SHA512 1821c030cd6d9b78aed4d6471ed0c64ff340b6d5fb16e43c19c0a7d0a7ae10d1fb8b54581af2feeae89cd43bbae7d6f0b35f0bfc1c64922059a71a1b75b786ea
SSDEEP 12288:xrmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:xrmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1BB45239FB35E60B6FAD44272544BF4117E6E7F8CB50B219FD2487840A7FDD80692C88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c66b3e7deaf691e143f047f5470ac1db4ae9b71a5bc380bbbc1e7ec79940cc3a
MD5 114523446066713733be91b2872f4879
SHA1 ec0123ad9b6aa1ed3826693fe92b8be592fa0a77
SHA512 3aa5d7cd15c598564d87a2d86b2041b69c1db7184a6baabca2502cdeb5fc5ddae238fcfa3e669820caa62c9bf63127b082ba5a7a5d7b2cb08b06edad78170441
SSDEEP 12288:C4mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:C4mXCYBOQ8QprdUHc0/T3iaV
TLSH
T1D345239FB35D60B6FAD44272645BF4017E6E7F8CB50B219FD2487840A7FDD80692C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a85dc8a51c6788b29a2d692679cc527c372acd518a86c77aa377ae1e9e541ab7
MD5 1901cb611bef0416214a7cda833e029b
SHA1 66495fbbb8f18de389ef1379584ba822e8f14dcb
SHA512 fc1008febf07d23d23f0ca6250fd2c3720c40e3c7390d6567c68ea2603d16116d94f650b9bf8b737206446bc72ea26c3f1f1dae133fdcfc9be88914662864bf9
SSDEEP 12288:WsmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:WsmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1EA45239FB35A60B6FAD44271644BF8117E6E7FCCA51B219FD2487840B7FDD80682C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 feabeb1277a850928e62a4737df2fe6fe24f0d97b000ffadfefcd128d2ef7fce
MD5 19529e7711811ec8da562606cf8532c6
SHA1 d96967bb555979d54799a7bbae16ec6b9635f1c7
SHA512 f4c89bc61029975a5e1c35a75f80ac7fe65ea66c571879caf156b224c084e4499f20d62155c7e45fdfafc35f884fa60f854f2142e637cb7b746ac57b6750c180
SSDEEP 24576:EZMHzFVSOUmXCYBOQ8QprdUHc0/T3iaV:EZMHzfvCqT8M2xz
TLSH
T1FB65029AB39018F4ECA7823ECC569906E6B27C590770C65F03A436665F737901C3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6b1246fd9bdc5a4c3fda2bb5d2ea4db665d272f47c40e573ace5a165d7b11f65
MD5 39528b6a5ddd34f28a1c393308a823d5
SHA1 896779d9a4b57ea38be8cb0fd6bb41a909cf2464
SHA512 6424384dad65b162636eb6370d71969b1c28feb17e3206ce165edfc10c6a819aa05310acb00383035069b4969d55755dfc1834da94eeae03fc331b6ee5618fda
SSDEEP 12288:+FmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:+FmXCYBOQ8QprdUHc0/T3iaV
TLSH
T11E45239FB35D60B6FAD44272645BF8117E6E7FCCB10B219FD2487840A7F9D80692C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fc73d998d7ef5f7f6a16e296a7bcbe8a7e897e17489d0af9adbcf3488259d47e
MD5 2338a23bc3fbda3736293c8b610e67cc
SHA1 12a64ac9509f96d3979d4ad94544ecb6881f69c4
SHA512 08c8768f8a78925b2fde3bf7fc5c420e68959234010ba1d3e4cde34cbd14b2a11a0c7748d9691fb2c822228a29120af92e19623fbb9c722279501e4f71bfef49
SSDEEP 12288:WhmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:WhmXCYBOQ8QprdUHc0/T3iaV
TLSH
T13845239FB35D60B6FAD44272644BF8117E6E7F8CB50B219FD2487840A7FDD80692C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d4184d1ded4c863eba3bc31338674a8aeb69430eaff68db09e7753dbc9fbd279
MD5 c1b9e64852ccf8221fa4a022e5364508
SHA1 f6bfc02856eca018064260106300f087ff08ed63
SHA512 e24ece3bbf63d5b953c2ff689855b18efa06f24c39f05f41c4062a20ec0ade1a524c26a8d1c14efdf65eff92ad66cfd474177be61308351175b9232a34291097
SSDEEP 12288:ByPz5L8AmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:QzyAmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1BA55124B73A530F9E5768234C8522902F77ABC7547209AAF536427722F77AC09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ebaf7c3bde68a630066f3896533ca69fee9858d9735b8a9fdc2860d013ecffe3
MD5 ef76293efccab1af81f7c2c0675c065f
SHA1 043762259e693f59eee9ae7b0fe4f77c8cc3087e
SHA512 d84adbccc52928448d118c09968b39cc99bc641267a2ec4bf738e890029e25ec03233a6f315ffb2cbc24a995f40370e68ca2540f7bd437de7b34eec56bd2d234
SSDEEP 12288:6FmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:6FmXCYBOQ8QprdUHc0/T3iaV
TLSH
T12C45239FB35D60B6FAD44272645BF8117E6E7FCCB10B219FD2487840A7F9D80692C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f2b10115a3ab228845c1f87f7b2b781044afe866ff2e171a3f46735cf7b205ec
MD5 55fd7af7735a5d5457bd48d874f1cf20
SHA1 7fabd5887b1c47b93b75324faa59ef6ae7795891
SHA512 dc1f1df0bd897cfa7ce96a41202b95283c920227e6db2e67fd5e3caa0513ffa529e4cbf5a8e6f149d9ddeb4f08692e2d7c7b376b622150b6e7f8a4f638422809
SSDEEP 12288:SFmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:SFmXCYBOQ8QprdUHc0/T3iaV
TLSH
T12145239FB35D60B6FAD44272644BF8117E6E7FCCB50B219FD2487840A7F9D80692C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 3034c76db7757e65c84f9da4efff1fc0f837df7d62d9af8c3e8c4a2a1ad23a5c
MD5 299de89c21883e00f1b031f2fa90e084
SHA1 e50085da09710a08983c1336a65db6cc0249ab0b
SHA512 d565219e141b0868066a67af3830751c79b03895fc524628bcc7a3c50e05260ff4a4a638f4875c983487bb4988daba51a3d5abe4d434c9fcd72b12964f7543c6
SSDEEP 12288:XyPz5L8AmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:azyAmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1F455124B73A530F9E5768234C8522902F77ABC7547209AAF536027722F77AC09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 42aebf26f27c307d40cb748dc5f2d808ddc2d70596351ef7a5cce2fb8788207e
MD5 6fa570515ee4df002d8d064e30022c90
SHA1 6a207e62c0dd364aad37f2aa0a41488200a9416f
SHA512 1aaa3f9214a9adb18d6fcb91d1628ed39e3efbed4220b25823aa01519fab9f9196570a09b762fbf152616bfb247940ab856a6d6e1956a517c8db85207afd6e2b
SSDEEP 24576:aT9aLl3z0zDmmXCYBOQ8QprdUHc0/T3iaV:aTQLljeCqT8M2xz
TLSH
T1C06502A9B35018F8ECA7823ECC569906E6B27C590770C65F03A836665F737901C3DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a971b951e41e04834799e5b46c88241b698b8e8bacd87af409b5dabcbb6b31d5
MD5 175e83ac8a4b58711f44ec38532d285c
SHA1 0dd013b833e5ce86cc06e7df84382b349754fb1b
SHA512 eb6797184c40c08906bdc182fb6feb65c99f19875da2f462549fb5891e25df77858a6d57da09780809ec88918fda29513718520c26034b420a367141996258ed
SSDEEP 24576:L31d9CHKy7GZqmXCYBOQ8QprdUHc0/T3iaV:r1d9CHKyavCqT8M2xz
TLSH
T1C885CF91F3E410E8F1B78A358C769511DABA7C991B31DA8F03A4255A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b20f6bc590beec7a59a540906e46e6120e418bcc1477d324dada0e995e8a15c6
MD5 46e96a48ff0db9333b77b6dc8a2fa8fe
SHA1 d968c33901e70fb7bb81586cc2917a5ebbde2df0
SHA512 655ff3f52fff6349f8c0b3cb1a46aca0340bccc0ce4f8adffb693bdeef9c5cf734b567f768ce9ee2fe25ebd7ac34338eefeaebf0aca57002e3cd7661ca133663
SSDEEP 12288:yWmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:yWmXCYBOQ8QprdUHc0/T3iaV
TLSH
T11D45239FB35E60B6FAD44271644BF4017E6E7FCCB50B219FD2487840A7F9D80692C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f8d76eee0705a47571194c88802e3e2b8909527888d42afb16aae8f177ed597e
MD5 2c13842dd758b465dcee82bf0fe8e641
SHA1 3fa2a7ba8953da79172f5a6537d32b2932426a40
SHA512 98de5c64c34de7cd218812f2ce38d299463ac1f887a85e4af6c62b39f4d52460a68238948d07356b071bcd7a805a3a1ae150aa226f04b28911d74254772c58e8
SSDEEP 12288:5Jsf1mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:+1mXCYBOQ8QprdUHc0/T3iaV
TLSH
T10155015AE39811E8D0AE4275C7569A01B73B7C6493E1D3CB52C0F53D1FBAAC09DE9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6e20a541e8c73b45ab389c4da0cf4162e5bf99a0b28af1ce71391846706b739a
MD5 04cae885b3ec52fc987e288f17daf3d1
SHA1 f82d9cfc2cb14cd0533ee789f7985b6e376ee421
SHA512 183db38e9090c2acbbf6a6b8779ca1f484f4d85be01019ac022ada7c19fd70d09d4ce1ad0f646a4a7e4fba9ae05053112349143969a4457759dc0d7a46e38973
SSDEEP 12288:YwmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:YwmXCYBOQ8QprdUHc0/T3iaV
TLSH
T17F45235FB35D60A2F9F94271145FF4213A2EBF9C9B0961DBE1047980A6B9DC0AC3C80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 208bd72e6a95b467d5a849b2a1d34e27709b0197cfee1733783436af2853a4bf
MD5 20ec448feaab180cfbf788ce7c0501d9
SHA1 5e6db5805f7de6406fab127cd1c49d6ebb3067d8
SHA512 83c4ce56382903f218f49617fcce1c8fc0141bfa19f002ed97a2e8b0e7e18b7f3e8f3d7fa7956590e869a8b3544c06272d6f5d7db6a9c8b02d595cb8914703ac
SSDEEP 24576:28RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCimXCYBOQ8QprdUHc0/T3iaV:PRZwQCyiHiQEaaPnMyCqT8M2xz
TLSH
T13C85AF1E63DC42A5E4BAD278CDA74407E6B278165731A7CF0190C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 37d199c7b60456136102caa5fe4792858bc1e47ad3767f63f26258b4081f7e3d
MD5 edbd59d6c032662fcec4314dfbec3d4c
SHA1 f34ad6b5f5394354dbbbcb4489a7fb70de7749de
SHA512 4b9fc1e8d9caccfe3fb47ac9d6fa4e8342369b2adea2dffdd54204e97f17f2b550c3345b8b29c425ef9ab16a16602f09f47cb9c31d631c32840134d9a6d052ef
SSDEEP 12288:jbxA1U7KumSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxx:jbxA1UGumXCYBOQ8QprdUHc0/T3iaV
TLSH
T1DA55126F63AC20F1F6B5813988D6D002E736BC596321A3DF5180A2795F7BED49C39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 69d9bd63d8f8b521b6dc095f26aa248275d0493574b44de7d61e4d91b3b43d3d
MD5 2fbc813ea8478a80908daedffa40a72a
SHA1 f6387f2d822a3af305ea6e7bf9a5db71a61b08d0
SHA512 1b18bc5246139ee3d4ecfda4da8e75fb7048e463bd18b4520034f6a0f4dc4a0d4abbdc4bdbc7901721b50ec49176b155919eb03513e7c1bfd8baa95785b3a984
SSDEEP 24576:djsmP0yHaqrVqHra44KDzMsrnDmXCYBOQ8QprdUHc0/T3iaV:djRP0yHfVqzlAsrnyCqT8M2xz
TLSH
T18F45AF2EF2B910F9D4AAC136454107B5BB71782D1F219ACB0170C634AF1AEE49E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 3e0d8a7b0adca54e3ed587b68f558d4c15466e05254386e3b3bad99c875cf2ee
MD5 d1d9788d3e64e7dc934f648bf81b3b9a
SHA1 1519888a73091e010748c2d828d8e34d765e3185
SHA512 bb4962b28757f502eca8fe4845870089008803cd1babe19acafae5dc0507804198ca8c100068b046e0e50afa6c88387b67c1eca48222f75ccb2223374cdc3b6f
SSDEEP 12288:GKmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:GKmXCYBOQ8QprdUHc0/T3iaV
TLSH
T13D55239FB34D60B6FEE48271544AB8117A6E7F8C671A22DBD1447840A7FDDC0AD3C84A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 e6f19b097cada1549ce352ca10f171527128d445fc8d4f10024bd450416df8ca
MD5 6bc4fa5119c2a917f6d90ea98db607a2
SHA1 38ccda7b4e28e9ec980c67947a50fb68a862b19c
SHA512 19d58a6a3f101c042e94ad2428772c99acb2e529809731eefa6a8ac317f533da29fe45c40da15257a2e6c287f2e0f5420614e1cb6dfc52b32f2074948a4952b1
SSDEEP 12288:KObVA4LWO+vAYFT8mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0J:7BLBUT8mXCYBOQ8QprdUHc0/T3iaV
TLSH
T11D75F159F39400F9E97B813CC8A69912E676B89C0324E7DF03A85A551F73BE14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d223f439b520f5785497647654e44127d57d700efe45746b5006314f8aa02fdd
MD5 3917b5a0f9acdd046ae2e0bc2cdbd542
SHA1 31c84fde47b175f3d0d036413992cab35ba11705
SHA512 e74b7f9285c331b549eb7b18c305db09fd8bf31c267c2a580d05b2b63eb44dc5f8b33d38427ff681522670bf870885f29beddb921013e05469d39fc830b352bc
SSDEEP 12288:B70Vm0IYNvUyBpvmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0zd:ewYNHtmXCYBOQ8QprdUHc0/T3iaV
TLSH
T1EC65F12FA2AD18E5E57B917989C38509F6737C96131192CF01A0827A1F77EE8BC3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 73c3aaee0ee70cdcc5ec4cea0fa4305cd3f5fa6bcbd81c7ccfa97593c8499418
MD5 7696b92e91d44a3ef2cb9b9da64a8917
SHA1 603c75dfa1dc80f9705376b68beb9d4f9c946e85
SHA512 3f3ab817fb88728c094d9c3d3d96d1f013fc99eb4454ee2b18e5d04bfa3e17bf08ad50968e6228c09904d5460526f830f3be9152b3ca8ccd44f3b6448781fada
SSDEEP 24576:EnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKI:EnXoJJYH84VVS6AmEOJas+cHBjSSKHPs
TLSH
T1D465BFAEA2BC04E8D5BBC17DC5C25506F5B278651331C6CF026082BA7F27EE55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1ba6a6a415bdc3cb8e7d45dab409eda95ee921a475cf5842870d217e67ee5d2b
MD5 ba34a1e69c0ee21307db8049d6e1ba36
SHA1 42cca746b8e305d6f2eb6c2d04c8cb6e31c6d8a1
SHA512 3e2ba5c745fc05951f24f67cb558797930c845c7f7947ba3167b01e7be90f4c7cfca2c8ca70836c03970178eafaabab06152f5c4d9aab38b7eba73472164cf5f
SSDEEP 24576:Dv7Xbxd9Tuycf8M/TYlSuxwr2PC3mXCYBOQ8QprdUHc0/T3iaV:DDLL9TuJ0M/TYW2PlCqT8M2xz
TLSH
T157858D5EA3EC52D8E4BBD6BD85A79046FAB2B855173081CF0250856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 a3ee79aaac414fa4cffbe93ac9ab5abd5a8789bf0906b19e75fa194fde43ed4c
MD5 f53c63fbc91f619691ceaabcc981148f
SHA1 e65710736f0c2a5c62439fd10d8513ff9e8ed071
SHA512 52f6d00acfc13ccb57fc1662323b798b00f83b87ab81de43cd581bc2092203ab5e6dc08056455848bb9eff8a29e18aac7d69bb6cc3f1ceb9cecae0eabc0ae88c
SSDEEP 24576:begJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10w8mXCYBOQ8QprdUHc0/T3iaV:bngOJOmPOHzbCqT8M2xz
TLSH
T15D55BE3FB7BC15D5E07EC17D89968816F6B1782603265ACF0160827E5F2BEE46E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 0c0c3330381616cdacbed9f49630ad0ec41ba0027bf4d7de661a863f9d85a24d
MD5 20ac0bd60ecf8cea1f51b7ebd19d34e7
SHA1 42c5519791ab1ee34457144f01466bcc5d2a291a
SHA512 3338159bfc8ec58cb85c47c430d24c5a7216a821e516ccbece34f06c6f8221d2814ec49d74934ae7b9d0a49070a82f3dd3145e946689ac793c36e6796eb55df2
SSDEEP 24576:jLJnJiTk3R3waE4JrOqmXCYBOQ8QprdUHc0/T3iaV:jLJnJK8R304lcCqT8M2xz
TLSH
T15475E13DD2A810E8E4B7C2B4815A6756FF31386C2B2569CB55B4D5313F22FD0AA39F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4d43881f8c23874bc4b656a7e315d8e0be9d920c60e8aac69737d705daa43720
MD5 5dbbe09dd811871a6c016ca683a214ef
SHA1 993ebc570ebe14abbe075a3e1552c45e5ed0b723
SHA512 269b127c5a21b5725c4538ff91d3d9a1dee87394ad1a11594a800a614381509bc227865e3476d86a78adcffa8fbc12315d896063ea3bf7782813082c9cbb482c
SSDEEP 24576:0A9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pkmXCYBOQ8QprdUHc0/T3iaV:j9GqCzDScAZmlvTcFg8Ph6BCqT8M2xz
TLSH
T158955C05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ffaa9da06b0008e10426798b60a7071222af4882ed671d9c26209a7fced9573b
MD5 531eb18f790785a23e50aacc02f8ca25
SHA1 e33b29a55b2dacf4bc8269db5ca1aa5791b218b6
SHA512 e79818daf10788b8c8c8265736d0e6c5bd012b308107a004237695bbf8f3646cf2b0c6880db2f90dcec7d1f743944c4beff89fd7d37a822bcd1da3776c68c3d8
SSDEEP 24576:klYJeXm5jUuEymXCYBOQ8QprdUHc0/T3iaV:klYJeXmRUuEdCqT8M2xz
TLSH
T1B655125E739C30F5E26A817994969900E376BDA4630223EF81E0E5758FBBED06D3CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 d2ed0f190ab90494da2bd46e92ef4b9c3418c0889fd629479444abd061c0d7eb
MD5 17637c071542aa72b6d8d370e12575d4
SHA1 38d0e33869ece64994901f784eda28d92ba09604
SHA512 bc299de774cbaa05b83aa7aa7961a63a54a319e0bb823ff4af9ffbbb3f2abe71e7a830e01c6afe37570721de30af615bfcbccc3a7d15fe722a6409d07d6a4d3c
SSDEEP 12288:iuu6kyxmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:ijtyxmXCYBOQ8QprdUHc0/T3iaV
TLSH
T18765124A739860E4FAB5423498639150AF3DBD549B1153DF9190FA2E6FB6FC0AC38F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 cede2e9d589280c1b670d065edf6fcdbca5248e8b9d18fb635fc24288e860cd8
MD5 7ff5f93fe1eeb705f60265f3159140b5
SHA1 f49dab78e3cd84d87c6dc5bc1a88edcba588ce11
SHA512 3e23d42a944b13a93b1687107b470aa8f4a9d440432839f750eeb19597b7c997e8080e260a120aaffdd74aa4a8c24926b4fab9499cf89e06c38d2073df49d311
SSDEEP 12288:RP8mSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0z0AWTaxCY:F8mXCYBOQ8QprdUHc0/T3iaV
TLSH
T16055239F735970B5FEA44271541BB8017A6E7FA8631621EF9094F860DBF9DC0A83CC4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 defd4caa1b3303ddb9f8a0516ae54f7f80f0a0a8590843080e3b8b1e81e19f0f
MD5 e854624f0f00add93807bb3f0f97ca37
SHA1 9dc59b6e483b2797dcc989c8464cf4989457da60
SHA512 2797bec86e7f2cac54ef45138b0d0af0352b70b657791db5791c9cf92dbe1835809a162c8db3943f48b591cff8c21063ed0f04ff99499129afdef594441ec17e
SSDEEP 24576:KC+TyQIu93VAumZr7jmrmXCYBOQ8QprdUHc0/T3iaV:K/TfIq+YqCqT8M2xz
TLSH
T1F9558D1DA7F919CAE2B6C675C8A35493EA33B871137186CF2044C07D499EEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 dca7e331239a9b62c5476c4ced799d153ef50d2fe6a35a01217ef28fad0f621d
MD5 47191607cd517c62ccf6698ad54ea912
SHA1 55b2a681474fb55f1dad08e7300779e9ed7f37cf
SHA512 649383d9aa5925d29cccc8020465a8377f4f74ee8da75126af3c6a9700c1c3fb6593d4fba31c6eb39d0fa2c8e548125831fce3272cc99b199328b3e57a8ccedf
SSDEEP 12288:4cyrWOstaa3kcsYmSuBsYx/s6OQgDY7HkJIrpBLhUfQcjQ0/kv+j3ezIOt1Ta0zd:9LQikZYmXCYBOQ8QprdUHc0/T3iaV
TLSH
T16065F10FB3AE10A5E5A7C13C88864112FAB37874571263DF4290C7794BBB9E9BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 cbce3d3979e780ab74e2b466472a42a8e07576824326453e34e61c44baea9cc2
MD5 170f9ffd3ecd7c56f9bc88fd8d283f6b
SHA1 d6abe6e59c009febe7b1a4e8e18ad808aeb2055d
SHA512 f3890ebfe81ede900580a40cca3f0fdf56a8a3297475df200f2b0982f846a9cabe14838800130b87d36c4901b6c30370e18333c2494a0408fb0bd724cf3fc6d0
SSDEEP 49152:0pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPMCqT8M2xz:1pC7b4+80GTk8
TLSH
T101A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 05bb3e2a002c762ecaa3921674e1487880d66a778fa31be79c361ae0dfcdc054
MD5 4fd86c4bcbd0a3934268bf5f438866d8
SHA1 636f0bb8a4daf8ffaca1ab8cb3e1ca5c6f57e890
SHA512 a20f5df7450576c2b44bbbb6180b44a05de583d2aa623d2693aa17d51937135b674bd61a7db331ab0ba324c03637aa7a57a1842b4dae9e08fbd53b39fabc0425
SSDEEP 24576:dSAwJPE1IDAo+4Kt+l4413JUQbmXCYBOQ8QprdUHc0/T3iaV:dqPCIo4Kol4vQaCqT8M2xz
TLSH
T13D55BF2AA7F956F5E17AC7B4D663C501FB727822133163CF8290913E0E269E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-237-0x0000000140000000-0x0000000140173000-memory.dmp

Download

memory/416-74-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/416-80-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/416-82-0x0000000140000000-0x0000000140173000-memory.dmp

Download

memory/1196-414-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/1196-281-0x0000000140000000-0x000000014013C000-memory.dmp

Download

memory/1292-0-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/1292-9-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/1292-33-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/1292-1-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/1292-35-0x0000000140000000-0x000000014017F000-memory.dmp

Download

memory/1596-304-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/1596-296-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1596-302-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1596-420-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/1636-432-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-439-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-465-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-466-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-463-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-464-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-462-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-461-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-454-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-455-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-457-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-459-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-460-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-458-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-456-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-453-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-452-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-451-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-448-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-450-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-449-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-447-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-429-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-430-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-446-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-445-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-431-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-435-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-434-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-436-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-433-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-441-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-443-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-444-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-442-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-440-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-310-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1636-312-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1636-438-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1636-437-0x0000013651910000-0x0000013651920000-memory.dmp

Download

memory/1648-342-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1648-396-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1648-426-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1648-412-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1648-336-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1648-380-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1648-335-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1720-421-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/1720-307-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/1752-319-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1752-251-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1752-250-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/1752-257-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2012-331-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/2012-425-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/2200-246-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/2200-315-0x0000000140000000-0x000000014015E000-memory.dmp

Download

memory/2828-320-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2828-423-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2960-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2960-46-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2960-57-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2960-40-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3216-67-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3216-70-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3216-72-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3216-65-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3216-59-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3252-327-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3252-424-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3268-290-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3268-419-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3268-292-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3268-284-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3432-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3432-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3432-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3432-38-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3536-326-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/3536-267-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/3536-270-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/3536-264-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/3700-316-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3700-422-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4044-13-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/4044-229-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/4240-277-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4240-334-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4240-418-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4688-234-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/4688-25-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4688-24-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4688-18-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4688-17-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/4876-30-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4876-89-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5064-274-0x0000000140000000-0x000000014013A000-memory.dmp

Download

memory/5064-330-0x0000000140000000-0x000000014013A000-memory.dmp

Download