0bc9d03076bb1f91a504f92f72d776635bc350621b743a007bfcbe7b64fa026c

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 23.7MB
Sample260606-ya5cescs8k
SHA256 0bc9d03076bb1f91a504f92f72d776635bc350621b743a007bfcbe7b64fa026c
MD5 c2b58c387f85b867842bed6c9430c6de
SHA1 ba4b678ac2e4f30dfb843634761b37f6ce1705b0
SHA512 58f5ee0e2f3ddea047fd92c3d23fab69b0174a71c332ea9f2476640eca4e397d53641bcf5ac6bd7f4266c4459b13f22d4df128ae2d34cb647bb628e5e489dc3c
SSDEEP 393216:0a/poVXFQYxpEgNiNP+VyjH62bdgReLlGxe66OiZmMz0Azq06qJfZOtEcIacV8gn:6VXFp3GGVy7/baQ8x/6HZmMz0AuqJxAw
TLSH
T17047332F6A475AF1DD8E46F059C41EF29DB2FC9293008ABF91B4E4E15F322F4CA19164
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
3376	alg.exe
3448	DiagnosticsHub.StandardCollector.Service.exe
5056	fxssvc.exe
3084	elevation_service.exe
1196	ideviceproxy.exe
2328	elevation_service.exe
5076	maintenanceservice.exe
1500	msdtc.exe
2852	OSE.EXE
2764	PerceptionSimulationService.exe
1948	perfhost.exe
1684	locator.exe
948	SensorDataService.exe
1072	snmptrap.exe
1208	spectrum.exe
4028	ssh-agent.exe
3992	TieringEngineService.exe
4428	AgentService.exe
1436	vds.exe
3100	vssvc.exe
4436	wbengine.exe
4908	WmiApSrv.exe
2204	SearchIndexer.exe

Loads dropped DLL 59 IoCs

pid	Process
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe
1196	ideviceproxy.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\49ec3da9fc4568d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180031\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180031\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180031\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x001900000002b4fd-181.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c79fb4f2ebf5dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c88fdcf8ebf5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c23bb2f2ebf5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078c79cf2ebf5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab08b4f8ebf5dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3448	DiagnosticsHub.StandardCollector.Service.exe
3448	DiagnosticsHub.StandardCollector.Service.exe
3448	DiagnosticsHub.StandardCollector.Service.exe
3448	DiagnosticsHub.StandardCollector.Service.exe
3448	DiagnosticsHub.StandardCollector.Service.exe
3448	DiagnosticsHub.StandardCollector.Service.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
692	Process not Found
692	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2960	2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeAuditPrivilege	5056	fxssvc.exe
Token: SeDebugPrivilege	1196	ideviceproxy.exe
Token: SeDebugPrivilege	3448	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3084	elevation_service.exe
Token: SeRestorePrivilege	3992	TieringEngineService.exe
Token: SeManageVolumePrivilege	3992	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4428	AgentService.exe
Token: SeBackupPrivilege	3100	vssvc.exe
Token: SeRestorePrivilege	3100	vssvc.exe
Token: SeAuditPrivilege	3100	vssvc.exe
Token: SeBackupPrivilege	4436	wbengine.exe
Token: SeRestorePrivilege	4436	wbengine.exe
Token: SeSecurityPrivilege	4436	wbengine.exe
Token: 33	2204	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2204	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2204	SearchIndexer.exe
Token: SeDebugPrivilege	3084	elevation_service.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1196	2960	2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe	86
PID 1196 wrote to memory of 584	1196	ideviceproxy.exe	90
PID 2204 wrote to memory of 1256	2204	SearchIndexer.exe	108
PID 2204 wrote to memory of 2876	2204	SearchIndexer.exe	109
PID 2204 wrote to memory of 1840	2204	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\ideviceproxy\ideviceproxy.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-06_c2b58c387f85b867842bed6c9430c6de_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:584

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2848

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2328

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1500

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2764

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1948

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1684

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:948

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1072

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1208

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4028

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1488

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4908

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1256
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2988 2976 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2876
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3020 3016 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e666153fb0056755ddaac09879fda659f677d32bc66ddc3f107f7d4e555fb82e
MD5 87b27bf4be4dd8d93d9cc97b15cb8574
SHA1 6dbaebadb9e2f49af44facd42906a1e4d6e158e6
SHA512 396aca1b93b933e4dc0ceeda32f1e38d7abaae36e25d8924f325f5d2551247d21a7dbcab8b81d1cd003b2fb936b229b6941343aecb590c099e16b2146f425abb
SSDEEP 49152:Ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnBygkJU+Swbgb8k:q3q6HjBqygOU+Vg3
TLSH
T1E5D58C03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 23b2b20ab66e3b902b474798ebcfc4e75ba6b580366dc7550956b1b8b7c75484
MD5 1326fa148d1b8a7dbb9eea1751829b83
SHA1 eac09e843fdbeb829c60cc896eea9ff9762eae8a
SHA512 7d9a3dba7c53afa8ae8010180421a48174e2f7039168efdd186f2e60e38ee0f636defadeca214e180ccfc39945590800303a9848effbac42354fd40c8b05b3b1
SSDEEP 24576:XXYfDtczAPmygxmJU+iHqqti5ZvngbRahGnwK:CtcPygkJU+Swbgb8k
TLSH
T11775F12867D408FDEC678238C9A28511EA73BC514764F69B03F4AA651F333D89D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0a37be213f6b0064a3fea5a09a7d38fa0c117317470477c3694c81a638caed25
MD5 56a684ceac347960e05e30d7826646f9
SHA1 dd24b0cbd9e9c2fe2703749b4c7da7061bc427e8
SHA512 6229ee66104fefd8fac732ab5fa4f447ccf9350c845f174af924e886ebab2a630aadd26396fa73a4bc8c363b815d92a1fc5575e89eb53611cdd57f5f7ba7e686
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOygkJU+Swbgb8k:iu6JmVxd2dOygOU+Vg3
TLSH
T180D59D13F1DA01E8D05ED478974A9233E962BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\_ctypes.pyd
Size 121KB
SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
MD5 565d011ce1cee4d48e722c7421300090
SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
TLSH
T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\select.pyd
Size 29KB
SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
MD5 e4ab524f78a4cf31099b43b35d2faec3
SHA1 a9702669ef49b3a043ca5550383826d075167291
SHA512 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee
SSDEEP 384:oG0ICxeeLn0XHqYK/57AvB0KJIYQGFHQIYiSy1pCQuRWAM+o/8E9VF0NyMl+:tieOGHqlGxJIYQGp5YiSyvHAMxkEN
TLSH
T15ED28F57AF646845D923C9B2ACE28E1ADE31B6924710C2CB3368C15D1F317C27BB77A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

time.pyd

Path C:\Users\Admin\AppData\Local\Temp\IDEVIC~1\zeroconf\_utils\time.pyd
Size 37KB
SHA256 108e5ae2bdb64b1ed8b867ba75ea5ffd7fb4efdbbad5e2667e10180ad49e93e7
MD5 bdef6607404bdff1a1513c90c972678b
SHA1 2a819f49ee1188474eae7448284f0f8a7a7c3c8d
SHA512 8f06e7d8054acdec5a46076ca9633254b6b9f8ae2fe79d676004f767223c8dc13c657d97c22890c587733ec4415bea08dab183d5f6760bc2c282f897f7f2a434
SSDEEP 768:7qnxZyEWB72d+MCXx2a2HbclWhc7u5Ic5kk:OnTq2d+tXV2Hbdgq/kk
TLSH
T16E033A2566A841E8E4A3C1B8CA335E17F7B0B456271467DF2150D3CE2F12BD226BFB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\_asyncio.pyd
Size 63KB
SHA256 746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403
MD5 07a6e6dcc30e1c4c7e0cdc41a457a887
SHA1 53bc820b63d88cbe889944e242b50662b4b2cb42
SHA512 837f1e40db9bdf1bc73b2a700df6086a3acdb7d52afc903239410b2d226ffd1dd5e8b5f317401bcf58dd042bd56787af6cdc49af96fcb588bcf0127d536b6c6d
SSDEEP 1536:/0f8MOytWQazE6XWpkJONIYOnsO7SyLzx1z:cf8X2sE6XWpkJONIYOndx
TLSH
T174538D83E2808595D957A074D8B30F56E771F6500B0403DE62A8D29E2F733229BFFB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\_bz2.pyd
Size 82KB
SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
MD5 aa1083bde6d21cabfc630a18f51b1926
SHA1 e40e61dba19301817a48fd66ceeaade79a934389
SHA512 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c
SSDEEP 1536:CX8z7RFgpNVu5eYu00NI5OhgYNxx8bhm+uVIYCVH7Symxs:CszlF+uyIkNxebhEVIYCVHL
TLSH
T190839E93E3605AF5E45B92B9A6A04357E331BE49035093EFF75883162F13F813D6836A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\_cffi_backend.pyd
Size 177KB
SHA256 59767b0918859beddf28a7d66a50431411ffd940c32b3e8347e6d938b60facdf
MD5 210def84bb2c35115a2b2ac25e3ffd8f
SHA1 0376b275c81c25d4df2be4789c875b31f106bd09
SHA512 cd5551eb7afd4645860c7edd7b0abd375ee6e1da934be21a6099879c8ee3812d57f2398cad28fbb6f75bba77471d9b32c96c7c1e9d3b4d26c7fc838745746c7f
SSDEEP 3072:nmHfhrWGYV6sewRdFRId6PBNKcqDn/C1j/UyS7viSTLkKxalPu//ay/i:nmprWX6sPRNPBAn/0/dCiSTLL0P2/ay
TLSH
T15C046B56329C12B2D69751788D675B47E3B3B8201750D7CF01A0C6B22F27BE27A7EB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\_hashlib.pyd
Size 63KB
SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
MD5 b4ff25b1aca23d48897fc616e102e9b6
SHA1 8295ee478191eb5f741a5f6a3f4ab4576ceec8d2
SHA512 a7adcf652bc88f8878dae2742a37af75599936d80223e62fe74755d6bafaafd985678595872fb696c715f69a1f963f12e3d52cd3d7e7a83747983b2ee244e8a2
SSDEEP 1536:r5m8HQNUbaxjTvKzl9mjNLOjxNHeuNIYOIa7Syuxrm:r5m8H79mJOjPHeuNIYOIaum
TLSH
T174538E46A69544A4D96781B9CDA34F57E9F2F1001710ABDF0368C18D2F233C3ABFA766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\_lzma.pyd
Size 155KB
SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
MD5 b86b9f292af12006187ebe6c606a377d
SHA1 604224e12514c21ab6db4c285365b0996c7f2139
SHA512 d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312
SSDEEP 3072:esdh8kZbsOb0Mt4zorT81qjznf09mNoqCPAaQVIYZ1Ncf:esdhBZbsm0hi78YOqtX6
TLSH
T122F33A92A394F4D5F7628C78D6624F17DBF678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\_overlapped.pyd
Size 50KB
SHA256 ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164
MD5 78e8049e26df6fd3a4011562ff8e74a0
SHA1 d5a91c720e4672c40e1dd6d54b3197b4a1f8b633
SHA512 ea7a54d38cefed870cee65dd9460b6c51131ae5219933ddc998a86d12bb093784242cb5471c77bc324ccf59fa42c2914865dcf582f74c440fa52b7d15d9faeac
SSDEEP 768:OiqKtLpqCvqlB1QIb1D1N+gpOUpEkCZ9hIYXth5YiSyveAMxkEs:+KzqC/A1hNekCZ9hIYXtP7SyExA
TLSH
T193337B02670404DADD67C2BDD8735F16EA71B4D2470183AF52A8CA4A0F737C16BEEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\_socket.pyd
Size 77KB
SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
MD5 b77017baa2004833ef3847a3a3141280
SHA1 39666f74bd076015b376fc81250dff89dff4b0a6
SHA512 6b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d
SSDEEP 1536:kHan8OG4wAM/Hh2JO9/s+S+pzpTzVs/tiTFVf77neJIYLw47Syt6xr:8an8OAF2JO9/sT+pzVVs/tYFVT7neJIh
TLSH
T1BE736B11A69011AAD2B3C07AC5634F23F774F4C1179597CF1264CA6E5F23782EE7AB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\_ssl.pyd
Size 174KB
SHA256 ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
MD5 0f02eccd7933b7a7c2bdedca2a72aab6
SHA1 0b4c551d8fe34d8128e5cf97daa19eb4c97db06e
SHA512 90a64082dab51380e05c76047ee40e259c719d7170fb4acb247b68a03b710461b350da3821b426fd13167895ded32f9c5ec0e07587ad4125683a18a3495f5ed5
SSDEEP 3072:mn5VVb4iZpIy+vgSf36XK7DapGB4JQELqOlh59YL48WKqgVl5pVIYC7Nb0CY:m5Vp4EaDD36XK7r4JkQY
TLSH
T10E047C47B59469B7E817E4FEC1230802EBB5F005331157CE49D6DA8A0F07746AEAAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\_uuid.pyd
Size 24KB
SHA256 e6aa7f1637e211251c9d6f467203b2b6d85e5bc2d901699f2a55af637fa89250
MD5 cc2fc10d528ec8eac403f3955a214d5b
SHA1 3eefd8e449532c13ae160aa631fdb0ad8f6f2ea4
SHA512 bf18089bd0b3a880930827d2035302060ea9db529ad1020879e5be6de42693bd0a01b40270b4e93ceaea3cfed20dad1e2942d983cde8bb2c99159b32209b34bb
SSDEEP 384:8ZL2/LE/t8Cfi/1VIYZwXmHQIYiSy1pCQgyaxPAM+o/8E9VF0Ny8/r:8qLadI1VIYZws5YiSyvXaxPAMxkEq
TLSH
T1B0B26C92DA605C55EC2789B1A4E54F1AE935FB824B90C3CB330CC2555F613C37AAA3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\cryptography\hazmat\bindings\_rust.pyd
Size 6.9MB
SHA256 7e22d579ac503b959268964102c03d4e96c8a9b74186158b8c82fdc8cf9d9522
MD5 12a7c0d35ccbd002150bb29ddd7e8440
SHA1 f16d9a4654dc76b3cfada387ff7bdddb0b18b79a
SHA512 c9e5e68de8f51f91cbba839b4fece1db4da7480890a6c7318a78deaa30191fcb8913ba447f45d4ae93b986f3246f09f8cc721e781ce020110a3bb5628b3ef9f7
SSDEEP 98304:1CPfKk+AGdmA+xiIfIBE7S2ohqc/3J2y:gPfr3GdmAwjABE7S2ogiJ
TLSH
T1D4766C69B6B8016DD82AC0B8C3475223EB71749A177066EB19D496F82F73FE4273E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\pyexpat.pyd
Size 194KB
SHA256 c7c7564f7f874fb660a46384980a2cf28bc3e245ca83628a197ccf861eab5560
MD5 79561bc9f70383f8ae073802a321adfb
SHA1 5f378f47888e5092598c20c56827419d9f480fa7
SHA512 476c839f544b730c5b133e2ae08112144cac07b6dfb8332535058f5cbf54ce7ed4a72efb38e6d56007ae755694b05e81e247d0a10210c993376484a057f2217c
SSDEEP 6144:VK/lLDYZL1p13eiG7eDT9AmNfLVuOgOgOgOgOgOgNltwZSm:VglkZHLVuOgOgOgOgOgOgN0sm
TLSH
T131146C5BB1A2C0EBD8838038D6D34A0BDBB1B865039197CF52C4EB7D5F277523A69319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\python3.dll
Size 65KB
SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
MD5 7e07c63636a01df77cd31cfca9a5c745
SHA1 593765bc1729fdca66dd45bbb6ea9fcd882f42a6
SHA512 8c538625be972481c495c7271398993cfe188e2f0a71d38fb51eb18b62467205fe3944def156d0ff09a145670af375d2fc974c6b18313fa275ce6b420decc729
SSDEEP 768:Iw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJS0:v/5k8cnzeJWJIYL0D7Sy7x9
TLSH
T134636E529B58F8A6DAF665FC38D19DCE143B12CC87ED88DCA57893D30E1A310A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\python311.dll
Size 5.5MB
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
TLSH
T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes311.dll

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\pywintypes311.dll
Size 131KB
SHA256 89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a
MD5 90b786dc6795d8ad0870e290349b5b52
SHA1 592c54e67cf5d2d884339e7a8d7a21e003e6482f
SHA512 c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72
SSDEEP 3072:luJ2G0a2fYrFceQaVK756Y/r06trRjEKQze7KN9eJKVKG6j1J:luJ2faiYrFceQaVfY/rx1eze7KbewVrk
TLSH
T1CFD33A47374684CAE936D37ECDA71A02D3A2B0110715E3CF46A0C29B5F63BD66E3A746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\vcruntime140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\vcruntime140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32security.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\win32security.pyd
Size 133KB
SHA256 10882e7945becf3e8f574b61d0209dd7442efd18ab33e95dceececc34148ab32
MD5 0007e4004ee357b3242e446aad090d27
SHA1 4a26e091ca095699e6d7ecc6a6bfbb52e8135059
SHA512 170fa5971f201a18183437fc9e97dcd5b11546909d2e47860a62c10bff513e2509cb4082b728e762f1357145df84dcee1797133225536bd15fc87b2345659858
SSDEEP 1536:wsEpYpxfj4qSvXig4F1UhrbLaXcGKpwjr8LnCUA4RPdaZYQ0HgqFUdPEmU:JEp8L4qSvjaXZiC4RPdaz0HgqFU9fU
TLSH
T137D3399333C480D4E56A92BDC9B28A13D772B45407D0E3CF0556CA968F532DABE3AF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cache.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\zeroconf\_cache.pyd
Size 196KB
SHA256 606951b63c631d15293309baf5a30c19f029caf3df7fb455f3d0b84000522f0e
MD5 f73919563061664c146e3bee2c70097b
SHA1 b9a31df2ce99f7d8560a845f54c084097ea5db89
SHA512 1346ba79edc8170cd0199b0dda5434349d69caf5910f40b413f4717d2183ce21244051b0e94b20800a0de8740a902193118a2a0ae0532317c5a1e4591d6c0793
SSDEEP 3072:RV/Gs8BplSs4UWpHUCGEudNRqSrORn6X5+meSP7VHqXWZWf15ENVFRD43hZg:Rtl8HlzWpUORn6X0SPBKXWg4dK3hZg
TLSH
T19814081523AC1099E9B78178CC23A613FB7374462B246BCF1160C6A53F62BD5B7BD712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_dns.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\zeroconf\_dns.pyd
Size 354KB
SHA256 e339003bc3b860598aa71e59f00cc5c4b1565ebcc8ef05bdcb4596cb34c558ee
MD5 107f09465d206807a9a5a2e588b684de
SHA1 23031c731f63e0a81399d457156a8cd3fd1b5cd8
SHA512 3068f2fb674ef10faf5856b0e46f83069fb7fe100ce1e898ebef5bd329c18606be30b0247e7a15c2971e1d6611fe3e38acab090208bb6d2104db0c88e0067976
SSDEEP 6144:H1Soa2rMGb3GIIx84G7D/6SRrva0siGuAMW+mMpCNAxweL:H1Soh3Gu4CLFXszqmQCjeL
TLSH
T1E9742A1993A81486F97B80788D33E513FB72B08A57947ACB5160CA543FA2FE5B7BD301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

incoming.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\zeroconf\_protocol\incoming.pyd
Size 212KB
SHA256 0f1b588e348587c1a60ee3768a6b4b12080d6419cff175a451a42a9ebdf16657
MD5 823b2e5da61fd056781fbbf5f5cf22f2
SHA1 302400b1cc6a6032e6f1469851b149def331cf99
SHA512 10d1e147c3aff88945cae0ea232b150e72a104373defcdf8debb03c88247403c02abac7e03b3e61ec92067db51bbbf528e681e22f0b9ce497e96463b0dfbe8aa
SSDEEP 3072:NQG3DiMgJBN9pbRSUVdA0ZSk+xFI15Ljs2cY4YeGuPqYFB5Vol+YXJ:NV3DMJRpV/A0OTSJs2c+RuiY7vY5
TLSH
T17F24291663AC0899FA6B8078C833E917DB72B4462724BBCF11A0C6552F63BD6B77D701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

outgoing.pyd

Path C:\Users\Admin\AppData\Local\Temp\ideviceproxy\zeroconf\_protocol\outgoing.pyd
Size 233KB
SHA256 42bcc902915e518dbd4a73ed7d0dc8f40e386f4e4999012e2117e8fb237f7ee3
MD5 59ee3ac5c4b03bae31091107d2990519
SHA1 bd477d6a16cfd955f09bf18af0d4905a01dc8b96
SHA512 b92e1d298e346048a013410aab5095375f2b6652e497bbdcb59d62ad7dfbd68c387ea67ef1aa663e838430fe3771cf1421b4c70d90e2c8417a84e60e70d62983
SSDEEP 3072:jKhHe7ghZWFSoNiu2RIoPVNB+h3Pxd6BpqtmXgr81Lr7mo59aG/dywBA:2tgghoFSoNiuNoPVNB+F27X3By
TLSH
T16034191563AC4859FABB807C8C23E917DB72B4862710E7CF2160C6552FA3AE5B7BD701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 3942275e908c8d6af5eb0d7ba94cfaffb004b64523428b606f1952b63a427ea7
MD5 d28ae8d5b83b16f5f8cb6d3d294cfb23
SHA1 42dd1853e8743973451f64dbf01dd3ebef17b4fe
SHA512 293c33ef1480df30dc98c44638818108767ec4cbae1893f83e15da59c52bca48e58afd18362992c23792b7562c925f09eed032193065bd5f5bba281b5683b3ee
SSDEEP 24576:gbxA1UGDmygxmJU+iHqqti5ZvngbRahGnwK:gbxA1UtygkJU+Swbgb8k
TLSH
T1FC65125D16DC04E9F536853885C68201DB71BC256721E3EF10E5A3B91F3BEE89C3AE52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 cb03c9af1a3287c27082e4b562694215e151565789e2bded856300d15529f3b4
MD5 ff03063c20cbd6d1dac584a18c52452e
SHA1 5a0b30c481951f62a8f2c866137de5d527e33df2
SHA512 221d9dc8cdbc495ac87392d98831f8ffbdbadbe1285030f8f0698002e809571d0b40500ac92aa658eecfea51c8f0a9cdf49e1821b37ece2c9bcbeb6c879f3756
SSDEEP 24576:QjsmP0yHaqrVqHra44KDzMsrnGmygxmJU+iHqqti5ZvngbRahGnwK:QjRP0yHfVqzlAsrnDygkJU+Swbgb8k
TLSH
T14B45AF2DF2B910B9D4AAC136454507B5FB71782D1F209ACB01B0C634AF1AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 dcb72f2d9554dad3b4a83fbe2472f0234b0088e56cb4d2658432ac4aee4f03a1
MD5 738ba0f93ce829e65586541645da40ed
SHA1 fce0d6ecacab6117abca91af6bf690b96a67fd29
SHA512 5710963b5f6269f14738e7a6b29050c4a0709936d0b2ce5aeca1e2d5d2b33aedc54100dbb2d57a45ae6e5bdac3c6f8bdd8d514b1863da4285664e289041887da
SSDEEP 24576:tlYJeXm5jUuEfmygxmJU+iHqqti5ZvngbRahGnwK:tlYJeXmRUuEuygkJU+Swbgb8k
TLSH
T1E565128C369C20E9F52A817485964650EBB1FCB06701A3FF41F0E6B95F3AAE55C3EE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 fbf022d92eae8c3c47385c37f1444cd140ff44fef1c83b4ab35a40c0f01dda6f
MD5 579849a5a8b8f85d8f96fdc53a5d112b
SHA1 824b519986d954972cd85e5ae801a0dfbb5fefaf
SHA512 a646d74adfa8094c5c1fbc032d3be67079c00b3ea2fd8cc2564ef3331d61bebd19913790d4c3b5c1aaf9c28888343f483f1546c1cb10dc15009395521a2acfab
SSDEEP 24576:KBtymmygxmJU+iHqqti5ZvngbRahGnwK:KBtcygkJU+Swbgb8k
TLSH
T16E65124823D851A8F9760A309AA74290DEB8BC209F1592EF51E0F77E3F357D4E835B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-399-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/948-511-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/948-450-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1072-486-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/1072-402-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/1196-199-0x00000262B29E0000-0x00000262B2DBC000-memory.dmp

Download

memory/1196-198-0x00000262B2910000-0x00000262B297B000-memory.dmp

Download

memory/1208-413-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1208-489-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1208-411-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1436-492-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1436-430-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1500-160-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/1500-369-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/1684-439-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/1684-397-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/1840-532-0x000001CAB8E50000-0x000001CAB90BE000-memory.dmp

Download

memory/1948-394-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/1948-388-0x0000000000400000-0x0000000000559000-memory.dmp

Download

memory/1948-389-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/1948-436-0x0000000000400000-0x0000000000559000-memory.dmp

Download

memory/2204-451-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2204-452-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2204-468-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2204-442-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2204-448-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2204-484-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/2204-513-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2328-368-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2328-119-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2328-125-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2328-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2764-379-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2764-378-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2764-385-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2764-432-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2852-210-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2852-370-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2852-212-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2852-204-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2876-500-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-528-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-520-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-521-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-517-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-518-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-524-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-516-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-522-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-525-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-507-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-523-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-526-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-527-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-504-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-501-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-533-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-519-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-534-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-535-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-536-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-509-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-498-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-529-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-497-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-530-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-502-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-503-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-531-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-505-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-506-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-508-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-494-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-495-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-496-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2876-499-0x00000152C7920000-0x00000152C7930000-memory.dmp

Download

memory/2960-159-0x0000000140000000-0x00000001417D3000-memory.dmp

Download

memory/2960-202-0x0000000140000000-0x00000001417D3000-memory.dmp

Download

memory/2960-0-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2960-10-0x0000000140000000-0x00000001417D3000-memory.dmp

Download

memory/2960-6-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/2960-200-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/3084-107-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3084-101-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3084-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3084-367-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3100-433-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3100-493-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3376-12-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/3376-337-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/3448-25-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3448-16-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3448-19-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/3448-343-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/3992-425-0x0000000140000000-0x00000001401A4000-memory.dmp

Download

memory/3992-491-0x0000000140000000-0x00000001401A4000-memory.dmp

Download

memory/4028-421-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4028-490-0x0000000140000000-0x00000001401C4000-memory.dmp

Download

memory/4028-415-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4028-423-0x0000000140000000-0x00000001401C4000-memory.dmp

Download

memory/4428-427-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4428-429-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4436-510-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4436-437-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4908-441-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/4908-512-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/5056-96-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5056-109-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5076-136-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5076-143-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/5076-130-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5076-138-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/5076-140-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download