21ca036fad488dffee04f5335e10934c88c74c97b58c89ede068d8a600588636

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260728-py3dashq3x
SHA256 21ca036fad488dffee04f5335e10934c88c74c97b58c89ede068d8a600588636
MD5 d65a5cb483ca5d59bd01b35182842a0b
SHA1 c7e4bd07e953a7bbf7bd17a8e6052028d25a452f
SHA512 16df95ef280601d8dc3a798406d2f41e8fe5977bf6802e41ce4006fe12aec3a2df9f2389845b4e664c91adfdf7bb85e8300d4e496a7aafae1566e4f307166dbd
SSDEEP 49152:90V8tmfJCiulRM6Cm33aC0npmZNkj8A5cfi6jQCw2OzKTG55ge8Q/lFTjN4:OCJxAUdCLm
TLSH
T1B5167C0BE6B940E5C4BBD13D8A539657FAB27849877197CB07A0871A4F237E09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
860	alg.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
956	elevation_service.exe
1112	elevation_service.exe
2792	maintenanceservice.exe
3936	OSE.EXE
4752	fxssvc.exe
3036	msdtc.exe
4340	PerceptionSimulationService.exe
3828	perfhost.exe
2528	locator.exe
1776	SensorDataService.exe
2548	snmptrap.exe
3284	spectrum.exe
4380	ssh-agent.exe
3168	TieringEngineService.exe
4400	AgentService.exe
4632	vds.exe
4952	vssvc.exe
992	wbengine.exe
3528	WmiApSrv.exe
4656	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dad584679c0b0e8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-shm	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-07-28.1245.4880.1.aodl	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7e71d2a8f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d194c298f1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088d3292a8f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff778c298f1edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c9f93298f1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1475e2a8f1edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004243bb2a8f1edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c791c92a8f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab3bb0298f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f796d298f1edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4728	DiagnosticsHub.StandardCollector.Service.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
4728	DiagnosticsHub.StandardCollector.Service.exe
956	elevation_service.exe
956	elevation_service.exe
956	elevation_service.exe
956	elevation_service.exe
956	elevation_service.exe
956	elevation_service.exe
956	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4880	2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	4728	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	956	elevation_service.exe
Token: SeAuditPrivilege	4752	fxssvc.exe
Token: SeRestorePrivilege	3168	TieringEngineService.exe
Token: SeManageVolumePrivilege	3168	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4400	AgentService.exe
Token: SeBackupPrivilege	4952	vssvc.exe
Token: SeRestorePrivilege	4952	vssvc.exe
Token: SeAuditPrivilege	4952	vssvc.exe
Token: SeBackupPrivilege	992	wbengine.exe
Token: SeRestorePrivilege	992	wbengine.exe
Token: SeSecurityPrivilege	992	wbengine.exe
Token: 33	4656	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeDebugPrivilege	956	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2208	4656	SearchIndexer.exe	121
PID 4656 wrote to memory of 3024	4656	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_d65a5cb483ca5d59bd01b35182842a0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:860

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1552

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3828

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2528

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1776

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2548

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3284

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4380

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2208
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 42c2404d19dd15754f8a00ca25e5c97468e869174d3cdec26cdd7939289542e5
MD5 1f1f6920578e7d994ce62fa57537560e
SHA1 722f8d3711d011eb3ac7a95bbd2a9916c12a9ef2
SHA512 d095e1e3d9018f66cd13cbdfb237085384831a1e822a19cccc18d1879da484616bf9aac3fdb411949b175d3e7a477b7fe214baf6c66bd5eb7576d9fcd810b768
SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnuQ/lFTjN4:03q6HjBiLm
TLSH
T170D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 25a17b47e0598e8f8fab0017820fbf20df38303b019a6c2f5999a5f270420bbc
MD5 6fa0fcbec72c6672730b748898f8a168
SHA1 77a144a8c34becfe28ca3d89ee5c9fde104aaef8
SHA512 b3bb77e6933c70e0e3517c04308a1316b3e4a71e398d9ee551577d4b316f90c392a743b47a859a7703177cf1a5327eb3e63484d9d9f282da7ce091740e76b846
SSDEEP 12288:11XLsswWkxy2lRq2czABGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:bXYfDtczARnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1B465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3af04612f8a74a5ad6427a2d248f59c55a6f0e39d5cb678c45fc5ccfa1148e41
MD5 55afad94c65929d0912a4f9de4f730d8
SHA1 bc89014f7329b838a5f1740b329bf9b437005751
SHA512 b371bb73f438329512e0e37cecfe1635284be19448ec3806e0aee85ccb622970c4ca94b9edcb1ff414a1cb135462756531e169841f1642d58ca72d6ba65dc02b
SSDEEP 24576:H0Le5ji0hmxLrMmnQ/tbw/2Mkjy6Fr7g0oY:HPji0AlrQ/lFTjN4
TLSH
T168859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1729e6bc2fd4947e27784c34ad50b80ed42d8fc584dbefba89dd43dfa54c676e
MD5 72ea394835f2a57f38cdf249e660693b
SHA1 cee232a36a7a194f8716615dbc8155012eec64e3
SHA512 f979d82da457b431e8aa85fab0d2736c99073ec12be492b47ea755a066d58d836356276cf7c8f429bfc2162799f64d1386c6520c506942cd9f68e0e144d13886
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWE6q8wyucnQ/tbw/2Mkjy6Fr7g0o3:A/ezSC6vUzPvxHjyvQ/lFTjN4
TLSH
T1E2755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dffdb1424a69d784aca4438a22c8e9488ab559102d0dc433a001c579605a6df0
MD5 07c83bf21563a65cc5b53e62ac1d88e4
SHA1 1942b58bc49290c38823c75e8094d4636627ccba
SHA512 983ddded9f0b85246bb2afa602be227ee99463ef3b2ab195fd2b2ff84d604b54e3edb1acb327b28b2b87fc1e0e0610a652f70689d12b094cad839d952c834098
SSDEEP 24576:dVbqPb88hv/l+69nQ/tbw/2Mkjy6Fr7g0o2:dVO88hXl+aQ/lFTjN4
TLSH
T14D559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 084e7c1a8c7ddd76397c253727ba8278898002d01fc2bf79b151bddd5d936ddd
MD5 889fd04cd48d87a5db4f1362bc7ad962
SHA1 9c11069d2d0f18fd926fbd0326b1c57d0145ea33
SHA512 a662bfd795c78ef2bd636e9b3127c0cbc42c74949468d8507a519eab849d775a43a302445bc1da4edc88035af19c9142f8c88ceed3e0a3583f8c3ea09c683083
SSDEEP 12288:bzCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:bzCnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1425523696A24F897FF2B06B15CC284826B7B0EC1BFD4E74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 18153e50505674717d25809790d38426548560764bc515861c20b250bbf8de39
MD5 9e681c686a73072a30fc77f246fce0b4
SHA1 dc118ce2b86192ed7028ebb724d759ea4472d667
SHA512 6169822ee88a66e38bb18a2845d1e09164f3464ab5b09d149d5b552eb6017b52392086f1895550304788fed82f1e3be888f9dd828f8a8314f53d9b33cdb79a0b
SSDEEP 12288:veBNUbTVO86UVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:vJIU1nQ/tbw/2Mkjy6Fr7g0om
TLSH
T13075CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e302f5ff88c55dbb66b96efe45739892c1b3ada1dd5957cd3a9cd625bf39680a
MD5 4f8d2949aea4c20926ff5dc9e44a988e
SHA1 6584274dc3b1184cc738bb4e660478cb82735363
SHA512 f8abbc7882f44ac9dd91adab51b6916eae27badf5dd8cc16fd2ef7535aacd16fda84259db52e884596b30958132b31135b22e7d8f55ce7a39d0414e06c20f4f2
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:/QvGAdlCEL8c/yRNw5CPLm
TLSH
T14B267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 09f0aabaf9b06f645066218516e90d196c7c898bc1e59f00e208565897185740
MD5 0a8846e9b824a27aaf07c183063d8029
SHA1 d1698cbd4c2a817a275adbe86db216dce73bb65a
SHA512 73a45ea216e91884e53439be4b277cf633f5269e8c76c74e8679b5ab922c4cf6cd5c52b32a80ae6ff7a567bd12570a448ab0c9894735ff2b3f59d64fc8368e3b
SSDEEP 12288:JAwSfxL/2Dc39DLLmt0LDQewsAjLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgZ:6QewsAj7nQ/tbw/2Mkjy6Fr7g0oz
TLSH
T11F75E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9a1b1486fb43e1bc95e3d13d96c69b4e3407932f6a7f970e6cd7e73477514e4a
MD5 7e0b3511feae216be14ef805ff677054
SHA1 960e5d392e0c846eb1bf7926d27930f162033bb1
SHA512 33518b02ab1dc77c04a887dad022cb9810fb48f5e7805d2ea2bb261f6b105a04662c138299a23a62aebf37c7d1887129ca0e0464c4fae07ff097834c0e252c48
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHoL:wUEtQevvqc2W1cpV2EI32
TLSH
T13E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ef80d13c9b92af2398e3b531e15153373c911a40874cb31f7945a42e0b9b7ccd
MD5 3dffb9a87bb0ac823c92696322dda264
SHA1 7f388dc3ef24fb39496c82b296def996659b0ca1
SHA512 b3e57ec311dff2ffe2da16fc09c567f6f6a593e2bc971a352a4bde08cf32feea7bc2d193750039a8b038a33dd73231a6825d7768c920f439b7a33d6bb36d81b4
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/zbQ/lFTjN4:OoqtVjnmzLm
TLSH
T1CBD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a53648d37c60bfe750d4c094da4d040a7f6f8e9edc7a7bd512f73f609a3af760
MD5 16f05302a3e857e6aad6b6c54338af6c
SHA1 7d3dc26a8bd3efd288086217e3440499ec263b46
SHA512 c8a66d18484990f90ffd5204218531d46d7ca79e079b51095ea79c06726a58be1decdfbccd3e90592293752164aa7aa1a186fd5ac7fbfe2cb896a8fb9152756d
SSDEEP 24576:FAhGLJIFoiwtA5l7S53AnQ/tbw/2Mkjy6Fr7g0oj:FAMyFoiq5wQ/lFTjN4
TLSH
T1A935AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a6c3e5953405305700e489188a7e8b9049112399c4a13acb955617b8f3496e11
MD5 109b4914631bc09a91933208ca8d1137
SHA1 8c55d5886550c904c8fff6da659240ea36ce79f2
SHA512 447b9515c7efffceb723dc6d116ec7df5340285de4f46c0a17aabafc1e8b7ceb34b9157a1294979eed600912aabad3c72ec318bd4d1ca3f6289643a100646452
SSDEEP 12288:3mw5HEjsChN2BFgl0WDm+C8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMV:WwuHOWPnQ/tbw/2Mkjy6Fr7g0og
TLSH
T18865F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3325ada0fcbd1c6ef3e411d200b51879cefa0a350d5517ec83ff343b6c44054a
MD5 18c9f67993d086cb4697fd2ddd767aee
SHA1 d386204c8c71a27cefa7a8b3abd1a4aaf266c6a6
SHA512 48932723d8d00e7f10a7e2c749ac7c91d6cc44907ca015d6a3f4ec6920325c08eab58cee8696ef9a638ab86129901963597b845dc7875f0780197bba3a021908
SSDEEP 12288:JXZ1IybGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:RZu+nQ/tbw/2Mkjy6Fr7g0ob
TLSH
T16155126933A4B0FAE6674278CCE28646E7733882677183CF275442695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7e51124298c0e5314ef0ba18b91fa4d5b18cebdae83085b60a8c0244b7587885
MD5 16e9f68d6656347223ca36a62403751b
SHA1 6c76d15b962ac411455202856eb25961da2c2418
SHA512 858b43193105bc24409496f2e57f7829f01ae2c32d9c56ff00ffd043adeccbefeb4b2aba6a56ab78fd69f44adeee66a5f8d2d30d10ef24b826f151333c6d247e
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:sQRQyi36YOcPQLvw2gAf+PN3eLm
TLSH
T141667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f84391b52c60fc9d230fda93417b257b77ab42e23b9cb6d609fe50ff59649949
MD5 30c811df48461f7e26d1ac3af5e3cc96
SHA1 89242a1af793898a734456f4c089c4478f8248d1
SHA512 ac4fbb3fd20360d8a37e9267fad4ec7856dcff862b0dd4731bc9b09c5347237e94355e7fa8e47859311a60fa15d13db8fe8037ca503a0997276a373b0bccb9da
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:+QRQyi36YOcPQLvw2gAf+PN3eLm
TLSH
T146667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7d677b1f56ef83b27a02651046f35f312a5fff81ef4303c2ee481a06d31ed152
MD5 c9093ccc958fc09207efe40436bd0b2a
SHA1 4077dd6d923f5ca1572eacf780b5b500edc6dd89
SHA512 e84177dad9f00ddbb8f66b3b6e4d4357d89eb383d5aa3d4a539acb9975f4b959d26e5ed0934ff9b4cb804d1336e594a99470f4046786f79d2380167770b641e7
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0unQ/tbw/2Mkjy6I:Y68Qg55nhheWu7PNU3/rQ/lFTjN4
TLSH
T12CB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f6c89f9c6a7904ed1f302e86c744a3cd169ad53861b51289bb461ba1cdd8c768
MD5 f08d056c0274d000613b1abc0ef6b591
SHA1 99eb784951c9daca88345ca7f7ef26abc9743175
SHA512 2154f74b6f788ecac39fe41326eb34d1d175ab1946d21ce444bdca91df4f6442db4c8959da63d0143f706010935aff3c78c7b8ad99e238f14da9de520d832ae1
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99z:xy5112gYy5azzVvL69nLKnhZNLm
TLSH
T182167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d90fb505170c0d84aed42c04aa113f3ec0548b4d501da58ec8e69b83a55de995
MD5 0b97b016e353f30cfd951dbae92e9cd9
SHA1 ca6782a95cec78643e15fb3ea7b97201666f5e89
SHA512 da8612bb47b750139ced296847be89a861fcb946bf87b0b3c35c81063e624bd1a8f72cce6421633693d863e69151c6d4c716c3ce3b4eee1c6e234c3792c8d149
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glBQ/lFTjN4:Xu6JmVxd2dmLm
TLSH
T1CCD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 06a661913b331799a04292e46244e283eeccb21d3a71a98318fd588ee0826c0d
MD5 bdde9c8b5a92ac7d10209dc652390698
SHA1 903bb94710d71cefdcee9309dd129f95acb7079c
SHA512 5d99963066d036745e4464bf707bafb8b0553762e63b35a77d14aad0dbf8d57b8b24c6d6050f8f1791655f9772118147910b5c9381065134e92a02ff11f629d6
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xVQ/lFTjN4:nmifPbRzLm
TLSH
T14FB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c5da5609e168267de9e0f13364513d0cb8a6f6975a73123cdead66d1cf66bbf7
MD5 a655e5ac1aa247ef8fa4a79e7691ab60
SHA1 5941970f74976da11fe91dfcb3fee7c8c49a2132
SHA512 210892372f1f7380b1b83fac96a9e7bcc353565f1825399258c76a59a207d0c8e457b120f97cd7e7ebd459c41912c252a9a2b8aa883d098b5ba7235a39ce77d4
SSDEEP 49152:BSuZQIY0Be2KRRVtOnks6NMHq+Q/lFTjN4:P5dKTi61ZLm
TLSH
T1CFC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 245b34558f518a5da9f2ebb20985a4c97930df9cbefbfd084c75c68d15bc6c97
MD5 93bb3e04cda9de1892326c4c46ccf7a4
SHA1 47ca2fa9232d5e6fbb1a55f58632efb1264d6084
SHA512 c27639d2433d2dd32e60af124f760adbe655da024274e06cac8bd338561ee889cdafe0b45e398be4614cdeec0049f82e8c12b5737f69e2285aba995f1f7c535a
SSDEEP 49152:1htSn8EApI0figngiDn0AP5wRQ/lFTjN4:EX2iyphnLm
TLSH
T1EE95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e0d67f15bfd3f0cbfca88a438194a1ef80634fe21165399e8e3dcd25e72b0353
MD5 7323fee0bb8bbdcf14f564e607a3a71b
SHA1 c0f589954e5c2d2db00a83f7c3241331cf6ad2b0
SHA512 99a8db47bcfeb4e548625abc149b748a3e415deedc826a2156d3bf760c34e94655f98ce85fe6ef5e0aa3b22bba0e9312ff1cb4cb829548bb7c098a636fe37751
SSDEEP 12288:1aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:1anQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1DF5523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 58ef7ef1c6150f7cb9b2ed0df0c3dcb6bd4a788f4a5fe0e3c082b24d77ac104f
MD5 3a119731f4f5a02a0f802577f086fc60
SHA1 974e4d160f4b5aa40a362fafadd0433028ee626c
SHA512 df226a6d3dff9834c636d1d604c0b2ca724712acd987bf06aab6ae3c36f62558e8787a52fa25d400619b2bd51563389d6d11a382c6dd61999646531953b5f232
SSDEEP 12288:33GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:3XnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1735523697965F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f21e834cf77402deb0b481a4ee61a0439edca14a469f8a33846392c1fa43c1ce
MD5 555bb2fb7d6f12868326e29173168515
SHA1 3f21885bda41f1ad287bd203ca2c9b8525395d66
SHA512 208f368b4488031bf1f687f9ecb33bd0be1b84f200dd919617b620c4c3636247513c3f5a295bc4ce4eaa80616e6c04e8eb9224c3b2de3ecf416f9a533b740b4f
SSDEEP 12288:8NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:8tnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1DF5523697965F88BFB1706F54C834182AB7B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3cfbe657e8f30877b3fe2dd171039204381776e3c86f37053b49e0e2332b6e1e
MD5 ad804b00cf5b5f84c0707ce555fdd76e
SHA1 ed06e0623823fc8fc41313be7be3260485a06543
SHA512 0121cf6aeff779c28a89d76ce30d0d4ea85c8c23b464c1c4f22e938b55d8b0ae1128cf0a3e559a72ff31e7e1972c0e5f9c16893673caefe7e53d476609861d49
SSDEEP 12288:wVAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:1nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1425523693B69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bf6f3d44a4e2b103de56cf42a484270387282a188daa90ee946e8c1898e33448
MD5 e9ce1e0bf407638bb3e55d655cbeb5d6
SHA1 c3e6cada8e4f5251309496524ad41091d11361fd
SHA512 50d1c8fe918189fdebc4f8aeb0c6274f3389e5dbd5107e55bea013820b6764e3faabd9e3c40fbb0785ec20fd8b680f0ea05cd83993e406aa147562e1ab9c2849
SSDEEP 12288:JIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:JInQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1C85523697965F98BFA1706F14C838182AB7B0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6a0a0b411c102d94ef863b8895e24ec18ba3a8d29c4097b7cb82a7f647fd0c6e
MD5 93c22eee8f0af8eb5454c830938828f7
SHA1 ce2851aa10d893cf4f97785d887b0ce53f634713
SHA512 9d7cc6c1b3e64828a4e47d4bb954c2741e848febecf428b0f4a68221e363eff9ee719f80e5a7b1d55ff6ebe2502986e33601335f4568fa7f3bc0a89032c8292d
SSDEEP 12288:/jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:/TnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1895523697965F98BFB2706F14C828182A73F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6b13bbfd8ad096e0b778fc45aa836483cd6e307238f1bbe24c377fca8859b4de
MD5 d2db549a4e096f94ec4c8d14f6685f26
SHA1 a259e40c2919561168baa0631a1755c65f7d5657
SHA512 d243f78a2d6d8a00c6aef199822037fdaa846eb15f38bba5b05b40093d0865463eedeaffd38d03a9d7839926f098c350b89753455bb2980c037fb3fbb7639022
SSDEEP 12288:XfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:X/nQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1C55523697965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4b7ae12a83bdf576d6f376761714516a4084fd537b03e90298c4ac61c3bbba47
MD5 bcb5422483cb72405b53bc21245d4c0d
SHA1 4f5d9ea052ae237acca64a0525e0a8359d33804b
SHA512 28f642c5c6b91de7f51d0a0704a39f6d74c8ba15b3d35fcd66f807b4fc4d17accc58f4a73b7a5e9a22c625e37aafcc9e180d0f24767af8093f6801083a42c1ac
SSDEEP 12288:2iZwbDzzFEoS2cPvyXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:5ZM3zFVSO3nQ/tbw/2Mkjy6Fr7g0om
TLSH
T1077501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2b0c476d9aa89ea1e2429752e9cef01d7fa881d62995dd75513b70e82e85adb6
MD5 27b7f1be4128331f4cde538be8802092
SHA1 12f62e4f2722249c093ccff50c22029d3a6d37c6
SHA512 58daf795831dcfe07be57e2a11b8efce9645de4ed2e9f51fead6a2511e00f76eaff8b03c74ef19addd36ebadf1a4cf1bd8047615a4471ee95a70824dedadf997
SSDEEP 12288:ROGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:ROnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1545523697965F88BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 457824b501504816b4e1e6343dd3b681d2f471c7b18375fc6c89a56687aacbd4
MD5 7f2def0a9e4afbe63d68981c88841bb6
SHA1 9d98ac90c64298e8c696243d9d420dea7dff4d65
SHA512 d1f633f608f2d73d82be4490481b3799e32f718d50aa3286611c0b1435d1c8e3715dd45f704c0ffc6c8d63add2e34abe76474a4348333d21216c84a43f27d3f3
SSDEEP 12288:OSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:OSnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1045523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 08e17be2ffdd60746e89bf71c1b1945ee1618370c2f4d7e9da9d2002b43d3ba2
MD5 10d1444984ff01f2189efb21c2df4606
SHA1 0d90232639fadd28db08776cc2e053006de39a0f
SHA512 a3a7fb53b5d902c55deb918a866c24859da743b14d813d0887e039f5dbecfbf500c58d62dd69854a9f1b34f8d83dd54a4e5535f253f5972511aeea39b0f0c9bb
SSDEEP 12288:/yPz5L8bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:yzyLnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T13F65021773A570FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0ecbcba4562c4f95dbef27069ce238a56d23164bbcdf05403afa1d8bda769279
MD5 880c1a8f064bff61170142da2050899c
SHA1 061ba1ade03a1d7c8d914acf83c19fd98b89d4e7
SHA512 74d11283be56e286755860d2270447caeaffa447ed5234902f42b81006da741e8ae51f219cac797cd188fa8b2d454c317470a9671179c2bc842080bf097cfe58
SSDEEP 12288:tOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:tOnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T11F5523697965F88BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8263fc29a722892b49cd732902540164eceafc15f32554724b19882c3fa57e02
MD5 f38e7b9c6b6573edf23983b41d9be192
SHA1 af44004cc6fc7f87ba195acd3187b6f5bcd74019
SHA512 c8df31a9a8a682fabcedc4525c1b7ec71fa550981c75a86f3ebb0020ffc1049474644a21789c95275d746255b12a4d34e11049ba2656b2b1333dd9ac4190a8f8
SSDEEP 12288:zOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:zOnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1AD5523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 aac18d87c2c1ab5488dbde2a59ef307ca2c3b21ada714a5ec7ec1fbf90554623
MD5 b59dd73c898227dbc7f75ca72da9aa01
SHA1 eb366c12c13c0a042ee9fa977d94e5155a06ac47
SHA512 d14af0431d33dafa26d7c88e0ce791c987679f613e2be8d04d79c7414973c308fc5ae884e55a1b06dc6a42b5465701e279da33df7120aea6d995f8faaf5435c1
SSDEEP 12288:SyPz5L8bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:PzyLnQ/tbw/2Mkjy6Fr7g0om
TLSH
T10065021773A570FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 17f3d40b1c03948cec4dd939163d5dbfa071c8e3e0b76a890a824a7e69978a02
MD5 efdba407b309147bafa084c4c98f69fc
SHA1 55771f5311118c76338d22a3fa3b6216972d126f
SHA512 c45e43d319949cf7710490f09ad2c4cabb90e5d5db4f153dc6c6beb352181b6e3479dd602d93983ed2e1b32dfea0687874be68c7df363214a66780c873dadacd
SSDEEP 24576:fT0aLl3z0zDdnQ/tbw/2Mkjy6Fr7g0o/:fTDLljcQ/lFTjN4
TLSH
T1DC7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 23e7ce4baf999af558ae8b365543725a736abb3ca7aebf71820f15c373d6e26f
MD5 1554073200fcf29a16ed77778cd3f9f9
SHA1 5ebdda5fdbefb5b1d11f833820bc7b244bd1eb0d
SHA512 179f8bd0770200d0fc261524f7b8e68882e171dc78af67479b8b042873faa1dc99de6151d9ccb2513f07599b3f3dc46775b46302541e56906a42b54a3d9670c5
SSDEEP 24576:F31d9CHKy7GZJnQ/tbw/2Mkjy6Fr7g0oh:l1d9CHKyajQ/lFTjN4
TLSH
T13185CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f1ccd8a0bf9f74691cfa6117e96821ff0cddf88214eb60cc7f8f20c693d74dab
MD5 a840f64efdb9387396312df9bde58928
SHA1 7a324a2918f2b0118d63bff35f83a06fe81bf88b
SHA512 26eb44760f8db11f3a1cbe3e9d89af603577ecaa170b6e3660abd2839b4c236339da61b880dc8c61ee10a168799e20fca16dc803a41586d464a57d39eddd32b4
SSDEEP 12288:FtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:FNnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1F65523697925F98BFB1706F54C828182AB7F0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f1f8bf8248ebe5297ba5992f60c93f0f33713060edf7093714f4516804e88569
MD5 01f82162b9b5b27150d2314b8ef0a108
SHA1 89ac07cc4763d26451a63fc705de2b5abdb33971
SHA512 5b1d9f5d972997c3dcf593f0ee48a786b0de0f4e2cfacc865f961c6532fad8d5c8ffdfcace5ebf4d4140f00952990de162436c640ec8ca59ea82df411bf2b923
SSDEEP 12288:c7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:crnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T14A5523787964F99BFA2B06F548828182A77F0EC6BFD1938F7B481129967D39406C63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 2e337627bba2aac9b843bbb028dd0c90f5076ab9a764b01821655f6bab39b143
MD5 8d7cb0016e183ede875f0178b54fe780
SHA1 c68fc50637b15aaedacc68685d854d64345d0500
SHA512 0ddbc7d999b53929bb6434f43927fc3ea0607a321f55f795ad293674e3c320d2ad72b3a5c7cdd49131f2a8ee9b09c9688192108869f104cf7e1d6ce9ffc038a9
SSDEEP 12288:6kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:6EnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1235523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 89cd7084584263b9ddfa2c88b68b4cee48e89165db8ac1c0c48cf844e9389ff8
MD5 05ec69fa56221337fa158ca3cded4b33
SHA1 0ae44e7025df54a26fa7e0e8f589f80e5876eea6
SHA512 f5edbbf95c6936fdcbfbb7ea7377985234d0e7c33306ad0c6f2ef59b62c849d3781fbd1973468afbd879e19c13b5e47f4ab2cef257309688b05134b4c505927b
SSDEEP 12288:hssf+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:J+nQ/tbw/2Mkjy6Fr7g0ok
TLSH
T19365F119E29852E9D02E5279CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6cf65c8f0a1ecbbe3aec6f90ba833697b2ad097bdbe46afefe37af38fb728f96
MD5 cb18d568023fcb24d3f5cd09838fdeae
SHA1 7a372724c216d60c971bcd37567987b926fd7598
SHA512 85b6a7c16f53966ef6f95965d6df88a77afcfe806d94f777196b54e8ddace7ab28ca5a5e7ebf8316e35d3c9e165bdf4451bb92362edf87c0095bbfca2c151bac
SSDEEP 12288:ngGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:nAnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T14D5523296768F94BFA3B06B05882C151673F0EC5BF91D38FB708222D957C3D41EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0c82afec781a20ba3892fa535ce4ab1d88896eb5a4b00c4dc2bb1c7630e692a8
MD5 cdac8ca9f98d58eb2d9016f5e01e47b1
SHA1 6fb57412d02ee58a5b1f8353d8df6a28edb08ff1
SHA512 e41e51a41a24fa359df722abe2713ea34d5e4e31ab393058d199c53205b7ad91b7c0aa28859dd797cd0328156f19a50f584e82325a4f2f7373fd67c586ae7100
SSDEEP 49152:Fa0h2GEkuAe73q3pp46zwwQuQ/lFTjN4:Fa0hNYG4JweLm
TLSH
T10F859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 9b0cf66c1f5cfeccb5bc8254effdf2271472475af62b17bfb6a56c66111cdf10
MD5 92ec70a8188c516bc1fdbf133dd489a1
SHA1 f037117974476e6964220d15a2089ffeb40ecfb3
SHA512 e3983ac6aadde71e36f79f07a4f92c56cdb0ca9c1b2bbad89eaf8e0af1ae12dbe19dd0b72186633f55bfbc79e3a2b4b0b719333a635bbe5591772a18b42a0896
SSDEEP 12288:8hbHjfXpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:8hbHjP5nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1CB55027E26AC30DAF63692BD88928546D7327C552B11A3DF2381423D4F3BBE41D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a820df79f25fbac36026f6af90ed9f151773a69d96e8db59c4d8758208f6f9d2
MD5 22236009b85e45a14a35dcef859715bc
SHA1 94ad154ea90ca85f039abfc012b1421fbc6ec775
SHA512 016bf729e4e052b28f4b9ab88f80def686fbb0b46e73a9c12a7f52b0ebd6a1bcae0bdf4f02e0238cce37c9daca22edafe9629562cb4af5e406b2ca8c194e751a
SSDEEP 24576:c3YgnJcRTk4yti+R5dBR/FnQ/tbw/2Mkjy6Fr7g0oe:cIgnaTk46pBR/FQ/lFTjN4
TLSH
T13345BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 4043b8880aa04829d81eb86dfc20495754f8543eafe3086397681c4fec1d4be0
MD5 28eb85888386d39f1092d98e447c5338
SHA1 c9b8e10755a1d6ee42ec6b234e8c14a7b48c4ab8
SHA512 70ed9b45ef0401a0f32231bcb03ef92e6bc29d14c9b470242d9515b95881fc3111c19faae8945cb31e57319a539ac5fe0c416ae23832e8809ffcb2f3ebfa107c
SSDEEP 12288:+EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:+knQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1375523687614F98BFA2706F54C838146673B0EC17FA1A3CF77482129967D3D41AF6784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 9db1f48e7a4bec4e11d3d3ffe7071a1fcc0f02bbe24c2c8cf35bb4640cd6ec30
MD5 ecab274d7b3e43f535c26e9f13b3547f
SHA1 5a1baa7b5fb698fc997cea9d565c28202831e5f0
SHA512 5dcdb9d084e3dce24cd1a58c21e95f32fedee99af7dbaa749885843ecb260de33f3056bd4fbb9100afd40f3f99d4265776e245be3e00d8a9b2c6316931fff507
SSDEEP 12288:3Ob4A4LWOsvAYFTrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:YwL3UTbnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1BD75F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 f8812dde7c31b2d42b84244c3012f268e88b565c1f747d3bfedc269c938bfc29
MD5 66643b34305cdfd40b989b5fb8029ca0
SHA1 2f62197d0920289b9b77988eee1604830a42fa35
SHA512 8d3de382b8614899297bf66a2a3a6b94fa990cda2896ca2763271cef83b348b312cc20dddbda9b8bc1a2e22608007ee2ad7ee9e1cb4a489bf3bb58138229b840
SSDEEP 12288:CpFtCOvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:vOPnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1E455022D36EC60E6E536527C89838209D37278921B6253DF0780817E5F7BBF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1d890c4e6c9a49c66bef5322ab60992f08d99b2b32ebf32b1d4829ccb7e53b1c
MD5 3950a463e7b44aade400263aa0c9fa6b
SHA1 6ed9612dce5af6acae6edca30bf178b3498bda29
SHA512 b5d107487c02775c29580ec14f306f482feb5d4a042e16e5981d66020cec64d3628c6901cd02dbd7c0bbf30729a46dd2b7afe4b67524a759decc4b6dd762a441
SSDEEP 24576:x7NM9YqZqmWMUkPjZM48Mv6bEhsQnQ/tbw/2Mkjy6Fr7g0o9:x7cBWMpPjN8DbEh9Q/lFTjN4
TLSH
T183659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2d5ebe3e6122757148aec2ae1711bcede375e2d38014c231fbf4bda2eea5084c
MD5 4c0472fdca31f7b24a3426b7db0cea10
SHA1 64beb4df93651111e132c075048b8161a7b9721b
SHA512 1a0d4bd025ca28ddcd8382875d2b72a32db2990d5390370909b31ba3d3b5b5881aedd4af3775205414917b05e85d35afd97a0f027a982e9fbcf0fe2ae3108f49
SSDEEP 24576:2W6BApg2YuyuNDYTabvcdvNYf8km1anQ/tbw/2Mkjy6Fr7g0oe:2F2YuHNETovAvNYf8kmwQ/lFTjN4
TLSH
T1D8857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ba42d22f99c738694b65e827378763db2d88e6ff4108ba086a148945ebb7590d
MD5 59623e222d5767b7fce3fca62124a814
SHA1 d55d9ac335c182b1616b7a95f694be28db5f7fe3
SHA512 4b72381a142d9ab0b25436323d30d8c42ac40564fe51ebdac0f7e2d2ef3f3c8f7d47f9654d64b37351c8dbf0403948b74bc57fe85d022939074182f039d1bcd5
SSDEEP 24576:8AFs06+Omlf3NXEbToTnQ/tbw/2Mkjy6Fr7g0o2:RFs060lVXuOQ/lFTjN4
TLSH
T1A465AF2F66AC00D5D07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 8e80c44bb47d01e1ad61c7da9b31e29974393ce21db16c60c9022bb67c03fd9b
MD5 f16fb26276b8cae2dbfec095fc53af4f
SHA1 2444f112276c424fb28027a0c09073a52b4b60d3
SHA512 e605b065bd70981984f368f7aa1937e532f8b083bd2099c08503ecf30e6190015cdcf9c6fe7d088fcf8e33c015a1ae80fb653de3805ed10da2a2ac2714ddc309
SSDEEP 12288:lCJnJ5D3VkrqzxQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:cJnJ5D3WaOnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T13C75D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 69fbb933466acdff0e7395e5303932776a177f7b2e3a540cffd855d3717f6b0e
MD5 4f462b16345f4574090e72b02cf52d72
SHA1 931554848f0cf256bd583ca94b6f4ed108c04397
SHA512 477c8b2ccae467b8cadca3297795f4155b2fce5ffe1aea2224b621d6570f54c017cce9318d9ba636f5e438c859393edfec46cce6e31b28c379a77b3139267d79
SSDEEP 24576:lEPghm6/7IIXdwcXrif7qQncjlP65i3VuFnQ/tbw/2Mkjy6Fr7g0oc:yg06DIKdwc+eQnSt65aVcQ/lFTjN4
TLSH
T1B8955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 4cf91104d51d2bd7cba676c2fe13f570e844071d79e7b4c93f0a324ffd6dd48f
MD5 a19bcf75de29d604de42af204878e5f3
SHA1 e7cd1eaae965f0349fa7f087898e9d4c0397ab11
SHA512 b8fe9cdba566cc356ffb435e5325ccee27fce955fe3b1fffd1cadf9c58cbf05a190b1749f23d6add909aa2e6afd6a9670a85a5dd515bb77cc7da13145a9ef2eb
SSDEEP 12288:rEP3RSWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:wS2nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1F855126D37ACB0DAE52A517D88918145D373F4A12B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 f4eb57f483212cadf31028c4641b76c1b59ecadd72bf527f1f5612bc3268f0ba
MD5 67de866c938f293dca8146f6b83ead07
SHA1 fa7504016dd80bbfbdd29bba73e56742c6df3ace
SHA512 a58531f30e1bf64d6f9bca49c7e89db2dd1659760600a98729891dd5f64735ab1d8e6d60233d8d613818ca2149ae6c80c3b3859e08dfd4afac33226e3ea0356d
SSDEEP 12288:yjkytGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:yIyNnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1A96512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 8a7e1d3c722b40c9226a5698effe042c2defb1d8d537420df83ae81779209b23
MD5 54a965a3d21474758073a51bcfb1d18f
SHA1 7638dfbc3f8740fda9c4fc7b5266551f16487c76
SHA512 c7539d34e88937092e949e99509191f4e4c445dfebe81fda2ecb23952eab0a31268750628ee908b602006eba7ef2bdfc7ba73a2aa1e392a362f5653d9f362a3e
SSDEEP 12288:h0fGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:O/nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T11455236C2664F89BFE2706F448928542973B09C17F9167EF3684A239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d577c2a2f9f4fb46f01905e053b0684debf4cf4df97ffb7c0692e7cb0f113eac
MD5 b43c95dae7301855ee5933d7b36e412f
SHA1 cc22f86f9ec1438444c61faff622ad409c9885c8
SHA512 853ae33459903d32f2e87b4074759da366dfe9e1dfee8ed7aeb8499b5ad141d34fdb98d9ca6d64ef50693350f9fd4070833f075e64fc854288238850f032cec5
SSDEEP 24576:5Q9MxZKdcz9dw3InQ/tbw/2Mkjy6Fr7g0oR:5VKZIQ/lFTjN4
TLSH
T19A558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 33a26cbeb78320603fceb5dbf3b1ac02758cd3a96b36b73004946d0aff2e5f82
MD5 19240045f709e8a1863ca50a38f9a68d
SHA1 ca3968c30c694a96eb0c45c37482564816aa21a1
SHA512 698ca3af2bcb32e994e7dcfdf713bfc2d4978d0d554b62da1a9d3103326c0dfe251aec9e1f66b363a8bbc2484363567e88b0f0087f60ed5d61c1a62a454e7fd4
SSDEEP 12288:AyoKo20Rple9pRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:AyocSAphnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T10A65E01FBB6990A2E136813C89818745E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ba1729956b335db64889594bb1a68b80ccd2b2c01ed2f832d27c51113ab62695
MD5 835074efb14f6a1a10a13656f31e9d0d
SHA1 9ac6cdcdd7b7f82ce44a6402abf948b467a4a53a
SHA512 f5b962a1dcb14c4f155d04c72b3950aa98ea05f7c7e937107c17849720bea9ceae614e4e6ec09894c748d4efd22a30c508dfd5ab5fecafe9efdf7c0245e8ff62
SSDEEP 49152:1WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKhQ/lFTjN4:l0zuNIQLm
TLSH
T11BA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4a173422b63e05bb7e9f66d8aefde50a63ddbfa8372ede838706b0cf3ccd71a9
MD5 57ed07aca34b8600f7d49f2090a45c31
SHA1 c8f41098906a85f2ed69bf2f2a5756c292341e3b
SHA512 564a5fa903b45c9a8eeef432217d3abfdaf74293c2ee4e2cd4e3d7904c548b721cee143850dac2d116bfb1ccaa84c2f7a1b1531e455d8a92b023774ec423bf3b
SSDEEP 24576:O1QT7EcpfxR+N5AWAz3ooiYtjMqb2nQ/tbw/2Mkjy6Fr7g0oW:DTDxR+N5YzTfjMTQ/lFTjN4
TLSH
T15D55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/860-236-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/860-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/956-42-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/956-238-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/956-205-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/956-48-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/992-327-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/992-436-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1112-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1112-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1112-207-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1776-415-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1776-344-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1776-281-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2528-278-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2528-331-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2548-285-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2548-409-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2792-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2792-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2792-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2792-74-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3024-429-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-434-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-420-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-419-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-441-0x000001CAFCE60000-0x000001CAFCF67000-memory.dmp

Download

memory/3024-425-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-422-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-424-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-431-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-430-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-432-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-423-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-433-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-428-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-427-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-426-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3024-421-0x000001CAFCB00000-0x000001CAFCB10000-memory.dmp

Download

memory/3036-318-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3036-249-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3168-311-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3168-417-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3284-412-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3284-296-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3284-288-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3284-294-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3528-437-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3528-332-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3828-326-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3828-275-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3828-268-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/3828-273-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/3936-76-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3936-82-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3936-206-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4340-262-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4340-260-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4340-254-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4340-322-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4380-306-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4380-308-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4380-300-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4380-416-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4400-316-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4400-314-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4632-319-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4632-418-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4656-375-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4656-345-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4656-413-0x000000000CDB0000-0x000000000CDB8000-memory.dmp

Download

memory/4656-391-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4656-407-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4656-438-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4728-18-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4728-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4728-237-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4728-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4752-245-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4752-250-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4880-0-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/4880-9-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/4880-8-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/4880-39-0x0000000140000000-0x0000000140408000-memory.dmp

Download

memory/4880-38-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/4952-323-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4952-435-0x0000000140000000-0x00000001401FC000-memory.dmp

Download