793a70c3dec5bba042b551f1dde7f61239e21d4ee122eb189fcb785f0b493863

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample260819-qlrayavela
SHA256 793a70c3dec5bba042b551f1dde7f61239e21d4ee122eb189fcb785f0b493863
MD5 69dd4f211209aca90c93f00f3eee6c90
SHA1 d508017425fbc4d014bc397eaecc31c0b938d983
SHA512 293e2e68bb98c8dfee7abbef18af752d0ca5ea3c81b13abc40962697e477caa77273d49834287122b750c8a08b4737a354a44067b9b3d465005f5bfab6e70301
SSDEEP 49152:S7EE3hXd5NHfrPqx0AAzXfuyaU0CBedbQ/dBZchqmb2BqZTd/drwwQFB4Hd6axz+:bjB89/dBa5drK49tzTzm
TLSH
T135167C07E6B941F4C0BBD1398A579657FAB2785A877197CB43A0875A0F237E09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4364	alg.exe
2352	DiagnosticsHub.StandardCollector.Service.exe
2480	elevation_service.exe
4548	elevation_service.exe
4052	maintenanceservice.exe
4732	OSE.EXE
2448	msdtc.exe
4380	PerceptionSimulationService.exe
4760	perfhost.exe
1048	locator.exe
1452	SensorDataService.exe
4472	snmptrap.exe
3236	spectrum.exe
4156	ssh-agent.exe
2976	TieringEngineService.exe
4372	AgentService.exe
3956	vds.exe
4696	vssvc.exe
620	wbengine.exe
4596	WmiApSrv.exe
1248	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\488a479e2d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\FileSyncHelper-2026-08-19.1321.1664.2.aodl	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e021adfdd2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cddf3dedd2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbfab4dfdd2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e804fbdedd2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053651cdfdd2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a12921dfdd2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b475bdedd2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000557f3ae0dd2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007cd145dedd2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2352	DiagnosticsHub.StandardCollector.Service.exe
2352	DiagnosticsHub.StandardCollector.Service.exe
2352	DiagnosticsHub.StandardCollector.Service.exe
2352	DiagnosticsHub.StandardCollector.Service.exe
2352	DiagnosticsHub.StandardCollector.Service.exe
2352	DiagnosticsHub.StandardCollector.Service.exe
2480	elevation_service.exe
2480	elevation_service.exe
2480	elevation_service.exe
2480	elevation_service.exe
2480	elevation_service.exe
2480	elevation_service.exe
2480	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1664	2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	2352	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2480	elevation_service.exe
Token: SeRestorePrivilege	2976	TieringEngineService.exe
Token: SeManageVolumePrivilege	2976	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4372	AgentService.exe
Token: SeBackupPrivilege	4696	vssvc.exe
Token: SeRestorePrivilege	4696	vssvc.exe
Token: SeAuditPrivilege	4696	vssvc.exe
Token: SeBackupPrivilege	620	wbengine.exe
Token: SeRestorePrivilege	620	wbengine.exe
Token: SeSecurityPrivilege	620	wbengine.exe
Token: 33	1248	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1248	SearchIndexer.exe
Token: SeDebugPrivilege	2480	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1584	1248	SearchIndexer.exe	118
PID 1248 wrote to memory of 552	1248	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_69dd4f211209aca90c93f00f3eee6c90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4364

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4548

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4052

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4732

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2448

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4380

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4760

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1048

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1452

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4472

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3236

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1884

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3956

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:620

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4596

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1584
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4b3500f36063ee8a85edc518b1e26ebee23ca744a7ac0f6417eef355844b67d7
MD5 aedb97587ee344b562b526e4291193f8
SHA1 dd6c52865f60b62114ea3e850d8d02710ceff610
SHA512 6917c084e8221d47d05d1805dc46555078c0881a1a4f459817314ac0e96d6344abfc2208d5770742ee3266092cd32e8e22c240c0e99c2a9a9f5d2d8fe40451d0
SSDEEP 49152:Rb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnYwQFB4Hd6axzkszpw:X3q6sjB149tzTzm
TLSH
T1EED58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f98f270be764de26f915b86006355a7374a23ce30ec2002e8d8807fc8e4b81ac
MD5 b7b14b3f7f8be4de6313e48dfc5e086d
SHA1 d9b87e3aa3890a82a0b1a64a0da9262f6ec0148e
SHA512 709a4fccefdd728cf6eee919d5ad633a73beed94a0a9b83a5627104f6ddeeecb94f28ab9d1ad49353002a56f79f0570070d858cb7a4429a44af81ccdcd5069fd
SSDEEP 24576:sXYfDtczAASwQFB4Hd6LausvUWx9BkszlXWy2v:LtcCwQFB4Hd6axzkszpw
TLSH
T17565022977E408FDED67923DC8A28515E973B85247A0E78B03F499251F332E85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 878db3c78ca9621eae3f479b485f8c548c23c372fc93b1f22440a094f9f2414c
MD5 a0e8688f12ed1923da50b585b62301eb
SHA1 66cf3c23e8996e05ae807d4f4937d390c78e7da4
SHA512 2e81f57819c6357b96d0b87e9e1c1f0fd67cda383bbded61b296816f61f609f2d7103fdb29d58149eb169b2ab868dbbdbe0884b9b1de43f36e445b5acab3f965
SSDEEP 24576:n0Le5ji0hmxxrMtSwQFB4Hd6LausvUWx9BkszlXWy2v:nPji0AjNwQFB4Hd6axzkszpw
TLSH
T19885AE16F5788375D073C0B9C5D2A69EED7230824B308ACB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bbf42491d55e1c5eb76951cd32b7880a5f29717d198b0a3b6911975890113df3
MD5 1c6a5b4e69974bccb07ac1640c7fe51b
SHA1 42aeef7a0ca75d9fd252018926ce03614262c641
SHA512 d2bb2a20e4c4d97354ac8250a279833cf09487544b1d1c1c12b0033346a5250c317342f372bf03eb5d613a6525c81779f4c4eaedf1e369bc2dc07183c1f47729
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWn6q8wyuHSwQFB4Hd6LausvUWx9BkszlXWy2v:l/ezSC6vUzPveHjyRwQFB4Hd6axzkszm
TLSH
T104755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4a0f06f02254251f862f6d15d99b6cbebb5b5793e66f9e54afe5d465ac01b22a
MD5 4509eb688ab318dc228f294357996651
SHA1 7cf9597a79c8305303b265cf9484fec417e028e5
SHA512 93223f1c7513ee51c5ad62baa71db02d5a6cac67ba098c4541e82c2af0c8900ea5d81721fbd4c7e59e40e523ddca02da2eedbbacc56ebe4cf5a151b23d1e4886
SSDEEP 24576:HVbqPb88hv/l+YsSwQFB4Hd6LausvUWx9BkszlXWy2v:HVO88hXl+6wQFB4Hd6axzkszpw
TLSH
T1EE559E66F5748331D073C0BAC4D3AA9EEE7234424B318ACB1246D76C2E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 c2a010ef408f7392c7c5f4e91962ca6bd3fcaa3d42a4331a09096ba2c10b60a0
MD5 3b79b568d2e71329d42eb99daaf6daae
SHA1 95312610e31b6ce8ea2d6a672b73e58c2a2d6382
SHA512 06d88ca1d57967e534964d6127e6557ffbbe8221054143addf6c8971aecca8c742fbe1f606f0e76998631c087fd317124c975037e6f36c4fddfc6f74f1e89002
SSDEEP 12288:0LSTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:0L5SwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1114523C2A57DB1EAEBD33333909764FCCC8EBC238F94C60692B63A0995744B9D145987
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 82330ade178b1b8991875ec76cbed18ce01e93601cc7281a1bb95465e089130e
MD5 8a6ea69289f5555b4ed29e4681b53004
SHA1 7ddc18a03a00de125c1876b214e70d1949d4f4a2
SHA512 e8863085f100444ba74483b43612c66a0729adf24788be57b28142d0dd69fb7ba92dab4dd3ead66b2c3b79afba013304c569a4d80d67136a2436bc0ced157dcb
SSDEEP 24576:GJIU0SwQFB4Hd6LausvUWx9BkszlXWy2v:GJIUjwQFB4Hd6axzkszpw
TLSH
T11F65DF3BEE38FCE2C27A5D7956918240D7A278314F6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 948e8caaade11a369f89240265a829795d0f2313b44eaa3954183f49a7227855
MD5 18daa043ced37a5c75bbdaf660e9cc98
SHA1 98613fda5fcaddf324ba7c9b1a7861b350d85dc0
SHA512 1844fdcd598a0388cbc518b04b6774fab65531e66affac5e18d3e0d45c43c1d34e8dd5a37be809c50c73b3ee7db3c84f173442a88fc33b5105cdef403ad75e6a
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THt:wQvGAdlCEL8c/DRNw5CA49tzTzm
TLSH
T1FB266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 97cd6df875b191d58e70cdd8237b61775e196a6f06216e683f98f72bc060c91a
MD5 50a6c8c1055166c7c2b9d57573a43f29
SHA1 d6180e01c2bafdfe466715427e5b866152d13ac4
SHA512 9d0f3cb57a72b37a56bec055fd87c5db9cac0995a3dc5f72098dac7cce9ab59e4023f976820f255bc3fded01d708d0f05c8caea76ad055bf5569c7cd7ad9d54d
SSDEEP 24576:10ewsAjOSwQFB4Hd6LausvUWx9BkszlXWy2v:Olj9wQFB4Hd6axzkszpw
TLSH
T10165E031FA78E036C7BB0DB21B26C71A586DB9204F911AC3E3E85E9D59301D26376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fa7ca155dfa7db14bdd764fba8654d4e0e2a68f91d4877d05e53827b1600ffd1
MD5 75f0d8b6e68925b319f0671d2e1c2ccf
SHA1 8654b81e4ca0d87d1a6368a954db635d2e029084
SHA512 8e5e5b96fd576c407cbd12633a964b9e1c16705cd8e5f3a14dd80de909345185cc70284476e27ab89673124ecf95f2927b620ef60d4a8bba5e5513faa4702cab
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHr09P:vUEtQevvqc2W1cpV2tI32r09P
TLSH
T1CC474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9b22141c5538e3c815060b37ca0d2c39a6d836ca4ba892186048c523b05475fb
MD5 7ae82598f9a1c054f4c60aa2d57b1ff7
SHA1 d991269807b9c8207212adbf7878b19b2e162456
SHA512 a3415f5b3840d2ea6b002c363625a522366a6015c92d5cd758c02496dc934dbe049dc68ebbdb5abf77b3c0a84b592b9fd68065900330bac94fc2aa3ca1b7f49b
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/zdwQFB4Hd6axzkszpw:VoqtVjnmk49tzTzm
TLSH
T1A2D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 baaf9b44372f6fecdf1794211ee198cf232ba87e91d91af35db69d7da319b861
MD5 f9b5a0e7121d62ee1fed50d5d09ca52c
SHA1 158f62cb376eed2e754525e807a8582a6dcd4906
SHA512 561f911a6c1f1cefc5d0c4b7dfb00f8e676b81f8e853c39a524d4c047cfd1a1d2dbfa86a10e79a4e543f8f49087823c5075ea139a8fe8a21409d2e26e0777d9b
SSDEEP 24576:bAhGL3IFoiwtA5l7S53LSwQFB4Hd6LausvUWx9BkszlXWy2v:bAMUFoiq5GwQFB4Hd6axzkszpw
TLSH
T18F359D81EBF955D4F5F3AA7899B69170E976BCA65E31C20F2160D20F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 15f17964730987410c8262aa6e380601ea8883c5c1b9ffc9143d2265abb8a774
MD5 c0c2c233be282518ec66945c5f07dd8b
SHA1 1b13c3cd1277e81fcd3cdffa50c31ba8d53c584b
SHA512 c4f0e3ff3491776e4a79225cd56f2b833b089fef68e7379114b2b61b66269ebfc68e0c9b21709267828f0877ee97115df1b2d2afdf1590023ebca55763b33ae5
SSDEEP 24576:kwu4OWySwQFB4Hd6LausvUWx9BkszlXWy2v:kwvOKwQFB4Hd6axzkszpw
TLSH
T16165F14676A91CF9E9A75239C557C13AFBF2BC122A21C70F1360C65B5F33261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 768a732010b381de7c655d88933511e4cc00db5cfd82fb646bcccd59cded1466
MD5 0fc2b91ff25580361b62a1a45bd7f318
SHA1 b35f9e3e4f53ecd976356207d5fa8ce40e30c807
SHA512 a727c958a40026b4d68ccf1f11aa0e3efdf5c3f324dde2dc3c0a4e3ded142b6601ac615e619c2112d945a0f9ae31f3c19f651a8940ed91c868b1f0ea3af69694
SSDEEP 24576:PZuVSwQFB4Hd6LausvUWx9BkszlXWy2v:FwQFB4Hd6axzkszpw
TLSH
T1D145128A32BC70FAE2D3223AC4E2559CDBB67823477183CF127502595F329E55D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2c6a81afbbc1e25f6879e2a5dfbb9e7c703e38eef1b859f6f67328b62aba14b9
MD5 be6c31f6b119d881b8e8e60a432d02f1
SHA1 1a552d208b994df1d97e9101dd07c0ba650ac5c0
SHA512 3600cf9659d34e83ff063bfbe3ebf5cf058fa039ab3043492142ea1b5a4185d9ff4130301d1e8be0ef862cfc6c69388cc085d8f88530d9c584ba757a8284cf96
SSDEEP 98304:5QRQyi36YOcPbLvw2gAf+PN3h49tzTzm:wQyiKa/X+PNx09P
TLSH
T19C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9826f80bbba35f128b31527d4b7bafd61e0f75b7bb0d0fe960cd6a9a54f9a8a6
MD5 655f64f9b906a626f1be00e91ad7932e
SHA1 da0e20f2e38a769818777470cfd5ccfa19864774
SHA512 e8643fce82039352da690da5bb9a62fd45c81cdcc7e1a7c8e331445c8eb76ed9cc6d38155b81cecc0fa2aa24d28cc3ce6bb8ce0e7ec331346b06316f3442616d
SSDEEP 98304:kQRQyi36YOcPbLvw2gAf+PN3h49tzTzm:rQyiKa/X+PNx09P
TLSH
T173667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 895512f8c4ce6712dd9a1e258396aa1671a0c51c7151120a45e986fd59059b4d
MD5 94ff821924fe7a2046d118fc635e4897
SHA1 2c01f51a1d8128d2de8780cf33f68b7c20019f31
SHA512 56f8b130d1d4086d318ea12cc2865b82f216dc7d6ff57b96fe0ac017c52a819ec0f8ee21e148113cf380003fb8497a0a22fc57680039f887cf642ca8c4b7c2bb
SSDEEP 49152:q68Qg55nhceWu7PNU3/NwQFB4Hd6axzkszpw:YthLRc/D49tzTzm
TLSH
T140B55A33B2F600A9C44DE1769F4A973196D27C758FE0E3DB815172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8a8a8f492eb448c9c6f4fccab57ab0c955f0a177eb47ff1d289c2a1ea6026e43
MD5 57fcfa8f00d275a271e335974f768a7c
SHA1 9a17885c4dfef9eb56a5ecc2a5d8cb9b8b6cde91
SHA512 54c830478bea9510286dc80f46d73f6c5a4d085ac2f561dd3042370ab2f7c9fb78901c76e935f91b4bd18ed0576b664b16f1bdcd07abf21a152d4ab632eba1d5
SSDEEP 98304:py5112gYy5azzVvt69nLKnhZ249tzTzm:ELIHEWh809P
TLSH
T164168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 33bc1280e2b76286226e133f79dea29a69e3b2b38726c836f641da31b5f23ad9
MD5 d7471ae96c9fea879da94068e630ca3a
SHA1 ec4d8a998a458dc1f57493cbba7746800284c127
SHA512 45aa684c523b01b3fa81a7fdb02f378cb5628dd1f687d2183d465eabe342a0e02b0e317543eb4dac1f4683cb9b2f4c6dc9cb8774a8eece778475aff42b1a203a
SSDEEP 49152:2B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glvwQFB4Hd6axzkszpw:Eu6Jmdxd2dJ49tzTzm
TLSH
T1CBD59D13F1DA01E8D06ED179974A9233E962BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9fcda7af850aee1eedc143357409e9079b0f020e720ce7422619710819a44301
MD5 440918806f0801f97aa1c0050941168b
SHA1 82d39803eeb502d2b451bc6914b653f273146357
SHA512 d1fb2fd956fa2de4ff805ba87f6767aae94feb15e49801d9ad589f093febcfc5fa2e46aae4e8226f4d8cf8c08ba333142b8384fef30bdf19663d3a8fbe9fe4c0
SSDEEP 49152:S1hpsNoJpF1A63U44CwH7R4xDwQFB4Hd6axzkszpw:SmifPWRk49tzTzm
TLSH
T11CB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f14181c984b5f2921da07444ec79e3ed281407250731e40e0b0f42556a0156ca
MD5 24623fca8aded83e85add4c695463065
SHA1 d0a2e339627a63175431cd144339b9bbbbb538bd
SHA512 c9672346ea440d3e8c738c4f00a8da9737481d12953f21c50f83a2c46c9870a7020462d501f2ccb6a0187c5c6d6d5a6da3f7ee612f6647235305f22b807ea048
SSDEEP 49152:YSuZQIY0Be2KcRVtOnks6NMHqIwQFB4Hd6axzkszpw:C5dKii61S49tzTzm
TLSH
T1A3C5BF03F2E940E8E0BEE67487669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 05a2180a4285bebd66df690ead1f819ef5d769cb40df88386855cd7ba749a148
MD5 88e0264985f714937c449dc06445b67d
SHA1 a4aed2348318aa06409a38da29c479468f244260
SHA512 ce15710f269f78d57e897fc68e7679df7604ddfc72ac73b19f4a4cfdb04ccf4bc084212356c1622a259be1fac5fdb9c369f47207baade96a1f712f2207e0fdf9
SSDEEP 49152:+htSn8EApI0fig3giDn0AP5wfwQFB4Hd6axzkszpw:fX2imph449tzTzm
TLSH
T1D095BE13F2D900E8D05ED179C7468632E962BC160B38AADF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 3cf9f7530fe312682a9160898ee223b357074911993a5a0b23fa9290298caf13
MD5 144f0cb048ab62ea2a934e45ac1e124a
SHA1 3b8a9326c92e2b5d2422c17b790d1ef9179a1377
SHA512 74db788df429879f5888565bf14a6d2e35a769f8fb2a59ddb487309516393a936e58e5a4a026b5585f0d9d312244806acc3889bfbb3d15303f193c1183f88f2e
SSDEEP 12288:pKTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:pBSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1F84523C6B97EB1EEE6833333C05754FCCC8EBC278B95C20BA3AB260595744B95145D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 a910c4c38f814695dc17fb83dae21709295f72ade9324f60a94ddf5cc7454883
MD5 9beb4b0d141b8c061dde3b1d961be79b
SHA1 566bdd027b311c9678bcd3f88af6a3be9d84ddc8
SHA512 c2ea102f757de88352d0aa046e61603f476d114765d563dff35274e4bf856178b92e254bc2cc4e4196a9d711acd40a47d70cbbcd97074b7e63beab06b785133c
SSDEEP 12288:rlTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:rKSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1D14523C6B87E61DEE6833333C05754FCCC8EBC278F95C20BA3AA260595744B99545D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 2d546e20686af54f4881d18f045c639aa323fcf9184705f0bde5bd3b8270548e
MD5 5e27d52290b3bd7d3d5981e45ed34f6d
SHA1 93a30f1c56ee2b58e3177f5e472c5c1f85706050
SHA512 dd1bedd757a08b306a62e0e04e41a529dffb225849cf907ca1c69f388ae3ea1830b77380286e24569cc85877cce166da29e63d6353fc8c26c5ad228f101984a3
SSDEEP 12288:XzTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:XcSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1FE4523C6B87EB1DEE6833333C05754FCCC8EBC278B95C20BA3AB250595704B99149D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4c4bf0d80d7f680cfc7658f87eeb90cbf78c15b951f871423d3bf551e7534392
MD5 444fb6dd7399f46b4b05fa6768ecbfa6
SHA1 70508ce98aca05dabbb21d4a252a8a9dedb2ed93
SHA512 8169c52b913a2ef40620b4f8ba6c98dfdd72651c269d2a40043a9dd4245dc1e934956084bae9bb2e05a6630aec1017e8160a2b0204c5e279f8b2b0efdc89af83
SSDEEP 12288:DVQTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:NSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T148452382767E61DAE593B333C06350FCDCAEBC678B61C34F936216094A705F8A525F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 8c76b4587d533e6fd3d418dafbe6f6f38124110b95b4d5941c8aa04b8c6965d1
MD5 c0c1f96240fb601b1884e43765b12895
SHA1 743d424efffc0c75004fdd9ca64b5a1c7ffb4cb8
SHA512 fe137dcde398effcec1877c659baf76ba7ceed7284c90e550b32c38c6e95abcff5a481221c304023420656454be14c17f70a1a86e8f702d0b60925043ab3c966
SSDEEP 12288:34TUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:3DSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T12B4523C6B87EB1DEE6833333C05754FCCC8EBC278B95C20BA3AB260595744B95549D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 9c3b46e6b9229cd6ecb2207870983272dec886f66be9f413e2952097b9eab800
MD5 1816543ab82c4284b56612d5a0edf799
SHA1 9185351c52e6c792954587c1b140b657c74dbef3
SHA512 824751b42904464251eb6911779fcf86a950887144e5bbae8a8c38bbfc8e50075fb8a455368c356e14d288b0c2001d2389f131a6b44816614d428c39683e3a1a
SSDEEP 12288:3pTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:3WSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1B94523C6B97EA1DEE6833333C05754FCCC8EBC278F95C20BA3AB260595704B95549D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 2fad2463c5345147cf8ab3209281f01d27f32e5b6da356ddd26a7e9fe7ff748f
MD5 9cc0cbebac85149b980f12f1079a3668
SHA1 5d0949bb9c27b0897257791356d59d4b947a6e17
SHA512 899074c65246fc9cb9ce05a01727ac6795f15a37ea622a5e5d917430863d726b1333bcfac37749967b45b6d19b22483f888d8bef4b8b8c19e881c3d196fcac2a
SSDEEP 12288:+NTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:+iSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1464523C6B87EA1DEE6833333C05754FCCC8EBC278F95C20BA3AB2605A5744B99545D86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8671fbaac59f6dab90f7c930ccc6ca4fa8ef3c957c21eacd6c9539c4a065366a
MD5 11600478087bfca9caae7d35203a76ff
SHA1 8141bff0584e81768f1e120cb9fe5f5c85e8857d
SHA512 99782c653e1ba84ec5cbcc902c56af77629a40bd5e9b2279843b22aa088c42f14ae21aa791f3d9588fddd40d228ae5f490465849b2dfd4c303f0174dc42d61ce
SSDEEP 24576:tZMRzFVSOqSwQFB4Hd6LausvUWx9BkszlXWy2v:tZMRzfFwQFB4Hd6axzkszpw
TLSH
T1E0650295B3A418F9EDA3423EC8568959D5B27C1A0B70C60F13F436265F333A11D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 ab702e0ffac4c34f1c2542722139f1f8d67a9c46c5101b6a36c1eb522a704adb
MD5 7f716b24171d33c6765f98a34f24d0f2
SHA1 9ac4dd24e3efbcd4927bc8b7f00f69948ed094a9
SHA512 a798ab521c916715009f90288d370a13243702cecc9ac48dbf842cc1fe0ff3749440f4956206aa7501a0a9c86dc6f9b72e5d62d6d80280dbed3a1453b8016745
SSDEEP 12288:+2TUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:+lSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1984523C6B47EB1DEE6833333C05755FCCC8EBC278B91C20BA3AB260595744B99549D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 5e011e4dec061405a7deb60df2b4be3e1f0770b5f0c0e13747681bba7cbe26b0
MD5 2e5fe45e9a0c4a6f468a6fb38025fede
SHA1 dfbaa0bed5eb24650e742edf247ebfbf41221277
SHA512 e10f93b17ad04853f86b4f65aefa1abcd2f5680735e8fce515581fe7546b44b639c0d88f8c81344a80db3399e8ca34cd50c0228f70c765272777195a37e7bb7b
SSDEEP 12288:viTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:vJSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1774523C6B87EA1DEE6833333C05754FCCC8EBC278B95C307A3AB2605A5744B95549D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f08a6d61d2fccef3e63fad7fd81a6f06726154cb6090e98fa23193435e438e6e
MD5 ac8873ae7dd13739e7463a4dbfca973b
SHA1 b41b12e3d499296367d1b3ead4817f74049c3fea
SHA512 f7e75899c8984ae734bd6611cc76c22904cd3961bed4d47ff687f5f3fbcd9ad9ba713cd6d16002f629382333ad7cf7ea9591bfd8ad3d322464f74bd4d60607dc
SSDEEP 24576:JzyeSwQFB4Hd6LausvUWx9BkszlXWy2v:JqwQFB4Hd6axzkszpw
TLSH
T15A55024772B930F9D1675235C4A21959FBB6B8334B608B8F53A407362F335E09E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 412a9f7868428a24e7f252da66af4f1e291bda08f7bc2f558b00ce24655fc794
MD5 e114126a2cd218eb66dde39bc95037c5
SHA1 83e9409d62cb823674aef9cfb62dcc4bf17fd1d5
SHA512 ab62826840aa9b0221f649599cf05c1a6b34029b3190ae3c289be2e7ab248513d3c0dd458573b7047cd96144e185bf336f3711bfe4bd77902de5567ff74f7b4c
SSDEEP 12288:R2TUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:RlSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T10C4523C6B47EB1DEE6833333C05754FCCC8EBC278B95C20BA3AB260595744B99549D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 d884bd2383f269deb3e72659853f1bae3ec72a4920a05f81ee23f2a9698fb070
MD5 3e06e42dd986d770e7ef735052e58cad
SHA1 89871371c5d803f4cb72165403b1d70399bd1c27
SHA512 b38048ab7e371143ee753616b3d5fbb2a9c4a229b7e5833505fc584389958bb7d7f48b119156c30f1f8b9d377d1752b18f13302d340e38d0af37e185c0db87db
SSDEEP 12288:T2TUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:TlSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1BB4523C6B47EB1DEE6833333C05754FCCC8EBC278B95C20BA3AB260595744B99149D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f30a55a8bb490c0b8979693f27238a111bced1e83873fd24ab698bba92833714
MD5 07c5718db19b44392169cb1699c5bc31
SHA1 ea88d9aab26df1b0388efc7309a68390005058c0
SHA512 a6eecbf228ac2c9f23994053666260103d775383a76153b1e46af5e743abd222f9d8dba81746068e31abdd95fee076cafdd93d79a256be818674edc5123679ab
SSDEEP 24576:TzyeSwQFB4Hd6LausvUWx9BkszlXWy2v:TqwQFB4Hd6axzkszpw
TLSH
T14955024772B930F9D1675235C4A21959FBB6B8334B608B8F53A407362F335E09E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d28ec59afe74b0f386eb0f294b31dd5719fb8730703c149df4a51890b9d3acd5
MD5 9e9faa16699f0887deaeb01e99cbe99f
SHA1 d3f2ba134d44b7e0391206d078d446b66f3ef073
SHA512 ee65ce5c6eff72644d63b20436705aa565f64e82780cecba74a39b92a93e036fcc7fbd3e957da9b1fa840087add29a1ad9ae0278488cb419bed2f37acabcdf52
SSDEEP 24576:OTDaLl3z0zDMSwQFB4Hd6LausvUWx9BkszlXWy2v:OTuLljywQFB4Hd6axzkszpw
TLSH
T1B7650295B36418F8ED67423EC856895AD5B27C2B0B70C60F03F436165F332A15D2EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 d5d26518df0c2e7c3c543ee1d2698f79208dede0c22989a13c22d936eb2aa282
MD5 4a4a2c654cd1e6c64906ffab6b091446
SHA1 d72076721454560d1e009d17a612a5407dde82fa
SHA512 b0b825f865bd0fb686b466f7f2e2f8d7cb86153ee94e957efdd0f73099208429d332b41778e906aed13475875fb16f48109f193fbad3ec42745014c4cc582a10
SSDEEP 24576:63vd9CHKy7GZoSwQFB4Hd6LausvUWx9BkszlXWy2v:cvd9CHKyaFwQFB4Hd6axzkszpw
TLSH
T1B475D090F3E810E8F1B79A35C8765511D9B67C5A1B71CE8F03A4261A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 efea7903a0c585b99068943eb6633d13f97b59c653121ad1d063c3ac8b8ee91c
MD5 4dce7e2aed35aa2b0d9d0441bf4f3654
SHA1 d1bb0df1372a89971199828456d355d257a47d1a
SHA512 1135192ccdf2796bfd2f9ca45e42ca45126945e435e396e4dc4cd6a5159303732cd37e78dd3b5f30c69178dd7ab3e257592a255f581e5617da90b4ac78e95a12
SSDEEP 12288:GTTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:G8SwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1D94523C6B87EB1DEE6833333C05755FCCC8EBC278B95C20BA3AA260595744B99145D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 ecc966e8c1e27127ab9325d6239e3802994dce0599cf9cb4881e8df54f1f8c0b
MD5 f1c736cc3c630b43d2229c45e2ead8c7
SHA1 ca87a2f0ffda7127d5f8492ba2735b19dadcc701
SHA512 3d0f6cbddada3789cadd508224437fc0029daa7abe42ed80d4ab0ea6d750b7f7c18ffab376961e89d12008e17f0a10a9370049799cb2d359cefa9254c56040f4
SSDEEP 12288:ghTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:g+SwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T15D4523C6B97EB1EEE6833333C05755FCCC8EBC278B91C30BA3AB250595744B9914598A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 f6a21b55daa6d88601ab996681e272df9139839652e0f0749b74c41dccccf9ff
MD5 eee1475ae7eff98f7a8a1a18dacd811a
SHA1 e9552ab5c425d119531c08de2a20e42e91646e0c
SHA512 61c82ce20de35745c7d2504fcc2f8c96d073775a9611bf93269eb6f728350f0894d8a6818726ad70c3f7455efaa398a60b9acc0198fa2fd913707ab248913603
SSDEEP 12288:sMTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:s/SwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1804523C6B87EB1DEE6833333C05755FCCC8EBC278B95C20BA3AB260595744B95149D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 7b94fc2544caa5dfa1a82c9b387794e35e75688bcf36c429a296c3918d932213
MD5 aa76a1109fa6145dbbf1a749670d9fc7
SHA1 0f8a6204fc7333445cd75b03aefc8584c866590c
SHA512 99a30158b532e51bbeb1486dc6fbdc53906ef61d428f54ce2551c84062010fac743c2da06bca7998a4c6816a4fc4f0cc9d9d7bb61c9cfafc90eb3b32e991e8f7
SSDEEP 12288:mbsfmTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:NVSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T11055014AD2A812E8C0AE6236C3564694F6277C2687E1C3CB53D0F53E1F355E49DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 c9f326d7d5a2986fd65445fb74764d999e973d7c12e9c159940b8099ecba6a47
MD5 1bce4d6fc3bad4d7b84a1945f49d04e0
SHA1 1366ea0997f5495fde8dcb55fef6a561c06e59b5
SHA512 b463b840a9cc5ffd014c1af077f08f95b0af0583ec8049e340aa23b5cba21f1291538283cf261ce2f63f7dd8b5b1ba331a3f1bab311beda55a03adcf2075dd5d
SSDEEP 12288:0CTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:0pSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T198452382E67DB1DBF6E73332805790BC9C4FB8378F90C20BF266260995708F59955A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c8882f8023f10edd2becf2f65f3ce261ddbf5a2f12740aab9220e4fe9dcb733d
MD5 3631f01916c07e4b9fde925fb72873e9
SHA1 48c4ec7d6fb795e9ddd232d70828c99eadcaf71b
SHA512 444f0032af6f470cc4933e320fe8f71462c4b0ad40528cf735818962227460e5d0305b6f42eed7bf13b3dc82af9d236190e61a2f9c2e079d1ecb183a66384255
SSDEEP 49152:la0h2GEkuAe73q3pp46zwwQ+wQFB4Hd6axzkszpw:la0hNYG4JwH49tzTzm
TLSH
T11985AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 47e2213de0be726ce8761a5d2cfa42b497942f939c01ed747a475ece19ec0894
MD5 db072f7e8fccaf9fef7494119d1668ed
SHA1 5becada5c2be9a9b31030d5f852265527bb8b661
SHA512 d178ca451a45fc0a28bbca4e9d1f9ae44d935ad78db8b5e447e8bdf92fc0968bcd96fd6d9e1dcfbec982c4507cbfc7157b71822218001e36940eeeba9290e2ec
SSDEEP 24576:7hbHjPiSwQFB4Hd6LausvUWx9BkszlXWy2v:7hbHjJwQFB4Hd6axzkszpw
TLSH
T1E84502AE26BD20D9F5B2A23A8056855EC671BC260B1193CF63D2423D4F36DF85D35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.1MB
SHA256 5cd7079592e3f0ee78d74d18fc93e4d0686a648e117935df7d7a6f350ebb9212
MD5 9a050e77dd8e589599bb80f371613c3c
SHA1 abbe2aa713b1437f7be9e9c184acd07bc3f7deff
SHA512 a7692affd75644ed94a4040bf0f2ea72c89e5a748aa62438a0a86f31e517b94fb7b041db9b6e8355282bccc0d0c6e53c4f355e7a1f0298fd24469d848118a985
SSDEEP 12288:bGTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:b1SwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1824523C6B57EB1DEE6933333C05754FC8C4EB8234F91C387A2BA320992748F99565986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 914c97e3648d337972efec325cc9fc0a836969b1092a7a8e99ca3a54cba1cb24
MD5 12ce5548991e531fc7eaf9abf8f95ede
SHA1 0ebeeb00fef62df4d2440c04635bcc8f2a3cb9d4
SHA512 66825231a0c28cce2f01f89699eeff02e64b4a75b9b2ba90745d02401eb01fd706b6592da76707f815915173033fdeae7ff04c7b0b9f467429f545a1a7b62fe1
SSDEEP 24576:XbL3UTwSwQFB4Hd6LausvUWx9BkszlXWy2v:XbL3UbwQFB4Hd6axzkszpw
TLSH
T14B750145F7A800F9E967923DC4A3892AD5B2B85E0764E7CF03A84B551F236F14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 40535dad29dac45f19a65c73119dc1a7151ceeeb8f20c5c1503c4618455af111
MD5 45d83e3a5b61d87b1bf7611c27956a0f
SHA1 f393c96d463501eef35f4087e9ad2be1bae1faa7
SHA512 591bdd322c45efb55fea41e7cac49d8e72cd2f0f3d31a5c3feb32d9710708ed2b852147e1092d8411cfd0268f8da32ed2c808c97eee25f28174d7adf52b0d698
SSDEEP 12288:zpFtIOzTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:mOcSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1EC55025A36FD20E9E176723D8493825DD676B8630B2183CF42E0416E5F73EF86C3AA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3e3aed8b103c4b6c5a7f9c619bcf938c1d74d85aec1f32b225828410c2f27ab3
MD5 93058bf3525087f8dda1065cd5d67c23
SHA1 79d6870bf1280eb9de88ff481279797e49bd1b58
SHA512 aab0fd31576f4c7e9b0ab32435513de62d7987380af67396bea7c176889c535b4609956015c12b3ed051a49f519af22d63dc67c8164e2cdcbd2caece51be5982
SSDEEP 24576:37NM9YqZqmWMUkPjZM48Mv6bEhsZSwQFB4Hd6LausvUWx9BkszlXWy2v:37cBWMpPjN8DbEh9wQFB4Hd6axzkszpw
TLSH
T1B665AE2E6BAC81E5D477D13DC9A28245F5B2B4611B318ACF1162833E6F37AF44E35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 89965fbf6ee96b1380f2c527e70fb245fd7684687686687887be1f1fd935bee7
MD5 f27fa3414d54114db40eeba36ea082f5
SHA1 9edc479287f45a4aac46104ab9cb01b8981d7a99
SHA512 d83dd29965e95b4a85cfae5b1bba16c215cdf5b26b837cf7e532bc785d872f1f7fe3fe249bfa682ae6748cb6868080836964f7fd136bd304bb31fcb9096f2813
SSDEEP 49152:hF2YuHNETovAvNYf8kmMwQFB4Hd6axzkszpw:k6BCf8k149tzTzm
TLSH
T193858E6A27ED80A4E0BBD27D45B7D186F9B2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e534e848b81ff4860e079d2543a502d7f10184d20eac8a39b28be66ef384ff1f
MD5 3de0d313bb9d06d7e7a3cffb736a21dd
SHA1 9050156260f0667e37b525de33754784e24e61b5
SHA512 5ec5e7f4ff60d6743c8540ddc29a343012f7bafaca8e8e14393e65d1fe20db3cf4500e40709c727e11930409325033033f056781f3ab9687ef601d45ddfea40c
SSDEEP 24576:oAFs06+OmlfkNXEbTo4SwQFB4Hd6LausvUWx9BkszlXWy2v:tFs060lwXuewQFB4Hd6axzkszpw
TLSH
T18065AF2F62AC00D5D07ED17E8997C91AF6B1746307255ACB0260863E7F6BEF85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.4MB
SHA256 49c9b45c67de5e615cf55c6a00354213bcfa057fece287821eeff169e96aa6af
MD5 6f803ccd5cc29309704321590385807f
SHA1 6731b3c42fdbfce767fe37bf6f151c9e276dca74
SHA512 c0cf189b80bbab3555fc62bd3b009afb27f6c81452b483e6c785f1fb06ba1e1a736d0270dd2337aa8dab6e158dfc08a02bc2079143eedd1c90432abe01c1fcfd
SSDEEP 24576:QJnJ5D3WXjSwQFB4Hd6LausvUWx9BkszlXWy2v:QJnJ5DGXewQFB4Hd6axzkszpw
TLSH
T1BA65D02DD2A810E8D4B7D374815A1799FE72383E2F22AAC724B4D5357F12EE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b0243c5cd8104565cf92b616b49bf7bd4b290703caf57f48bb413e66997762c1
MD5 2815737a13b8bc59e31ea488efbdd241
SHA1 88eecd54c2769e47f1f2a01641813544dea855f2
SHA512 43bfd0d0bffe3da549576bbeb1e7ada0fc05a7bc91715f28da5449adf77fe05a41c27b0097ace75fcc99223c9f74cc3b5e2d861d08b611e33fa34cc386b862ec
SSDEEP 49152:Cg06DIKdwc+eQnSt65aVgwQFB4Hd6axzkszpw:7w49tzTzm
TLSH
T168956D16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 271f334a1b62aec3c75cf3f96b80825c9b9d7258cd087d0af6e0c6e79180983b
MD5 8f8a717d4c8c233b3982e83656f1defd
SHA1 663eca141695fd2a4f21493acb47a55565d78742
SHA512 b8c20cb135422cdcf231efe06000d25377791a66293f96f9d112d6ba3aed2993cce259c9254ba41ae4684aac62e0ebfa70c785037345044a619347f253a4d59c
SSDEEP 12288:4EP3RnETUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:TnnSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1DD45129E77AD70EAD167A13A80928598C6B6F0320B5257CF52E1823D4E338F96D3DF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 37e2e44dfcef9acc745c0eb351e079b1e374d1956b59208004d2f50bd6993653
MD5 e28be766bde0e64d6f8f7fc25809b653
SHA1 b0cb1b9715447a2cece6ac83f14bedd00d7fc279
SHA512 d97471c826f571114fe27a714788fae0bac151fd7ee3ddc57f6ec30ea60edc299c2c69d0146608064002dd95400859a87772843f99a36c21bbe094e124c85b3d
SSDEEP 24576:tIy+SwQFB4Hd6LausvUWx9BkszlXWy2v:tIuwQFB4Hd6axzkszpw
TLSH
T1F655124563AC60D9E6B62235C46381F88C79BC324F2183CF6191B62E6F35AF4A935F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.1MB
SHA256 e52a2a7a0c3726d099794c9a6126f50098afbb859894b2858595acde370565b5
MD5 a4d5f4fe111bb553c82061e0f2447c02
SHA1 8d9b9bd71a1fb32b9e4bab02505fd71293d33ee9
SHA512 29d65bcf00d4ad0bb649978b7bf5cdb7dacab701491628ea3a9f2c2baaf22a6407ef67db14ff736fe27a550f6ae928bb6d95160679a4bfb9d932606697095f43
SSDEEP 12288:jyDTUSwmJm1ELNRKHdpyJEj4VpaupRulX9U9gVoqrz9OqxP5WszlXWy23Nw0:OsSwQFB4Hd6LausvUWx9BkszlXWy2v
TLSH
T1B545238A717E71EEEA933333802755FCC85EB8334F90828F62F6722596704F99165D86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5b53e1b7a198644bd20fd5080df70d3ae9e565ac3220f9dbe4ee4c5fc69597bf
MD5 b2828f5b67cfa3f7be873c93116e62f9
SHA1 e042cbf91096a0c6dad75998f8dc0d749dccffd9
SHA512 a415a5fd3aaf91d92b861f4545a12a2ba054ee6c8b874506c277ee67fa353e4b6c7a560aeded058f13ed1badd05b2bbb7f94350e98d6ed5249a54dc3ed20bb31
SSDEEP 24576:QQ9MxZKdcz9dw3hSwQFB4Hd6LausvUWx9BkszlXWy2v:QVKZkwQFB4Hd6axzkszpw
TLSH
T1ED557C2DABF915DAE177D23594A250C3A673B4311B31C6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 dd03a247eefc1844f73a33e758e975fdf4ef74f26acdd7e861b13b0dd2a73da1
MD5 77db62cf757e63134c9725614a84305b
SHA1 23476d0d267ae5ecddddd607ae31d620722d9eb3
SHA512 99a07a4f0ddaf2359f671f2422264375c4b0048cce630ed3f9abaab2654c273fc0220af1ad2db73082515ad1d115083657a7bebf5aefff86fe67d540d44b44b6
SSDEEP 24576:tyocDAp6SwQFB4Hd6LausvUWx9BkszlXWy2v:wocDApJwQFB4Hd6axzkszpw
TLSH
T1CB55E05FB76D40E2E162923C88868659EA73B0315B6253CB6291C33D8F379F9BD34B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c2391be7abaf6ab4427b083e69e150a2cacc8dda72643e6fab41fdcb14bc0e98
MD5 81098f25ff52db81756fed4ecd2b5ab8
SHA1 ceaa603b6ac20a8bf9e3035721540eb191e8402e
SHA512 cb10a6adc91a9f058da9b0d1c003c3efe88cf8954de1cc8a36d0a36d6927188a2bbe67e8d0a6ec33231b7a61bd90328fa1566202ff3d0ef5b08cdd13cb74c5b2
SSDEEP 49152:lWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKJwQFB4Hd6axzkszpw:V0zuNIJ49tzTzm
TLSH
T11AA57B3DA2BC00A9D9AAC375C14613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6ac079e1a17f6ea2769e1b4958e965aa5207b9f9f0fd8702328e665de169d00e
MD5 95d2243de89a14d66402deae6dda87b9
SHA1 e36529481c7467286bcfbcaeceda540cbc1eabd0
SHA512 8f66eb748bef290e087cece2ac0651896fd2a8e1f15a60c051a2f107998dc818a45f1fd491a1371fd602d73e5e563ba937229ae066108d7614b66e1e63473008
SSDEEP 24576:C1QT7EcpfxR+N5AWAz3ooiYujMqbnSwQFB4Hd6LausvUWx9BkszlXWy2v:fTDxR+N5YzT4jMLwQFB4Hd6axzkszpw
TLSH
T10555B02EA7FC15E9D1BE85798A23C516FA727821033193CB42A0C17E1E779D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 29809bf1ae3274a51622daa6ddc81ff7ed004c8162a6c435a528eecab79ae010
MD5 856a1d238feabb8f606ae197d7b89181
SHA1 867515aca09682effaae878e9fc425d6da5edada
SHA512 ab5eb7d4a98bde0595d20334e0992eaffaf80cc5c478b95fae03082e4ceb8f6b3fca763856a17edd53fad65b26f1888d2c54283742f984b66f2eed203c8474d0
SSDEEP 24576:03YgnJcRTk4yti+R5dBR/KSwQFB4Hd6LausvUWx9BkszlXWy2v:0IgnaTk46pBR/5wQFB4Hd6axzkszpw
TLSH
T18545BF2EF2B910F9D8A6D236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-453-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-442-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-421-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-420-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-422-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-423-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-425-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-424-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-426-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-431-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-427-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-428-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-429-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-433-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-435-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-434-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-441-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-451-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-450-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-449-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-448-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-460-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-459-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-458-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-457-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-456-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-455-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-454-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-452-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-447-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-446-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-445-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-444-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-443-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-430-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-440-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-439-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-438-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-437-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-436-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/552-432-0x00000230E19B0000-0x00000230E19C0000-memory.dmp

Download

memory/620-419-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/620-328-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1048-326-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1048-277-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/1248-375-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1248-501-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1248-415-0x000000000C970000-0x000000000C978000-memory.dmp

Download

memory/1248-391-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1248-336-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1248-407-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1452-410-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1452-280-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1452-330-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1664-35-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1664-1-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1664-7-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/1664-205-0x0000000140000000-0x0000000140411000-memory.dmp

Download

memory/1664-9-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2352-18-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2352-28-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2352-27-0x0000000140000000-0x00000001401CC000-memory.dmp

Download

memory/2448-317-0x0000000140000000-0x00000001401DC000-memory.dmp

Download

memory/2448-249-0x0000000140000000-0x00000001401DC000-memory.dmp

Download

memory/2480-50-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2480-239-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2480-41-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2480-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2976-310-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2976-414-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3236-287-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3236-293-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3236-295-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3236-409-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3956-417-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3956-318-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4052-72-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4052-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4052-70-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4052-75-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4052-77-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4156-299-0x0000000140000000-0x0000000140225000-memory.dmp

Download

memory/4156-306-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4156-300-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4156-413-0x0000000140000000-0x0000000140225000-memory.dmp

Download

memory/4364-234-0x0000000140000000-0x00000001401CD000-memory.dmp

Download

memory/4364-13-0x0000000140000000-0x00000001401CD000-memory.dmp

Download

memory/4372-315-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4372-313-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4380-259-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4380-253-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4380-264-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/4380-319-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/4472-285-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/4472-335-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/4548-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4548-240-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4548-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4548-61-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4596-331-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4596-468-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4696-324-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4696-418-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4732-241-0x0000000140000000-0x00000001401F2000-memory.dmp

Download

memory/4732-79-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4732-87-0x0000000140000000-0x00000001401F2000-memory.dmp

Download

memory/4732-85-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4760-266-0x0000000000400000-0x00000000005BA000-memory.dmp

Download

memory/4760-322-0x0000000000400000-0x00000000005BA000-memory.dmp

Download

memory/4760-273-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/4760-268-0x0000000000940000-0x00000000009A7000-memory.dmp

Download