stealc | 882af13f7942fae48bc2d213940f8900804ad6bf2d1e0034591faaef9ee63b8c

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Size 3.0MB
Sample261002-ee8e4agf26
SHA256 882af13f7942fae48bc2d213940f8900804ad6bf2d1e0034591faaef9ee63b8c
MD5 c0ec9eaed4cf3685c479f94deae882bd
SHA1 047d2cac9208e88f33671c80b5a460289e9b02f0
SHA512 3200aed5db102085c7b0479fe4c5d04a116684d212c4f1be26f640d6e5a6b950397e353834a353e3ba99a7e4ef384ae97013bd1a092262a12d88ecffeb10d63a
SSDEEP 49152:6tY4be4yHQp0+6N/zdzQiHZTTOtjDvdpiryXkp8oL+bzxGMzva6ZU6CENlc7dpJ3:6Va/rUtjp669CEN6rV
TLSH
T10FE57B5F52AD00E8D1AAE17C86468A0AE271F806C731A6DF16A4475A1F7B7F34F7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/4524-8-0x0000000140000000-0x000000014030B000-memory.dmp	family_stealc_v3

Executes dropped EXE 22 IoCs

pid	Process
4576	alg.exe
1088	DiagnosticsHub.StandardCollector.Service.exe
4604	fxssvc.exe
4224	elevation_service.exe
2356	elevation_service.exe
3368	maintenanceservice.exe
3860	OSE.EXE
3576	msdtc.exe
2540	PerceptionSimulationService.exe
4260	perfhost.exe
1744	locator.exe
896	SensorDataService.exe
4152	snmptrap.exe
1672	spectrum.exe
3884	ssh-agent.exe
4516	TieringEngineService.exe
3168	AgentService.exe
1436	vds.exe
3468	vssvc.exe
1764	wbengine.exe
2432	WmiApSrv.exe
5008	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f903b65fa26b1277.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095146db02152dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c723beb02152dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ba3faaf2152dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c82bc9b12152dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e699d3b02152dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006591e7af2152dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f174eb02152dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e86c0b02152dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b7bb8b12152dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1088	DiagnosticsHub.StandardCollector.Service.exe
1088	DiagnosticsHub.StandardCollector.Service.exe
1088	DiagnosticsHub.StandardCollector.Service.exe
1088	DiagnosticsHub.StandardCollector.Service.exe
1088	DiagnosticsHub.StandardCollector.Service.exe
1088	DiagnosticsHub.StandardCollector.Service.exe
1088	DiagnosticsHub.StandardCollector.Service.exe
4224	elevation_service.exe
4224	elevation_service.exe
4224	elevation_service.exe
4224	elevation_service.exe
4224	elevation_service.exe
4224	elevation_service.exe
4224	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4524	2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAuditPrivilege	4604	fxssvc.exe
Token: SeDebugPrivilege	1088	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4224	elevation_service.exe
Token: SeRestorePrivilege	4516	TieringEngineService.exe
Token: SeManageVolumePrivilege	4516	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3168	AgentService.exe
Token: SeBackupPrivilege	3468	vssvc.exe
Token: SeRestorePrivilege	3468	vssvc.exe
Token: SeAuditPrivilege	3468	vssvc.exe
Token: SeBackupPrivilege	1764	wbengine.exe
Token: SeRestorePrivilege	1764	wbengine.exe
Token: SeSecurityPrivilege	1764	wbengine.exe
Token: 33	5008	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5008	SearchIndexer.exe
Token: SeDebugPrivilege	4224	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 5304	5008	SearchIndexer.exe	134
PID 5008 wrote to memory of 5328	5008	SearchIndexer.exe	135

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_c0ec9eaed4cf3685c479f94deae882bd_akira_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4480

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2356

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3368

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3860

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3576

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2540

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4260

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1744

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:896

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4152

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1672

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3884

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4336

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2432

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5304
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0eb977183dd894d48b42812f166ea732167a33aa08a624b967bd2b88c4a8ba22
MD5 b0a1ef9b86735d3792e5ec037b5ad0cf
SHA1 92eb5bf349ffd819fe200cf3d9738f680432f3ed
SHA512 a060a28752a4e5fac17ae9560ef429d04f78ba5c8d116aebca3957dc9b653a22e757d77915f90b5de68b8f9b390203c10bbbbc67ac0aa7230262f274e14aa5f3
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnk6ZU6CENlc7dpJLrQWd:w3q6HjBz69CEN6rV
TLSH
T1EBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 084b6de31c78641c3c01a2ef62e74154a3486224dc68be249f3a02b5e32d4c38
MD5 5315e7aa767e83da7308c9d3a66cce43
SHA1 b5011c07fbe1ae6d782be68235168d935bdafbe8
SHA512 5cf7b1f7f0873131ad43b7bc98e760dc34f778975956595211edba0b4c58e534fbaa2366ec25188c330c94422ef513449fd6566cc1462597402f8223fd777c0c
SSDEEP 24576:iXYfDtczAO+L6VMRCPU6CENltmVVdpx7fLrQWd:ptcs6ZU6CENlc7dpJLrQWd
TLSH
T14E65F22867E408F5ED67827CC8A2C511EA33BC954760EB9F03B4992A0F336D85D3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ad8f16c159df4b02d6c0aedf6cb851ebbf8a6317f8ee9918c987c406477a42c4
MD5 c26a3b9f4b383c69313421f5b27d249d
SHA1 70139264082d870a4fab759a6b94dbf61b5992e9
SHA512 233d542cfcdae490ccbb180778087873297cd3f51ee07ad1e1cdb186c63a38c604c993acd1d37fee3d9c0e3855cf7ab5bd1d74f3eb11c6c87c13d79390817c77
SSDEEP 24576:J0Le5ji0hmxirMV+L6VMRCPU6CENltmVVdpx7fLrQWd:JPji0Ac76ZU6CENlc7dpJLrQWd
TLSH
T19C85AE25F6744731D073C0B9C5D2A69EED7230865B308ACB4286D77C2F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ca6b23c813cf5d80a65590dd39be4d05fe03b4236de5864a5a190a71527da77f
MD5 410f0557b243697765a3d54334dd9e8a
SHA1 0a1f648ff751cdbc40554a7b40325f026005db3a
SHA512 5999808b6f67c90ab187dfccd54ffc46c32cf05440022d6e5cce63ba42da5137b8fc6a5cbe57edd2b7f3ba45373fe52f0cea319d96607eabec5dae4b4e93712f
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWE6q8wyuH+L6VMRCPU6CENltmVVdpx7fLrQWd:s/ezSC6vUzPvxHjyn6ZU6CENlc7dpJLL
TLSH
T1BC755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cc68c070cafd163a04f6f9090e80c14a785add834ab7d3b5cc26f2ac45647fcd
MD5 0f1450073715e3a07f1d3d7ee5441532
SHA1 3b00817299f517a75d4a36429dcd20a5094dfcd0
SHA512 15bdc63f68712631455e4a0cf7b3fcb617cecb5bc6cef71fb3e7aad2db7ef382b0112de55c8c5ad6987e318edf8d2ae2cbb573a4ab25e04ee99196bcb8b5be3c
SSDEEP 24576:cVbqPb88hv/l+66+L6VMRCPU6CENltmVVdpx7fLrQWd:cVO88hXl+O6ZU6CENlc7dpJLrQWd
TLSH
T111559E66F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 45e3986114a47c0681fd2f857943de9554507691d06799d54d7dc9d5c19d4e98
MD5 d901fd630f10d3343b0c140e37e61c0c
SHA1 649d901c157a8c8e6630e42dc96c8fccd0443ebe
SHA512 1c7a63d8504a89883f224100f3249b8ee06e0863faf4df2e8de24289797c8f2144ca1bc371c4898b5f098bfc2f462b4d14b099d6c2696702cfa76e2eff34f628
SSDEEP 12288:BR68+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7J:BRh+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16C45233487682D52DBF80238E1E691F1AD6AACD55B00AD1EE2777D0F0D398B4DC5B22D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3b34b06526385c1699f270ee9035a5a96ea7ea90d3c2381d4b9766cfa16362a5
MD5 b8acfc96c2233eb8f88066ba22828946
SHA1 9f702a60ac28aecb39fb30aaaa633a4a166e382a
SHA512 16cdf56c7d22267a9686ec9907366f1be3497d634f01f48d3012f615ad01076e4247bd25cabeebe2612cb18423e93025ab44979c8912841b995201a64b9e3dab
SSDEEP 24576:TJIUC+L6VMRCPU6CENltmVVdpx7fLrQWd:TJIU56ZU6CENlc7dpJLrQWd
TLSH
T1AD65CF3BEE28FCE2C27A4DB85A91C640E77278704F51A7CBD175820E8E235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b2979e8f2f0b652aee8f7601e5bd8b3f6c555cdc2bcf9263d3498e14dae7aa68
MD5 45b2ac3e490ad781b61b6cbe1860e5ea
SHA1 479116c20d39888895e02494f907c51febc0ad3c
SHA512 45e6a0a7d01788400c544ee96b7bf7ad40d34f9a8d94d7a43c201175440faa8d7ca22ba36ca4f44b2a99dc279454f7ba2ed31971a2d7ad25bd06f26dfca66b07
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:HQvGAdlCEL8c/yRNw5CM69CEN6rV
TLSH
T1B1266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5ab4f1316b59b9e516158bc7abc485a785522d73e6d55cdd2a787f62262a53a6
MD5 866a31f5a9be6ae0d4f2666d3c4ce14b
SHA1 6a53d06755ebe8aa433cb5145773fa8768477e25
SHA512 a32313e7eb4e5122affe9788a09872a34db4a14208a1732bca1036f1094cfb8964f8e2832bb90c7498e6c0305dd9f85c1cc3d1200231e32f26dabc2519258a23
SSDEEP 24576:VdewsAjU+L6VMRCPU6CENltmVVdpx7fLrQWd:bljL6ZU6CENlc7dpJLrQWd
TLSH
T14475E031FF74E432C3BB0DB61B36C716582DB9604B511AC3E3A89E9E49342D12776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 768c0de8e4de46caf00012862e7f1a82c07a86cf09880ba40a9f46041bc00797
MD5 275083b98e0b5b19887a531a35f9bb69
SHA1 ef86d33fc4a57ed7f915da33ca12cf9b74aba836
SHA512 bc94cd994b384abcb21961b65bb0b4c5537b89f66bc697263398b630f85f8626b708691ee00e4854c6c342ae7b8ecc3e03d38b40a095a110894fd084b4936948
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHTIm:RUEtQevvqc2W1cpV2EI32E
TLSH
T1ED474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dbb0ec73ef4d02a9cd2f4a255052146e35541260d53d754d0bf406d999301d8b
MD5 2c6258964715dd7055866d16390403b7
SHA1 e454c7a41c1d382fcee2837d6ac2db35580ed779
SHA512 22c647488b9cdcfea631f6460c10c34fc0d8c6dbadf337455c49a1597f73e64465a951708c7627bb55d81da00b1ee738693ab0ccb8250ba543504296898ee51a
SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zr6ZU6CENlc7dpJLrQWd:UoqtVjnmo69CEN6rV
TLSH
T1B5D58E1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4266461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b726bcdde75f9da28d9c5816083eba831b4260663246bac3fdc4e31fd208e399
MD5 6b59e9ed41020c5f9d8b8d6b18289287
SHA1 6ccceb3277e3a12b80bd72342f1f1cb4f8261b76
SHA512 d155324c937167fa51479c37c672369dbeb7acfad593081c45f47ecce286bee067f1cf4d22f9a1f38ad9dfb2619608c94331187934b200d6dcc7d59bfa7dce16
SSDEEP 24576:wAhGLJIFoiwtA5l7S537+L6VMRCPU6CENltmVVdpx7fLrQWd:wAMyFoiq546ZU6CENlc7dpJLrQWd
TLSH
T1E6359D81E7F915D4F5B3AA7899B69171EA76BCAA5E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 cd837cb4e73f8288d464b12c321c91f628f0dab0b6d1ca06e6043946842bae80
MD5 6a58d94fdc62fdff9bd02452b294d07c
SHA1 e71ee148485620b065ac7336cbb09f263814a0af
SHA512 6922af14b68cc5b8afcb0a12d598956238b2f092eac5ec52de7603159de91c34aadee0c065e7788139b1a94e82d97385a7a9d8f8dfa2a4f351ae00a5a62d3170
SSDEEP 24576:HwuoOWY+L6VMRCPU6CENltmVVdpx7fLrQWd:HwDOU6ZU6CENlc7dpJLrQWd
TLSH
T18565F14967A41CF9EAA74238C597C136F7F2BC422A21DB1F5360C65B5F37260AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8ba426fe35d0c69b8e9fe0ed42bae5023edf34bbdd8e4fd08649cf6fce471829
MD5 b9ba5e71221f02baa9e5fcc20a7b3076
SHA1 9ac74bc3972673623812d8c53be1b4a7fe7b0bac
SHA512 37b99878ca7994dc850e0fd26ee644b2b1e4102b023f92009df0371975aadf435c556002070a1bffe45d07600966147b585bab16656072629588ef47fc6bfa0b
SSDEEP 24576:jZu9+L6VMRCPU6CENltmVVdpx7fLrQWd:v6ZU6CENlc7dpJLrQWd
TLSH
T1AA55126913E834F2D2E6023CD9E29655E772BC96273147CF5226566E0F37AE05C3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 df236c3d8a852a384a13a739a662b8c443f24ccf69b316f875828060fa10166f
MD5 0ed2bbc746fc5f53a96955f927ba5975
SHA1 6ac95c7c94785a6c8d3e4f4fbfbd39094ee0eada
SHA512 ce9640d43fd0b1914927c6c020e3b20cf1ca815eee603bbab56d18563b53aafe6ba3c999bad610aa97a74c9973bdf5523644ad5629f51a7864a9f33d2896af63
SSDEEP 98304:iQRQyi36YOcPQLvw2gAf+PN3l69CEN6rV:5QyiKayX+PNVIm
TLSH
T1E1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c61589c010512eb0e8484b3ffbb8caba040944492ec8aa0a3d42eca389752c60
MD5 c8f7404553321d7884c290bd9c2bdcd6
SHA1 9b7f872f9d8f450d4ba687a1767568d1db907400
SHA512 297cdf0dc009900bbc0de3d6165aafab38182e5dca56020ce80296be11383357f08d0b1e4b8f6471efb95fa04f6bf1862b463eabe46d7a9eefb78a8dd91c38da
SSDEEP 98304:5QRQyi36YOcPQLvw2gAf+PN3l69CEN6rV:wQyiKayX+PNVIm
TLSH
T13D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 23fb1412057bf3d9fb74b78042933d08681dc07e5fdd1d5d7266cd2fb21f2653
MD5 68787623689a4daf914ad4b6c9a3333e
SHA1 04c1821844507260153796cda8cb4f3d3166709e
SHA512 5076c231e66c36e2077abe4bddb53d4be904604372a08019e51d1f6d03300072a11b5bf2178791526ab5d3200f04e7e04e197a7b01c4a55cc6acaf59b37ed98a
SSDEEP 49152:G68Qg55nhheWu7PNU3/76ZU6CENlc7dpJLrQWd:kthWRc/769CEN6rV
TLSH
T1A7B54933B2F60099C44DE1769F4A872196D27C758FE0E7DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1daa136c2686a13631a9fb8434bcc33d534e819fb7427934105767e829efaa87
MD5 15a3947aba1b405b49f312b20d77bd9f
SHA1 6d02c71c13bc3de3a333be531350be30f7f1f900
SHA512 1743e7146c8b0e0c538ae03b7ef46d69846ff32a40b3dec4e5d52ad115c35f8b6dc1c008bb6f6baa3aaa72ee3e27e677f44d80d33b868768bd6304982bd9d6db
SSDEEP 98304:ey5112gYy5azzVvL69nLKnhZ269CEN6rV:PLIHmWhQIm
TLSH
T10F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 44fd62f113211d0a9c12018245ce265226a5546b22501b984214acc2150fcd49
MD5 24550d75fdb9d5bcd9140986da499385
SHA1 e6c8ed2ffcb837e64c4ee3aac1c8bfec1fd1c02e
SHA512 af3805a1f135699c6e056beeaa5e6c51ce10d24fa5f0ec1a05d217047745228f7a81a2deea930558406d73a8c5811b2e11aa961fa2aaefe44b2838955ee097c7
SSDEEP 49152:7B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl36ZU6CENlc7dpJLrQWd:tu6JmVxd2d369CEN6rV
TLSH
T10DD59D13F2DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b1735ce8ca9a6a5923cd3c54a2a4d115bd7610a6b66e864f63494880be86a361
MD5 c250a8d24abdada668787adf56ff799e
SHA1 11d83f9a12fd2b6f5a06c7385a773a19a8d3712e
SHA512 5542344f8c9816abae00fa66db4218f36795ef3511f5d883d956122c6124d0ada1cca15870ab66f33895774ffbcad9cea67a5061e32a8779bea2bf85f512c4cb
SSDEEP 49152:Y1hpsNoJpF1A6UU44CwH7R4xZ6ZU6CENlc7dpJLrQWd:YmifPbRo69CEN6rV
TLSH
T18EB5AE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8e94a4224e8a54f6f4ea186f6b498da5814e2e71e984d1fee3fde76a56cfbb79
MD5 bb9900139524864ef2e683d96ecaffa6
SHA1 dbd58207d4e1e9a35d2e5aebd781fd579c8082f9
SHA512 d0d8cc596e4504bc319652dcf004d1e608f66ace9dfeb1af48a57996364a9eb3126f4e56836e623a1d3660b387aee4b51f71b1e44b8743c6374b98c6ac379b4f
SSDEEP 49152:0SuZQIY0Be2KRRVtOnks6NMHqK6ZU6CENlc7dpJLrQWd:m5dKTi61K69CEN6rV
TLSH
T1B2C5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 422abc3b5400a8fc53de35ce4391213488072c7ca8143f01783a8a3ebd203663
MD5 b3a215a9eeb8f7bfddcf61ae915b2f76
SHA1 d9e500c48933e9d7c14b185462ea47255de4f005
SHA512 d2a1e03b332f20d40a4f6f20949eb6297105d0373426411cf5fb274383f1d1022d668310a8ba0d5818a3ce3f9db7b4fef79205404ec77c822fd3beee3442cd9b
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5wN6ZU6CENlc7dpJLrQWd:wX2iyph069CEN6rV
TLSH
T15295BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0620be1d3237e9066941ffbf052c227b098f65d72b6c7812c808e4ace21e628e
MD5 bbf8190006c8d4a70e347f59bc66ca12
SHA1 e31ea5cd60f74256bcbbabc20e90a89f3956219b
SHA512 74d58d03c3f3d31a813a65cb66a180f0ba05476cf77e694d58d60e2c56769993c875ebe5c542449e48833a5e7d57f5758b113570787ffec0ca60068ee91dffa5
SSDEEP 12288:yi8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7y:yp+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T14045233487AA1D52D7E40278D1A291F5A859BDDBAB005D1FF37B781F0E3A8B41C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1e43b2b0f6e9b1578aa6889d73f3383dd1fcd526ce2afbc4288292e8cf5abc4d
MD5 f9115c2559175381d9e1918caad2128e
SHA1 da53bcf8f0dff1564f8b937dac180d84460efb78
SHA512 7b3d78ec80b5078e95ab34a2319725d0a5cba2634682718424ce03e312de37eb015a8ac6e1c392793cde867295131cf83546b92ddd6825e5cd33264bd7260eb5
SSDEEP 12288:ej8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb74:eQ+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12345233487AA1D52D7E41278D1A291F5A859BDDBAB005D1FF37B780F0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a9be61b8e55b74b0f3c96151416aaa9b2537e720a3acaf6e5e98155be1b43eb1
MD5 5dd5fa7e7544592e18baf6b75bbbae8d
SHA1 b9bbe0205566c4b71ac2b98a22d4852b26237425
SHA512 85ef6cbd3aaf890ee166fe2ac2d278899a7a4c362d34b3e546759b8a03652a42a919ddd0f37e4a3a2105d4c0303053175de3abf63a064c890b278f927eebf896
SSDEEP 12288:a58+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7p:aq+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T11445233487AA1D52D7E41278D1A291F5AC59BDDBAB005D1FF36B780F0E3A8B41C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 22071971f163ee60682c2f94ecb71e2ec8a8de68bb9cf14ee3ae6d7e7b8b3d20
MD5 0dfc30c5e7072e8aba18848990e0fab3
SHA1 dcfe514fb94d4533f2ab2265efab9679f4048754
SHA512 7c30c6807278f8e8e41fd45bcba34923b033075c1188ac20e961fc4360816dfe59d9e988b205a98a2b36a5e150a05e07f28bef48f4d0dc8db2c95d3e7e5eccac
SSDEEP 12288:KV48+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7Q:g+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1BF45233447A919D2D7F44278C1B291B1E979BCD6AB105F5FE322280F0E31AB46C3B728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1ed5aaf6dd52662b1bede6029c4c71c7f2916a7b3f551230138f7c0b6a8bcda6
MD5 25981cd5c2f0d7dff41659f0df66dc07
SHA1 e278d3df318a41e62f4aa46f9b15f0428e0f7bd7
SHA512 b402adb3239a41e2814a0a591fbdcca9f0293f048cc785fea2911249fafb95da9df67ac7c9ddfb5e0877d8dc9c32d5cc19b71ab522172453683c7d21b6c10f82
SSDEEP 12288:tw8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7a:tT+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T15545233487AA1D52D7E40278D1A291F5AC59BDDBAB005D1FE36B741F0E3A8B81C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 695d709549bae7c226074a52d51abbe46e5658258333dedb20c9ecd20beb8dfd
MD5 5f76d7b3f211cd2bb9d7b2ba4e545668
SHA1 77938cbd967f3e7cd37136d6778b43aa7f88bf5c
SHA512 5e1f35673dcbe75d79cea218cdefa7f6a9b703eedc8e74959213aee852e5e56db1928c4139ef8f15672ae32d2a82fe3f186bd4e782affb95eed779c8830021b3
SSDEEP 12288:fH8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7a:fc+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1F245233487AA1D52D7E41278D1A291F5A859BDDBAB006D1FF36B780F0E398B41C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 66444d0babf666bb7fd2daf6ed8df403b890174aea5f2ce517f91c588947dfcc
MD5 524d5aa20b940559176ead59013d8d69
SHA1 154747a80b0658f1b8afb07086fa99e06195987a
SHA512 2a3e16ceb6da9fb6cfdee409e373096b24d396bafb84082306aee44ec54afe14c8e218d7334c768196a10cb63bd08af3b92eed727649e6aa765b10571a769a33
SSDEEP 12288:Vb8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7U:VI+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1FF45233487AA1D52D7E40278D1A291F5A859BDDBAB005E1FF37BB80F0E398741C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9337bd9725a6da1ad98253e3f0d7ba55f0a3b93caa12a7784c70f0d5663892c4
MD5 436f8ec4ef9ae738cc96e09a669171df
SHA1 c86c61ffda3f95afa2190474b1f1b0f54e46a69b
SHA512 e9dbef9df14b2fd12796b03062c6798057aa8fdef73919ebb49e55a8afa06accfc66fa3ddb5f8de0280dbfe64066cce2c747e27bb2dc90af1dd8595692bd609f
SSDEEP 24576:kZMSzFVSOw+L6VMRCPU6CENltmVVdpx7fLrQWd:kZMSzfz6ZU6CENlc7dpJLrQWd
TLSH
T18D650265B3901CF5EDA7423DC9658956D6B2BC5A0B60CA1F13B5362B0F333A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2085a066f45ac5e70804817a77090280854fe987f0b691fff15942c78bc5474e
MD5 1466cb7ec8116e54c376d1fb0ffd461d
SHA1 ec2753d644c04c33a1233fe8099658d6cd122d30
SHA512 54b4596d7a3d59d01123544097ef9296f8f90522b716fe1b41116ddfa363482c18625ad8037f952b391de32a2cd07c9179e5410fb9f83f69f3ca4245b88c41ed
SSDEEP 12288:ie8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7J:iN+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T14745233587AA1D52D7E40278D1A291F5AC59BDDBAB406D1FE36B780F0E398B41C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 abd20b3753e89b776d8252aa79022cf77e7b64d93afd520c36c685f4fe3b21ec
MD5 502b717350153f8d75736bdf772d8b84
SHA1 5b56373b92425cf206dcb7c03900d9bc551354ae
SHA512 442009985ad7618a787c9eb797afdb1f31526de5ec6ef92777be6a70bc77516e8ed684a7e2b5de2fe25f699556856d48a18ee05c5d7ba14f2cbb1b56c07eb302
SSDEEP 12288:lq8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7l:lx+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T11845233587AA1D52D7E40278D1A291F5A859BDDBAB006D1FE36B780F0E398B41C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f77782acde1e261af279204d7b872ddf99cf404eef35fd00075e9aa253802757
MD5 77eb27314793cf8bf8cd097a8be9777e
SHA1 938575291a481ff594e8a5996fa34f587b4decef
SHA512 fbe51cdbcc629719794a91bc4475a8a9b00c6b366a47cdd48d64cf5c707a3febbc8eba5729490586117522ccdbe3bca9a5717b0c02d58f59f5940c131a2bb127
SSDEEP 24576:ezyk+L6VMRCPU6CENltmVVdpx7fLrQWd:e06ZU6CENlc7dpJLrQWd
TLSH
T1AC55021763A530F5D2764238C8A21A52F776BC765B208EAF53A4163B1F376A05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f72e48c37ae47437b8b3ddd939b37ebb8a99f1845089744c58d03eb4972620fa
MD5 cc9f92bcc0d9079056ad49b8e932b76a
SHA1 4ebe1f70482ab039e3b65d8babff40d96e41a717
SHA512 497e6d7c0bc3abd33c7202d4d151d5fd56ddbf4ebbdaeca2e3020ca05b78d8c6084dfb255b94bec834118e0bc238f16b29e876459643f8cf5a8ef5f627407269
SSDEEP 12288:Se8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7m:SN+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1AB45233587AA1D52D7E40278D1A291F5AC59BDDBAB006D1FE36B781F0E398B41C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 07bcc7da5434e1a9209b4a3e31fab2405566835fa83161e3131848ee8272c760
MD5 f0089f971323b420d23f348eb9aa84cc
SHA1 03950528dbe03c5456678557b89fd6314c55c942
SHA512 4f30b2d221c3e4d7480a6543df7ea14eeb4ce511e72a3eb99fa7efb2832938142e0c00f2afeac80ddf92ebda3cd8ec07d569f67cdd35df1296acce200b0f9b2e
SSDEEP 12288:Le8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7B:LN+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T14B45233587AA1D52D7E40278D1A291F5AC59BDDBAB406D1FE36B780F0E398B41C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d3ed54b8089676dd8462075de8296a07940a316577efbabd3c9fade45baff8a8
MD5 bd448d52f9b818f27d96b105a67f5a84
SHA1 341bc8912a70b132173f99634999bbfbb2d3fec4
SHA512 7bdf0e5f71df1565bed40193ac2c7c147b26c02b62e894778bb5049ca15fff2a8c3bfecf2643ab69975bccf403375a27be15d3a80ba852636a64cdc28833b000
SSDEEP 24576:bzyk+L6VMRCPU6CENltmVVdpx7fLrQWd:b06ZU6CENlc7dpJLrQWd
TLSH
T17055021763A530F5D2764238C8A21A52F776BC765B208EAF53A4163B1F376A05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 efad09c3e92c5d379307ab8a02946a1f9c82437332f3d04966f98b29808ef591
MD5 17b7239fd2f63527d734661547de43b8
SHA1 de1209ddb49a6f635d2fc4685ad2ae783167b809
SHA512 9582ab2b5269d193a7211c65675396aee006b9b2e4d0480235d63c3776f63856ebc4546873c36266f8a49a591115c980364ba5fa6cc64a826378b1c221ca86c0
SSDEEP 24576:YTHaLl3z0zDa+L6VMRCPU6CENltmVVdpx7fLrQWd:YT6Llj86ZU6CENlc7dpJLrQWd
TLSH
T1A8650264B3901CF5DDA7423EC9668956D6B27C5A0B60CA1F13B9362B4F333A01C3EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1f63d579caf8bb16ae25a3f1c5905d3a4987e7814a274ea513cafcafdac0b5b2
MD5 e3eccf6ef0c7c4ad09e6315f457b8517
SHA1 face82827d6e880e777410d9b826740e779cc947
SHA512 b97cf6e8d393bd01bbeb9291c08fd3be9c5eb1b55662d2c5a201a357001488031cb3583a528cc9c5e2640c091b576437836b6000bd4a2024a6142e1a4437e344
SSDEEP 24576:F37d9CHKy7GZW+L6VMRCPU6CENltmVVdpx7fLrQWd:l7d9CHKyaz6ZU6CENlc7dpJLrQWd
TLSH
T19675CF90F3E414E4F1B79A35C9768511DAB67C9A1B31DE8F03A8251A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8a81dfa777f1d7b0137f7683ed65a5a4afadd7d336f341c26065467926b9bbbc
MD5 83c30c6361c3690c4619832a56adfba6
SHA1 b48d650f13ccdb24141e00e5dd37f60a59350037
SHA512 31e8edcce78a7d4e67d94538c7ad6a82b0b547211665927a38b4a2cfd07afda1ce5a1059b805e85fec7d007820d374c0d8e17c11a76a9d4505e092bf46c8182f
SSDEEP 12288:1Z8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7u:1K+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T10445233487AA1D52D7E40278D1A291F5AC59BDDBAB005D1FE36B780F0E3A8B41C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4e88fb4f2131be50d3116f86c52f6feae0a680a64d09e0e57a6a231a049d063b
MD5 119a87240162dde9c25dba55f9145609
SHA1 be0c6d172be9be8029909204c7acd7a6d266a43b
SHA512 be907a6c99a8fd30416ac74abc2e097222031aa255d11fc0e26f28df0ee517148ab58986dfae7dc5972d76f3aee484514b329146303f4ac432d62b151fbb0746
SSDEEP 12288:4P8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb72:4E+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12D45233487A91DA2D7E40278D1A291F5AD59BDDAAB005E1FF37B781F0E398741C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 74c0813cf15bc173b70bf34abc9380fa133b7fa64626791bea01d2c847916c6f
MD5 feb6de017c1c4404c9ca48901f33ca8b
SHA1 d82530e5a4ed361ac51eb6205cea83cd7a140ae2
SHA512 ebea1f079f637dc8fb14bd65c2a97800a2856f41f06f233f6ca874b740adc1fcaab844e174f9611dfc5d768337edcb2cf3be00226a7df1366155721e4a12cb24
SSDEEP 12288:2E8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7l:2/+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16D45233587AA1D52D7E40278D1A291F5AC59BDDBAB405D1FE36B780F0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1c863b18098352857a12b05f0a2d90b17fe430ed045db6abafd94063b132f19a
MD5 ab12790733d7c19ffafba00bd8380984
SHA1 bfe66a8e1cfb51f0d1841149d7fbbb77fdb5a8b5
SHA512 1b49ca29fda9bd22db2e9ec90db677d4440c58fd35d0e24bd8930c45334cd8634b58f4f328c1b9462dc52490fd33d154f0d8cfcd706541a52873fa1bf448fbd5
SSDEEP 12288:XNsfu8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7N:U9+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T19655F019C39802E4C1AE2278C7928691B7377C6597E1D7CB62D1F43E0F3A6A05DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8d4be929179de7a2a56c9a9824699478f80327a3ad7d4ee57e703e4ff2fe39b8
MD5 26d1333466a40bfa94a98c283434503d
SHA1 575eeb49189b1fefb2716b5425e5ed00b1c4b7b8
SHA512 8defba4f5c58d170bab947615b3dd48b043924850a195b545cc2e31d1d11de1edbbbbaebebc5b39793f0aac74e361687e63a8327db3796baeb8f4cad0f7e5c04
SSDEEP 12288:0L8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb77:0Y+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T11445233587AD2D12E7F8127891A2C1B0692EBDE96F009D5FF226791E0D39CB45C2B31D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a3de9119c4658f4faca633ee3e21b71c2b8fcee428b1c1689536c7556c8cbc24
MD5 5865c986eb833ee7b3444750fd07703a
SHA1 3a771c20e81f7579ef9235e6532f0e7bdd97c026
SHA512 58d05da6d7aecbef218515b0380e3b7d4cf75f2b9bc6df8a7aa4ef3b7a487b63080cbf340407e4b071dc8ddd1145c682d53821e72340a5d0036fe37daaafe557
SSDEEP 49152:Ua0h2GEkuAe73q3pp46zwwQx6ZU6CENlc7dpJLrQWd:Ua0hNYG4JwS69CEN6rV
TLSH
T1D985AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 886538fc7e1e134d0ad6fabb6bd6afacb1000f8bcaaeebd721647530432dda1c
MD5 85be0bb677c4f9ee28d0ec01a12934ef
SHA1 d73ea782d8fbf232c698688dbc40e29e642fb1c1
SHA512 0f6e4b3ee91d9016e74d787d72a7c0333a6d31aba75d24c1d4fa0dd9bbd2d711c86d3d16cb6c0344203ffb5659b968f53c9fbf74c48c97a13e0f9194f48cc76c
SSDEEP 24576:HhbHjPG+L6VMRCPU6CENltmVVdpx7fLrQWd:HhbHjN6ZU6CENlc7dpJLrQWd
TLSH
T1F155123D07AC24D5E2B1A27CD5928546D731BC661B11A7EF6392923E0F3BEE41C3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2210a26e360b3b5b0a2e9966b6ae08d82baaad1b36a5550cf451cc743f8d9bb6
MD5 aefef16f6de6ba236f6d574b241b1693
SHA1 e8c76e1ac99e13f19673b6bfa4341e4024dfbab8
SHA512 2f6fb066479d13d7dd236d840ad219bf0cf2886c9c93db0196ae9bd2b845a48b3fbe4f2bfb6e7dd0989442c5f011dcc947dcb8fc404d23f255e79e0c572acd46
SSDEEP 24576:D3YgnJcRTk4yti+R5dBR/e+L6VMRCPU6CENltmVVdpx7fLrQWd:DIgnaTk46pBR/d6ZU6CENlc7dpJLrQWd
TLSH
T1F745AF2DF3B910B9D8A6D236850147B5FB71782D1F209ACB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 f1d67c8935b0e061a74df1c715e7900b9c4e906f1e2b46b66c9b87561f451f50
MD5 6e768d39d2b538edc4bebe6c3cb96afe
SHA1 e3c393e328a0dca7622e8a2e5d0ad062749dd907
SHA512 f9ebf4755dc2755a137e233c245cdc07b97715179245cd3fa3c865664c43a1b0e95e1d4843a188e520452643e24675f69782540629279b156d2a0d1322bd32d2
SSDEEP 12288:Sv8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7S:Sk+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1B945233887692D52D7F41278D1A291B5A819BDD66B005EDFA17B781F0E3ACF81C3B21C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 da8f27bfc928734e53ba27a4defa802c29c2fee09f1df70c72e8e2dc1a65c664
MD5 f89598b6118b0468e1d50df3d49a5ae7
SHA1 53c7fbc65c6c650a30780750a3d0109bef0e9570
SHA512 5b52e8dc82071eb42de1460b9f6bd54d7d301f37abe5b30b044c1e92d7f2460a42264c8e8b17e002c964ea2cbb468fea7ea493a6cf3a640829c4cc6f834c72a2
SSDEEP 24576:CpL3UT7+L6VMRCPU6CENltmVVdpx7fLrQWd:CpL3Us6ZU6CENlc7dpJLrQWd
TLSH
T13B750215E7A404F5E977913CC9A28526E672B89D0760EBDF03A94A6A0F237F14E3F710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 dde8784ccfc8f1f854caf8de5b3a769a370c355a9ee1194a488f451c4301ad65
MD5 27937c8f41dfb4c9d2cf55eedb6a02bb
SHA1 edd1ee3d2e53f9e2489f9bd69a998948022ad793
SHA512 da567c7d9d1bf26cdee50d1064310be726be3c2ce973ee3bc64cd6b3367788979fb0622eccef5a84bb9d4536cad4c767a186ea821c4998b6685afec5fd6ee9cd
SSDEEP 12288:opFtpO88+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7y:6OX+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1BD55022927ED24E1E2B5613CC5938259D772BCA6171157EF42A0807E0F77EF86C3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a12d5ac78466913c0d2a7b5c363611a1b0e57ee789e2161baf6d2366abfa6673
MD5 d7b7b6cd4b3d602f58b94f2c0d802f9a
SHA1 6281c1f6d9f662110400ba696b1536307705aa1a
SHA512 19d060ac7ca44c78dac734b9eb32a68c2bbb10effddbd335dbc97cbef2d3daeed19451bee1f9f2ef4c880811e49c40f7c96d2dbc64978a1e57753b23a6c03743
SSDEEP 24576:U7NM9YqZqmWMUkPjZM48Mv6bEhsI+L6VMRCPU6CENltmVVdpx7fLrQWd:U7cBWMpPjN8DbEhG6ZU6CENlc7dpJLrf
TLSH
T1ED65AE2E5BEC81E5D576D13DC9A28205F6B2B4611B318ACF1162833E6F37AF44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 905d95518796aaf4a6d3bf032e7587d6ea83b02aa84b4f2660b4ef51c4029352
MD5 1dbc9b7fb816259e4974131afe214257
SHA1 ea2ae9e6c624860776f3dde545fae70959fa4488
SHA512 ce6dad9bd2819ca0c9c3b9e2d892f902790244dffc0edb79fc73425191801880969e0286827bab38015f493af91293b3aeead33e1b9129071da99d17fc957ec2
SSDEEP 49152:bF2YuHNETovAvNYf8kmX6ZU6CENlc7dpJLrQWd:66BCf8kM69CEN6rV
TLSH
T1E5857E2927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8d93649da0caddd2016a06ee5e9a5fb6e6989c4908fdd07b89acc93c0e7da091
MD5 9822c4de7e27c36b4616076d78e8c619
SHA1 438901b27225c4dc8f78cb11c481f24dec04f001
SHA512 59264a8f2fe0a5121b8b836ec22180049490574801db0e88a162855011d02d52f761c053b822b28f6abccbd5f7e54d5642253a5ef8e630c6489540acb0cf2095
SSDEEP 24576:cAFs06+Omlf3NXEbToT+L6VMRCPU6CENltmVVdpx7fLrQWd:xFs060lVXuR6ZU6CENlc7dpJLrQWd
TLSH
T14065AE2F67AC00D5D07ED17D8A97C91AF6B1746707215ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 f79800b900648e11c721b1a5031f1aad81703e3254bef9520c2e227ef315090d
MD5 ddd6ef11d736026f9fd709438815016e
SHA1 612345524c8919c318852469e2b3d9c45ad9e688
SHA512 aea802f6bac8e10ea383ec50577c96111c7b8be0282c4f4227ae0776ac802f083cc26d502f8e53093f6a938e9272e41aa7c148169aa95ec1fcf6405254d99a5e
SSDEEP 24576:9JnJ5D3WXK+L6VMRCPU6CENltmVVdpx7fLrQWd:9JnJ5DGXR6ZU6CENlc7dpJLrQWd
TLSH
T12275D03DD2A810E4D4B7C274819A1795FE72387D2F226ACB24B4D5353F22EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 09523bcd52f0dca4627d52a017b5c07762a7bcec94c8c8c4c6fd7d332b688149
MD5 cef2df575ac6ad08f8a7fe692bb63f16
SHA1 aa9b4f7ba5b878ba289d22accde311d8bd415f9d
SHA512 074d6e8727e4ff27a0fd292920551f04a482a1e07171881847c188b6e0827a89e0351e372a7cf78e54b91dfadf0f74baa22f80f65a8b950475beca0aa01444fd
SSDEEP 49152:tg06DIKdwc+eQnSt65aVj6ZU6CENlc7dpJLrQWd:G969CEN6rV
TLSH
T14A956C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 3139b3c7fc18e031726ebc3a727031ca45f2b4f740ca0f66bb75dedb60c04b7f
MD5 7cbf70215d3d6692d6265650700df614
SHA1 1395926f549e4d89c9ae324806f99bca6dc9a79e
SHA512 51a97533244d6c028dfa0bccb7a9afbe9bfbfaf4a4e4cc3397377ff07eb72cd40fffd3d62b418ddfcac3395b5bde919233c70b1e241ec22b8bb61617606fea68
SSDEEP 12288:ZEP3RnG8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7L:qn1+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1B855022D57AD30E2D279913C85A18255D772F4B52B122BEF52A2D13E0E379F82D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 e3545c9b439188cb41eae002d44d229c584b46714775b5d3e9a9c5b7dc4738d3
MD5 bcdea5f508485e0f7b94dafe9c03118c
SHA1 667c6acb3897db7cb728b7c36a0712de497f1fca
SHA512 0c02e1005d0a805d031674a1c5d9c0564158d2ce5c721702c9df57ab18d29f26f2e1c44f365ab5e266772a58cc09677b91a8b161a29bab64c51905a12a54d38a
SSDEEP 24576:UIyh+L6VMRCPU6CENltmVVdpx7fLrQWd:UIB6ZU6CENlc7dpJLrQWd
TLSH
T15355121853982891E7F5023CD5A381E49E35BC616F109BDFA1A1F63F0F36AE46C36B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 fb3e994b7526cfa8b0571664fe1dc8faac338aa06c16a1a293e441f7c725f8f9
MD5 612bcb75123c00afd8609928390cecee
SHA1 154e322143df6ab96fc7fa3306b101375b59378d
SHA512 004913aec2c50f72d4795fe4d41cb867d2c928de224aafe3d87b89f3c64711154701aaee43a15ee3955c46006574e17b67e4e37a12f6d78267e328786987417a
SSDEEP 12288:Xys8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7p:in+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1F845233C47693D52DBB40278D1A295F1A5257CE52B006DEFA1B6B43F0F3A8F4183BA18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 022d8eb9162c1fe07b6d651adcdc637845c8081e9a307013de99d30ebd89f301
MD5 33772d103461f4aad21797da75189296
SHA1 35e78957092087b96c701f52aebb7762f0c6976a
SHA512 83427344f3bf119582918cc492f225d4544ae67233b2674665397ba98500b9e6012bf5cdcf2a87ef5b36264abfc45f9f40684eaaba075aa664ce212edfb3e285
SSDEEP 24576:NQ9MxZKdcz9dw3A+L6VMRCPU6CENltmVVdpx7fLrQWd:NVKZf6ZU6CENlc7dpJLrQWd
TLSH
T1E1558C2DABE9099AE177D23595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 78d4eaa7905e3a966a0656244d9ed628b8c274bdee99295693e2481fb7c6607a
MD5 0c53ecf6d0a7ca1446f5839cd7e8b701
SHA1 e6f4ebacf72226b4eae371bdf838ca365bb66024
SHA512 eb79b511d6565490f8746f7d232b5f12f47bbd14c94d7c30f6ae5891f33042920b13ef3ef9a43d090f798262ea7ae09381ad9e0455c5d5b20b95cc1a623b952a
SSDEEP 24576:fyocDApN+L6VMRCPU6CENltmVVdpx7fLrQWd:aocDApa6ZU6CENlc7dpJLrQWd
TLSH
T10E65E01FBB6E00A2E176813C89858255E773B4705B5257CB6292C33E4F379E8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 67a409b67215aa19c17c222b48467303b71d4ced13aea3b7230184c7fa26baad
MD5 0a894d8fdae4a25934539fc76560a031
SHA1 0196cae89fe983266ddaf0008dcc96766b0f8816
SHA512 6951ee444d8eda37ad7a218aebf1e22d4f91bb6d526ceae0f7dc22557ee8f269b1008def3cda50c84f5e6fff9151641fcda9e5db50ba33aeb0ff7cafc81e5ad2
SSDEEP 49152:2WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKa6ZU6CENlc7dpJLrQWd:A0zuNII69CEN6rV
TLSH
T1B1A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b926427153e6e8f4d9dd9e0d935a602da612b14c85120592054dd91d466702dc
MD5 4e24234bf59397883e23381eb7dcf26e
SHA1 6fcd1b80938d5a9da2b29d6c32cd53ccd2762f7e
SHA512 766294eb33664d0f480047a763c5fe32df7f334e14e95e2eb20044529b787bba99da35aefeade53e19ba0177f5e4d7c7dad47fa085dce8a38efb4b5e7fceb4bf
SSDEEP 24576:t1QT7EcpfxR+N5AWAz3ooiYtjMqb1+L6VMRCPU6CENltmVVdpx7fLrQWd:YTDxR+N5YzTfjM76ZU6CENlc7dpJLrQw
TLSH
T1C955B02EA7F915E5D1BE85789A23C512FA727861033193CF42A0C17E0E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/896-334-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/896-401-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/896-272-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1088-26-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1088-25-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/1088-17-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1436-310-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1436-460-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1672-279-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1672-285-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1672-287-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1672-404-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1744-269-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1744-321-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1764-510-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1764-318-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2356-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2356-181-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2356-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2432-322-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2432-516-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2540-251-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/2540-252-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2540-245-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2540-313-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3168-305-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3168-307-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3368-64-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3368-68-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3368-79-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3368-58-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3468-477-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3468-314-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3576-241-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3576-309-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3860-71-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3860-177-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3860-77-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3884-405-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3884-299-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3884-297-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3884-291-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4152-276-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4152-400-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4224-233-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4224-40-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4224-34-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4224-175-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4260-256-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4260-257-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/4260-262-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/4260-317-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4516-302-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4516-411-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4524-9-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/4524-0-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/4524-8-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/4576-232-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4576-14-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4604-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4604-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5008-335-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5008-366-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5008-409-0x000000000CD70000-0x000000000CD78000-memory.dmp

Download

memory/5008-517-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5008-398-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5008-382-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5328-415-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-444-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-423-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-422-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-421-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-420-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-419-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-418-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-417-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-416-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-425-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-428-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-429-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-430-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-432-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-433-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-431-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-438-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-439-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-437-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-443-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-424-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-449-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-452-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-451-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-450-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-448-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-447-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-446-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-445-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-442-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-441-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-440-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-436-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-435-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-434-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-426-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-427-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-414-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-413-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download

memory/5328-412-0x000001CA2A090000-0x000001CA2A0A0000-memory.dmp

Download