stealc | 8dd06154c063ae9865a62eca4316481b0dfd2234c79f0b0404ca7f60e92ac828

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 05:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
Size 1.2MB
Sample261002-f95s5aaa52
SHA256 8dd06154c063ae9865a62eca4316481b0dfd2234c79f0b0404ca7f60e92ac828
MD5 b1ddff6953995a594ad6eef86c46430e
SHA1 ec72c56e13052c9cbd4f2fb58d5975fb91cf4a5a
SHA512 d99e876d4eb26afb7331dcaa8baa19105b744b4a2479c02a1b87af869c87add29dfb332971bd0d686bcc13426d40b160df19dbe2f8bca0fd9b39984a33e3dafd
SSDEEP 24576:63WpRwENzlNhc5mVpKdwqrF+L6VMRCPU6CENltmVVdpx7fLrQWd:dImV0616ZU6CENlc7dpJLrQWd
TLSH
T197459C4663EC42E4F1F3A7389972855ADB72BC515B35C6CF0264561E0E73AD08E3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/868-26-0x0000000140000000-0x0000000140132000-memory.dmp	family_stealc_v3

Executes dropped EXE 22 IoCs

pid	Process
3152	alg.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
3600	elevation_service.exe
2968	elevation_service.exe
876	maintenanceservice.exe
4924	OSE.EXE
4256	fxssvc.exe
1988	msdtc.exe
752	PerceptionSimulationService.exe
1852	perfhost.exe
5000	locator.exe
4648	SensorDataService.exe
620	snmptrap.exe
2824	spectrum.exe
2640	ssh-agent.exe
3548	TieringEngineService.exe
4848	AgentService.exe
3840	vds.exe
4864	vssvc.exe
2892	wbengine.exe
736	WmiApSrv.exe
116	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7b216530a26b1277.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000534d4c183052dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000130c70103052dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9cf93103052dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd1e83103052dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074aeb6113052dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9cf93103052dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079aa6d103052dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3664	DiagnosticsHub.StandardCollector.Service.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	868	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3664	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3600	elevation_service.exe
Token: SeAuditPrivilege	4256	fxssvc.exe
Token: SeRestorePrivilege	3548	TieringEngineService.exe
Token: SeManageVolumePrivilege	3548	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4848	AgentService.exe
Token: SeBackupPrivilege	4864	vssvc.exe
Token: SeRestorePrivilege	4864	vssvc.exe
Token: SeAuditPrivilege	4864	vssvc.exe
Token: SeBackupPrivilege	2892	wbengine.exe
Token: SeRestorePrivilege	2892	wbengine.exe
Token: SeSecurityPrivilege	2892	wbengine.exe
Token: 33	116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	116	SearchIndexer.exe
Token: SeDebugPrivilege	3600	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
868	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
868	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
868	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3284	116	SearchIndexer.exe	132
PID 116 wrote to memory of 4372	116	SearchIndexer.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:868

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3152

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2968

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:876

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2800

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1988

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:752

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1852

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4648

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:620

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3760

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2640

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3284
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 50a73848081eeef959cf4a2a3f9cf4ba9affd4649d3cc89ad11d093ac155ddee
MD5 286c981c5d8e04e88276930690ab8a70
SHA1 8c1df6459ff2abedc2a54575f731d1c05a7d227a
SHA512 6ed7b9f01d2f721084f7df1acc2c0f706f4a28de84bbfeb8c612266ba1e65fea27bf6b4c7606969686870ef50c071c461fab15da3b7cb339ff1a1ff5fa31f02a
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnq6ZU6CENlc7dpJLrQWd:x3q6HjBJ69CEN6rV
TLSH
T130D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c4eaca065e8fb45df02da77a65b0ecbe7aaf8cda1fa309ddef5766665b22f4f9
MD5 abdf6f685d7854fc480efc91e7c63b15
SHA1 a3609aaa9cb0ff24bb8c648bee24362b05df485d
SHA512 880e0eeaf4e8d8f20a798830f7e691cb1ed270643c0cc3f012f09a46554032b34e3a8932fd7c0512af5c1a195015e017030daccca71a87767480224abc7d8efb
SSDEEP 24576:5XYfDtczAO+L6VMRCPU6CENltmVVdpx7fLrQWd:8tcU6ZU6CENlc7dpJLrQWd
TLSH
T1F765F12867E408F5EDA7427CC8A2C511EA33BC954760EB9F03B4992A0F336D85D3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 b7d7136398019149a5ab4fc2ce715b75d2e0d8d882dd129d8654f2c8789455fc
MD5 70b30d39415707b1b4569928e1a6f20c
SHA1 4dc0f7d863f1a51f4457d193aca3f16f78250572
SHA512 cf5570dde4172386ec7df90e6f2d31fd4e1fa6f7c6a1b915b38cd4e69e3fe4a3089093fd9d68e14e9ce77a0bdc94916509657c5bb28b4df53a57007f3a3dbdd8
SSDEEP 24576:Z0Le5ji0hmxirM1+L6VMRCPU6CENltmVVdpx7fLrQWd:ZPji0AcL6ZU6CENlc7dpJLrQWd
TLSH
T15D85AE25F6744731D073C0B9C5D2A69EED7230865B308ACB4286D77C2F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 25366c0e5352ad55e3c13705f3dc1c21b225dc80fd9e1f96c7eb9a64977ab448
MD5 37477027644aa1b66ff924318b30aae7
SHA1 f304de60b2680b1eebe7b2039f9ead0e94bc2cd0
SHA512 01b5ddc21c18f2e43dc8afc03eb18b079b331d81045e0f228e251a9697def34f388eda0696bcc29c1412de1b5f7ee3c4f51eca94308467fdfe31e3a43c049779
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWE6q8wyu/+L6VMRCPU6CENltmVVdpx7fLrQWd:F/ezSC6vUzPvxHjyf6ZU6CENlc7dpJLL
TLSH
T1C8755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 67db6ff618013dcb5bd07911516128674ecc5887b2e5784656b31bebc80d93ff
MD5 d1c554b895c393227e6bf54c47fca942
SHA1 75fcb2c679466569e4729b9455f52235c2c97b81
SHA512 6b28b7d7894b13950a7899bfc2910b85ab13a8a91934c9c38ac604128e14668f28ec049a4b72ed28ee9f763163b7df6df575868c084faac9594ffb4bb9505a08
SSDEEP 24576:ZVbqPb88hv/l+6C+L6VMRCPU6CENltmVVdpx7fLrQWd:ZVO88hXl+W6ZU6CENlc7dpJLrQWd
TLSH
T152559E66F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6fdf12c458eddf76923106f580e1952e96c1cb5bb41c42eddb2259802afb982b
MD5 b97599d41c6fecee673339b367d9cdde
SHA1 bd0de79b664e7a291ec0e1c747f975e9c1514103
SHA512 5aae2f43f7b983ccbceab6fe55a232b3c2b5549732c7bffbb2a9ebc254f76a06e3c929bf6ffe17e7afb79d2252f5d317072498bc3ca15926d158d5631a68bb2b
SSDEEP 12288:TRC8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7/:TRJ+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1ED45233487682D52EBF40238E1E691F1AD6AACD55B00AD1ED2777D0F0D398B4DC5B22D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f6a669cf4adeba84bbd5465bc6699a6749341e4c35a1e326197a78527d4becea
MD5 3eacbe1a1d92a5bcb366b7f321362239
SHA1 6ec2cd411581ea6fbc6f4dbe57b9da2297d49a2e
SHA512 61567441a2e3610197500ca2ea962ca0cf84440c3120bd4e6120883ff5e8b957cf15b4f84c2367b4b481122ca100d11a562ce8ff559154dec0eada720f8250d8
SSDEEP 24576:jJIUa+L6VMRCPU6CENltmVVdpx7fLrQWd:jJIUh6ZU6CENlc7dpJLrQWd
TLSH
T12D65CF3BEE28FCE2C27A4DB85A91C640E77278704F51A7CBD175820E8E235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 75a55cec9715e85645168ba4ade6c7e99a19eb7d0b1a894e3589ce8a207ab74a
MD5 64ac0f7f5c7592142cc5615ab90030e0
SHA1 bf5e26a70e5a6bbe0567b644a6026cd300131622
SHA512 efaf1da6dec9d77f77d65bceeb2727a7056832dc0759626b051099e12150038d1797bef1d505397b44fdc49d8ce8552a1489497f250a35b94fe68bd7272dc116
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THl:NQvGAdlCEL8c/yRNw5C069CEN6rV
TLSH
T12F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d7f9711615878ca82555d64a6cf2b6ebf6c7284f4cb9ca7e1ab04e0fba3a7bce
MD5 280acfee0d81e534fbbb331a2c3841b2
SHA1 9648663a208fc68f8ddbf4c8aa3274247bf1654f
SHA512 720e15a2bdd12a087ec4743e58f4139b759a770f434c906898fad8bcfd28d2ccbf06488c84cad70b19e356478c89ace5a23a74c85a25378effda6ed79f38d6e7
SSDEEP 24576:XdewsAjE+L6VMRCPU6CENltmVVdpx7fLrQWd:tlj76ZU6CENlc7dpJLrQWd
TLSH
T1A875E031FF74E432C3BB0DB61B36C716582DB9604B511AC3E3A89E9E49342D12776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 37ccc16e46a0883879d4973c06934c8b5a3a01f42f353755d9a063eac12422ad
MD5 2cb1efe74dbc23078a0ceec5de75c3d4
SHA1 b5fabf18350174536dcce3d1b64b213703e05203
SHA512 04bac4a75b32421d15fa5ca4e6e0f9a5fe722425830af149b5f2e30f25cfd7b872046ce1353270df7410cd6048d38416a84a8376c006d10f2f2c5ecd81c7408a
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHTIm:yUEtQevvqc2W1cpV2EI32E
TLSH
T142474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e738c498210fbedec208718a39033dc438d21b1dce08350a59e9a2f8fabdc194
MD5 d98886499bf60ea401288052659957cb
SHA1 991efac3274fabd4349b37371688fd174c567afa
SHA512 ae84e326b6c6d4a27277d49c1c424e9a45c0c390870b35b8444b557e84720e1197808902051eadd05c57208093cc04ee7e52286e5b7744df0dac0fac9b7b5d9d
SSDEEP 49152:dCbRquA/m2yL5zQfFiV+XenmE3/zb6ZU6CENlc7dpJLrQWd:aoqtVjnmo69CEN6rV
TLSH
T1F9D58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4266461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9d24d010284813ef63d5f931a05157b983b4fae099333c4a18b78f7f4f6e287b
MD5 4dc806d3afc6a6099e604c24f46d4522
SHA1 7e0ca9f0d09dc64eb4e31bc2d273cd169d7fd37f
SHA512 085292d55623d3a8bb5843913126cdba33770a1fcea6f8fb1dc0871d995fb2300c16dcf7c29bd5febe835116d5ca68519050bbdca7dfd3b7c6179e8f2ca3ecef
SSDEEP 24576:rAhGLJIFoiwtA5l7S537+L6VMRCPU6CENltmVVdpx7fLrQWd:rAMyFoiq5Y6ZU6CENlc7dpJLrQWd
TLSH
T150359D81E7F915D4F5B3AA7899B69171EA76BCAA5E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 53274a10ae539ed154f1031553dac10cf9543370b82dbabde1e44522236a119e
MD5 ccdfcd44b24f3ea1703652dbadfc3958
SHA1 3f9f3c9b7ee1a97348797ffdaff1f3aa592df1af
SHA512 cb8351c75a19b85447d8a21bb068d2b4519046319c31294786eb5b84a4bdec3fb91d5b4a6ac06a292f421d94fa545f71553d0ae54f990d3c0fec22b96009271a
SSDEEP 24576:YwuoOWg+L6VMRCPU6CENltmVVdpx7fLrQWd:YwDOM6ZU6CENlc7dpJLrQWd
TLSH
T1C965F14967A41CF9EAA74238C597C136F7F2BC422A21DB1F5360C65B5F37260AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e43b6fe9eed71b248f839bb891141c61e8e1b2d9180ad45ed823694e4e2bbca8
MD5 69916746d74eea3a04c163f596fe6b7c
SHA1 99d32d03a7cc98fab885345a837ec321df8df0bc
SHA512 0a201e3829ff5ab8327e67f4ec6e657e8b9108f2e4b0dfa0a8af65d13ac5ce041f1139daab40f68af6dc07b87f3387b3ff2ad33c55d01aca024faaacc8426613
SSDEEP 24576:kZuN+L6VMRCPU6CENltmVVdpx7fLrQWd:46ZU6CENlc7dpJLrQWd
TLSH
T1A855126913E834F2D2E2023CC9E29655E772BC96273147CF5276566E0F37AE05C3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ac05a627074555c2774e46722ebbb81cbdcec5257584072d4e90a4d3c330fc5f
MD5 5e22f8b099f0d7dd1ac151b104497647
SHA1 9c8b2820ab12ee5e2570bd7d65c1b9aeb27133a2
SHA512 80fe0cd67b7def6b0fd4cfe4b371549eee7194a3c34d97dbfc60b56b732f0d16ad6250562b1142a0cf6afdd7d25aab7dd54beac9571612b1241eac91f4c893b3
SSDEEP 98304:OQRQyi36YOcPQLvw2gAf+PN3V69CEN6rV:VQyiKayX+PNlIm
TLSH
T16C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a9ecb3898e9bee5dd5ed756edd3ace72455b0008d8d9f917052556b513b739b0
MD5 3585203e9f613f418f3c23ff2ab5ac7b
SHA1 1de2fe372f14ae82ed1d94ac161e19a99bb5105e
SHA512 75c5e0dcbad529e73735c9df658dc117626d921734ad22a5078c67702ad62b1de3dd34be175fd0b31aad9c5ff7f5bc574ff6a101d7e741c929f333bd0bde8dc0
SSDEEP 98304:vQRQyi36YOcPQLvw2gAf+PN3V69CEN6rV:eQyiKayX+PNlIm
TLSH
T110667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 27ecd9f6888a0d41a88c40f4fb81cf4f4f8c898ea0e67569bdc59bed4929405f
MD5 dbfcc9268cb16063e831c13ac88c6943
SHA1 fb5a8263c68aa6022fc7682d457d5f054de6c811
SHA512 99320cac80d88fa61bcbc0aacdf7c644d5a0c6bd12e1ea3b5b9300d6e6f13f6a8b76e051b6adad2129d352e7bcce3d8c5c6e7fc5f822b6a62aa0f7b263bac336
SSDEEP 49152:U68Qg55nhheWu7PNU3/L6ZU6CENlc7dpJLrQWd:+thWRc/L69CEN6rV
TLSH
T15AB54933B2F60099C44DE1769F4A872196D27C758FE0E7DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0cab5d4948375c14735490eb4bc9b53d28f2b011841aefb3961b971eb782c4f1
MD5 2aa7c3052f6786194b9eccd090a5cfad
SHA1 e62fe81972d39284179d9708c6b6178f654f87dd
SHA512 f31506a4b254f3d15c70ff28e37a31c08394ff62d508ffd9f716bc2bf7699453cd9faff7967353961fe23a91000d75c86c61a08cbf1d2ba81374641a6514ce9e
SSDEEP 98304:cy5112gYy5azzVvL69nLKnhZu69CEN6rV:dLIHmWhAIm
TLSH
T11A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 417b873febe318aa3839579c7d7b6f7b1cc8dc91befc5faff6c3acae39516552
MD5 cf79963623c6f44dd04e4ed62a16cd58
SHA1 f46e0fe9c786636e1c5d59e1b85140ddb05885d9
SHA512 fe5652c88024c81f1b4588ee8c9127ea6c5946dc72ce378583454bdfd398d155eed788c8bdec20ae958fe67b9a2e23eb39d1483653e04c9ee96ea1bc0efb162e
SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gld6ZU6CENlc7dpJLrQWd:qu6JmVxd2dd69CEN6rV
TLSH
T10DD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dee892adc7cd51644749586832740ab96f871512b61c41cef98bd64eb5fd7221
MD5 b018c325a354c667604356e7e8232a42
SHA1 626054b83ad4075a7eb2357efc309d1ec6320b19
SHA512 36799ec528396b0395a6a4d38de428ebc45fab029f1d1fb1b9876768ff5d5984602e1f5e1c80002ef8c9471632767dd64890a8d2fc40390605124444f5f7a904
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xB6ZU6CENlc7dpJLrQWd:jmifPbRo69CEN6rV
TLSH
T1CBB5AE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6d0713ff1bbe1233550309e97de6609b144f71efbaf26d0838b78eb83bb306a1
MD5 ff94acff2839e8afa265ae2ae660b356
SHA1 dc814aeccd01ef022758084c98dc822feb4a754a
SHA512 3df7b4e2b282cabfc89ea2c096c1e4680f1fcec47024b4b9a3508e0d82c801a32284426b85143a4315869a89711766a2b6b46494b4954490fa98ec2214e1fdcb
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqa6ZU6CENlc7dpJLrQWd:x5dKTi61a69CEN6rV
TLSH
T18BC5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5ee87037358253c7c9a22ca0d22054f416b531d25698dc18b241b27f97eb2bd8
MD5 b8c820a437843c88dc5001250c18719b
SHA1 f6374f5d14f83bfd3844e9d4f5f6c2ae0e79b487
SHA512 43a3a68c80a39ef9ea19f47d83bbe78294d25cf8d369cc973e77b0c1847801dd53c3620889f22a8df74b9c0c42b3eeff23116c5ff9bd5adad425f079e07921f7
SSDEEP 49152:8htSn8EApI0figngiDn0AP5wN6ZU6CENlc7dpJLrQWd:9X2iyphs69CEN6rV
TLSH
T12195BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 aab4a645315ff2027bddb9a76487a141c9bcb11974ffe655aa7dfaecbe9fd1f5
MD5 398feb178903509890fda0541f6a9b61
SHA1 57df691efdd4f11f9c75bd4c12011a9ef5559df6
SHA512 c0531060c24a11f051579cae24c0c1aaf5f8f8c030e39eb29a3b9984adbb0dc0d8b1a539148bb8440fb9241701be1f7859c652c324a6b3f40fb4826a4a2cbe8b
SSDEEP 12288:Ga8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7U:GB+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1F245233487AA1D52D7E40278D1A291F5A959BDDBAB005D1FF37B780F0E3A8B41C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b5115c03382375aac6e8180417f51b01056b1d94db22086c96aa0f15de4047c0
MD5 dad13b14da602c55b5f98feda7b5e9eb
SHA1 a1218c61e29259d08d4d1f762311e8037191db52
SHA512 0d7a766870266f3003b32928502c0386a914edc1e94de7836bd433d38a59e29b1f3c29902377b81eed9ab4e41ecd8b09cba4d46d03647a2280b27a84a23bd9d4
SSDEEP 12288:t78+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7U:to+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T19A45233487AA1D53D7E40278D1A291F5A859BDDBAB005D1FE37B780F0E398B81C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 aa18ed8d2f1886741e8f76d5c4003a684cdbbb90fd63c20b434d795dd33a0331
MD5 baa4a77faa79925e4e3a6c84f7e3675f
SHA1 78869536bbc45bd2d673fad34072e698c61cb152
SHA512 bae35982179df4f30253e74ece6fe4dd1a75687eb82515d29ba3bc35308503897a3e5cf03ff6ffbbe1e78d8e5cd3992fea308f6628c7131ca34978b6f78427d8
SSDEEP 12288:/B8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7V:/S+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T13E45233487AA1D53D7E41278D1A291F5A859ADDB6B005D1FF37B780F0E3A8B81C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 47fdf031801dc861ad211950b6d590e866f9bd21d80125c9e81a7b09cb95b626
MD5 6bd542ced3708f71903e0b39152c255f
SHA1 61c8a17ae63f65000d6b83d60c64b04ec3ef6b84
SHA512 b6621d08ec883d8b6cf9793b6860427fd6a38eb41ee26346894ba6afe88112b50cfe3922441b15255387324c054ca99265d37c854762ebf05e0ba2ede444e8c1
SSDEEP 12288:qV48+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7g:4+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1D245233547A919D2D7F14278C1A291B1FA75BCD6AB105F5FE322280F0E32AB45C3B728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 282c6250d3a48fbcee4238045092384b03c05313450d021f3efad81fe5ca17ca
MD5 31a6ac8ac38d572f454a1516d489cd94
SHA1 d03e3790a158da30372287124763afe30cadda1f
SHA512 e0c02261d11eb79cf5b6f76010f456cbbf355eeffe503711614e8cc85ca979721c49118ad981ec8bae27b14c905e8a24507c1cf79bc1917aad427806977ea373
SSDEEP 12288:NA8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb74:ND+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T10A45233487AA1D52D7E40278D1A291F5A859BDDB6B006D1FF36B781F0E3A8B41C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8212eb13d3e2f5dc038b49c8718d9a6ded02e6cd7c3cdf7210cbb15939769261
MD5 13d9a6582727ac4422e1401e3697a244
SHA1 237b25b8b57e054e28e7910e240dcc33e6279656
SHA512 bc84e7cb5079587d10b5292ad66b1be5c51d7ea1f31f0552b07257a76546a2c42ef17bc88424806456e513712320a45a574236c00569d20a3e14d0d1a2fecea6
SSDEEP 12288:Zn8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb78:Z8+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16645233487AA1D53D7E41278D1A291F5A859BDDBAB006D1FE37B780F0E398B41C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7edc1ec085b7292b7950f38d361fb84fe4ba84527e49b93f9ac7870c6577af78
MD5 e709b93e6de30f45b049eb2b08e0e163
SHA1 f22a12feeecc61bc4da7386309b49258eae7b9fc
SHA512 401ca51b996c5a58d492a88c9a8b9258f6a8d68ef47b09fe15faa448544b7ec4ca49a727a935605f0732ff573e1c0db5699f447fcf4d8d41e8648cf8520bbd3d
SSDEEP 12288:UD8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7U:Uw+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T19045233487AA1D52D7E40278D1A291F5A959BDDBAB005E1FF37B780F0E398B41C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d27a8fa0228e3b5c49dd6bf1925958ada5cc5a5acb10aae99d23e7f6d2932835
MD5 5c32478d217da08002ae49937e70f221
SHA1 db9421242ef942b9c61d9da7ec4b369454049316
SHA512 046c644376f77ccfdcc0220aa5d9ea9f77a397469911e6a32084ad1cc6f26b79248682560df17756315541752f2d574b9f4fe112bfdfc93d598b363c290d1fd9
SSDEEP 24576:DZMSzFVSOI+L6VMRCPU6CENltmVVdpx7fLrQWd:DZMSzfz6ZU6CENlc7dpJLrQWd
TLSH
T1216502A5B3901CF5EDA7423DC9658956D6B27C5A0B60CA1F13B5362B0F333A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 624b9f6254e1cc3e92b900dc2bb6f7792472fe58c9dc83ed5bbbea4a0f61b1f4
MD5 5ea3fdcd6be690d2e4c5b2fb5036febd
SHA1 30fe8922acaa232801aa5819713dafb2988de85a
SHA512 e5699abd77a169adb5a972970b95ac0b6c74e3201ca4f3e42287a4912a67a83801dab3b3676f2f727c0ad6665fb4703b3214ba2ac08597277bd9a823f8e8a1bb
SSDEEP 12288:zu8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7i:z9+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T13645233587AA1D52D7E40278D1A291F5AD59BDDB6B006D1FE36B780F0E3A8B41C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 be15ac99f79e1f2cd7b4be9b704bcde7fbaba0906fd80ea8b344fc4413c53f2e
MD5 ec09b672822bd186d3606e1217db352f
SHA1 82036721a9d3e6345bbbb94562ce0c2099d62aaa
SHA512 b6664a156029ca5239f721f7cc163a9731f13885f07d68401ad5b370ce9e2d6e1ac781a8eab8c0ec1ac05d2ab09b4a59c68f242ffaa2d8a7842001742776b9a8
SSDEEP 12288:3S8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7k:35+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1BD45233587AA1D52D7E40278D19291F5A859BDDBAB006D1FE37B780F0E398B41C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9c8f4b86ad1ffe08ab0f55926dce541542041c29360a2cb17aee887045ca4471
MD5 fceee0371a06b19dcbfa56e827d29cb1
SHA1 249f538c10ba49fa90b25f0917a59f18ae6b3586
SHA512 6eb03baafe99cad771e9efb331aafc7bff5d822c1eae8b7ac12f808fb952b4ebfbcbdc9074eb8043f969d1778a76cea4f79177f99fdc314441967ad2edbb74eb
SSDEEP 24576:jzy0+L6VMRCPU6CENltmVVdpx7fLrQWd:js6ZU6CENlc7dpJLrQWd
TLSH
T1B955021763A530F5D2764238C8A21A52F776BC761B209EAF53A4163B0F376A05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 049998906a9f5593cf1e742ee4e3c06453ef6468e629f81a4234bb515441e3c6
MD5 0b7b7bbe1786627b4eaaa16272a8e706
SHA1 1767372bf17b18b3ae53482c9667ca2d4d06ab06
SHA512 baa98ad784fd1ad5f8024d865d2621b74e16bb46923f684c2953cc132d54018b180ec6552170a3b73b556684bd5f13ca7b71057e1dd3b92bbb3b1e9692e7e33e
SSDEEP 12288:Iu8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7I:I9+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T19C45233587AA1D52D7E40278D1A291F5AC59BDDB6B006D1FE36B780F0E398B41C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7ce22d6a904fe54017374a181cefc486fd30736bb32a9d092a6177dd2c4e4ec6
MD5 1f25a2c340c9c6ea3e888fb2ccc80118
SHA1 fe55ca8394267398fc788da7117cc05053cb8800
SHA512 044c044c955b5c17cef7c5dd7661a023c213120c7881290168dddbfdeca0accc872945bc001eb7c693df8644cdec19245771724f5162f39c829a147615f21122
SSDEEP 12288:Iu8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb75:I9+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12145233587AA1D52D7E40278D1A291F5AC59BDDB6B006D1FE36B780F0E3A8B41C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 fa7f61a1daf245a92d525302c8dd09e86d9863dcf7a151944b2b4df30c92a323
MD5 dfc9a214489b3880d5e43319a214c637
SHA1 6e3dffb9c6bec12ee360c80fb79fed76f4995592
SHA512 922d21b22fd607c06da8c786b69f6ff273109c730ad71f4ea9132905c404c89cf62c600e23e15066a82647eda6476ca467b6f6759b3691096551b97257aa8d87
SSDEEP 24576:Xzy0+L6VMRCPU6CENltmVVdpx7fLrQWd:Xs6ZU6CENlc7dpJLrQWd
TLSH
T1E155021763A530F5D2764238C8A21A52F776BC761B209EAF53A4163B1F376A05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f41eb8b42612b5fed2e91a478afde44e474b0c9e60851eaceb14a38d899f3fbc
MD5 ef1291de1a28603031278941565fccf1
SHA1 f22459635da8b18dddb86d1cc97424862c6d6b71
SHA512 e28e8f540bb6bcf582f56d835f1b80261ef1a14e902bec4a564d8829b26eaff10af1f88bbc951f61e6b6c017599722843d6f14297fe643d1cdd6d9a3ecf8846d
SSDEEP 24576:ETHaLl3z0zDi+L6VMRCPU6CENltmVVdpx7fLrQWd:ET6LljE6ZU6CENlc7dpJLrQWd
TLSH
T19B650264B3901CF5DDA7423EC9668956D6B27C5A0B60CA1F13B9362B0F337A01C3EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 3e5fa8078718d23717360f3ee27051b2f7f6d23a661097f56ed61d772018f672
MD5 ab5ca49db9f9035b1af802969729558d
SHA1 3517545142ab31bec3b50901ede47e2434d17e59
SHA512 7e64e645459cbed20a2b41a4bfb73c8ed8de4c30fcff924b361f18d09b98740b303ad70f734e3e789bf0cab5523170f026f049e170f131e0411ab1e3d7dd0ac3
SSDEEP 24576:l37d9CHKy7GZG+L6VMRCPU6CENltmVVdpx7fLrQWd:F7d9CHKyaz6ZU6CENlc7dpJLrQWd
TLSH
T18475CF90F3E414E4F1B79A35C9768511DAB67C9A1B31DE8F03A4251A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3ad0a5ef2156b820d8d42c5e56cd67f77d7153f58c23379207dddac3ed9de5c1
MD5 3cc5c7f341b430fe35826543d4525c0b
SHA1 81659902de8a471f82d80b98b94da007f2d63781
SHA512 a2084281edf7d8a196bbd37293f217627d1c04599dc8c4f0f48ee6449cdcf6b57a3dcce7009e97acfab5aa56e0da0e880de438d433139c0c9bc6971befbb6bfa
SSDEEP 12288:xh8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7K:xy+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T19945233487AA1D52D7E41278D1A291F5A859BDDBAB005D1FE37B780F0E3A8B41C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 83d98964f301c96893bfc00f5c5b2d5da861ff9546b89204cd452f8890206762
MD5 c12572492191731e09d9a5eaa7f6f652
SHA1 f24f9ffbeaeb2f1d3335ae84edc9c1ebc65c7b53
SHA512 5ea4d4f028a11c195688abb64c68ec48003d338d5c6bb4fef90540c9389885d1d17cd83e99e449a7366068f7101804ca8d6b690bb0dd037ff5d6296bcef99688
SSDEEP 12288:T/8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7N:TU+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1FD45233487A91D63D7E40278D1A691F1A959BDDAAB005E1FF37B780F0E398B41C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 28af898d9949afbdf4c1a365ef1bec76b6332a99a28cfd2aee9e3b9204045be1
MD5 b9bf1847639fc20f958d02a58dfb34f8
SHA1 b44c48233957e9777e916f8c94a57a61140aa731
SHA512 32a1bdf3829f02e287e36323347337099def2dd4bfa116b80a8118af121c3c27a71449f60ef800b3bfcaa010ee2fcf2ae1f66d9c8c01979334f8802da9c5afed
SSDEEP 12288:os8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7h:on+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1D045233487AA1D52D7E40278D1A291F5AC59BDDB6B406D1FE36B780F0E398B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 848ff0d1efb0bd6104d86bd05069a3b2bf1af147f662ad5d14b7b9a736b23c69
MD5 1d60d1178a8dd5fd7401522e9ebc708c
SHA1 2fd4db2b10d6e47fc771dfe4f0664ec975fc77eb
SHA512 c16126acb8a51996129fbc27afadf954da4a37249f9bc84231de599e5b9367d1ccb11014324653b574604ed5947c968f12455a355a59587e5d909818141cd8cc
SSDEEP 12288:/u8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7h:/9+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T13445233587AA1D52D7E40278D1A291F5A959BDDB6B006D1FE37B780F0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 da6f1641166d4d8be327a800169fca6e404b0cb95e41ca7c80fd01d011ffe000
MD5 0d63a6c6bce9f3108488db396984f269
SHA1 783224aa951d9999f13af63b70f7fe9ab819ac8e
SHA512 861020933d513dd15e84804b7d291073074f3251ca9ec1fc46b0b32af53dd39330ef60fc45bb86454a98c61c955b609f1987c6369cbc9c403a7e9caa65bc50de
SSDEEP 12288:5Nsfe8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7N:+N+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1F755F019C39802E5C1AE2278C7928691B7337CA597E1D7CB62D1F43E0F366A05DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f230d4abe8a54e93b031c8d6e876288493e635f90debeaea0f0338528ca16833
MD5 5deb356754e6d7b51c27d516d1eabfb5
SHA1 daa6745b559f37bef0a77a1cc14af58e5a9e199f
SHA512 730fc42450adafc53ce37c8674d2c8c07d365bdd02cf4404b08ff7a0fe4be9b667e5371c00c993ddbb9aec6ac2c256c8c580f9da062710cf2e516fb5350c2d75
SSDEEP 12288:Is8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7A:In+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T14A45233587AD2D13E7F8127891A2C1B0692EBDEA6F009D5FF226751E0D398B45C2B31D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a4735e462044c2d267fe12433b87f11357b1954bc26211a8bc93c2da55f98175
MD5 940228b5993901eca7bca68160b7eca2
SHA1 c59b532a9877a31cae19926b85587ed76e0de930
SHA512 e006cd599a35333167d683aad733ca41eeab1eda6e7efdc9285eac67dcb1c2987ac9e8b135beb012c0665bc4d4781666f925261be238816e08f8d3cdb2027e8b
SSDEEP 49152:1a0h2GEkuAe73q3pp46zwwQW6ZU6CENlc7dpJLrQWd:1a0hNYG4JwN69CEN6rV
TLSH
T1CA85AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 30985079ffd39b970afab11e8866b861b0d62f86118ce09a7edd6941ec6b51ef
MD5 a54fa9572fd84f47e9d516864c1e04c1
SHA1 75f7eed1030463d2c0dc9e155d00e6a69d9a7555
SHA512 8c3e15c1e74bd142f64ae5e026320aa2e8686a6b936b814a438d584dadc7cea2f8f52e7c9fe561660690bc3773803e555f10a6bf00b56f2aa80023993ce7e64b
SSDEEP 24576:FhbHjPi+L6VMRCPU6CENltmVVdpx7fLrQWd:FhbHjR6ZU6CENlc7dpJLrQWd
TLSH
T1FE55123E07AC24D5E2B1A27CD5928546D731BC661B11A7EF6392913E0F3BEE41C3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a570dc16d51e11af199539f4d74769a340d151edf779c9b8f06c2f205ec1a588
MD5 985e3cb2dd680c14892097549610d09c
SHA1 b8c936d6dc517b1abc04fccf8d97c001002d6cb3
SHA512 88f9c538682d686fa03bf95903b17386361ee6a45bbccb9aba6519f92ca0d855e87192bbba63539959563198f952dc075f832fe1885f7a63e55f0ac82e66121f
SSDEEP 24576:83YgnJcRTk4yti+R5dBR/y+L6VMRCPU6CENltmVVdpx7fLrQWd:8IgnaTk46pBR/p6ZU6CENlc7dpJLrQWd
TLSH
T13645AF2DF3B910B9D8A6D236850147B5BB71782D1F209ACB0174C538AF1AEE85E39F1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 df375c0841481165f34c8e788b13e4c8755817c935098209200969482ca5b1d8
MD5 0144cb2dab049afcc548970e8d80c134
SHA1 6f02c767c1651a1fb0a97503a7a7faa702dc1ad2
SHA512 f6161f1edee0af6e9c2ff5bb6a1fd581d4c858c2de189b6281a45b19f4e2689a24c2c4e4954812ad341771c6d2e36dc4be789acc48eb9793bd46ca667833b2bd
SSDEEP 12288:BA8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7X:BD+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1E245233887692D52D7F41278D1A291B5A819BDD66B005EDFA17B781F0E3ACF81C3B21C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 81a15ee4441fb36ad9d9bd625e06197a40a6c03acf090d4eb1967654f4b9550f
MD5 e0b817f02eb64c72ca954e32eae08e2b
SHA1 b19d02146b9469a9db9eb2a4d4a9518fde73904f
SHA512 4dc80deb164bc6565dda61e182a108cce0ef96b9ecc0b85706efb3890f085b66bbf5ccf32a3de95339e442982df96f6e7fdf6963e3bfcd2228c990dd6bd8aa99
SSDEEP 24576:3pL3UTk+L6VMRCPU6CENltmVVdpx7fLrQWd:3pL3U/6ZU6CENlc7dpJLrQWd
TLSH
T15A750215E7A404F5E97B913CC9A28526E672B89D0760E7DF03A94A6A0F237F14E3F710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 4cc3f3b91d483cccc864c76b918a38dcd2408106138c40b04361aeb3c8dc0f10
MD5 88e5b3685d8caf9f491b56cb8dde1479
SHA1 e2dffccac8bfd053c50a2da2e0097a3c3cc239c4
SHA512 45a7486ae25cb3d53a28362548543fe90aad8ae0d0479b7e717274e33bde7f335d706833ce4e2d31e3ad03ac73a9c322a579832a7b439aad34ab041a52285be9
SSDEEP 12288:ypFtpOz8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7e:gOA+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T13555122927ED24E1E2B5613CC5938259D772BCA6171157EF42A0807E0F77EF86C3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d2111fb3291b72a5fe36e78ecdf98e1ca18369f1b50d9285023aa2406db128cb
MD5 2cbf5e8beb1c603b03c2c3f2fc57ed9b
SHA1 2df8d71f02e1e2b0e0fadbfb1ab5fd7962f05447
SHA512 327918bc4d2069fbea5cac985c95d192a6f42e0b16682cb4aa5fddbb83f33f2139fceecdc763e54a05748d1cb20d45eb82224aa7d5652e9d2819a39e1c25ca40
SSDEEP 24576:g7NM9YqZqmWMUkPjZM48Mv6bEhsX+L6VMRCPU6CENltmVVdpx7fLrQWd:g7cBWMpPjN8DbEhh6ZU6CENlc7dpJLrf
TLSH
T1BB65AE2E5BEC81E5D576D13DC9A28205F6B2B4611B318ACF1162833E6F37AF44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 31c0b13be221d34b44497ce8f9363a3713f74608c92a0fd15bbfcf53dd7341e8
MD5 23cb48b2bebb3f310cffe05190274a3d
SHA1 0228e16783e800ed7c716d2b232f4e833a176dae
SHA512 92c1b8eb333504f9acfb2794cc000a6668c6568029a92d4cf3450de532e7af1aa6d9f4afa6fc2764b0f95ca4f1c2221d37177a5d90b6584ff808f81cb2f8e1e1
SSDEEP 49152:VF2YuHNETovAvNYf8kms6ZU6CENlc7dpJLrQWd:w6BCf8kf69CEN6rV
TLSH
T156857E2927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 d859b99e3c06db778def8996d6f1d5197a643ec6d96a56ee4b51c1c0c2184135
MD5 e2d2c5fbd8313d502cfb831f7f67b259
SHA1 bb3ea22124d8b01f0b7489e3a6428888f164d679
SHA512 d1fef68da0daf4cfb30fba525aa18c7d7ddc7d89214aa3dacb1f2af69c4adeed8d120f0f7e3a9eb221c2a547aca7145a509edbf9d967d2aeacae0c33514ae36a
SSDEEP 24576:DAFs06+Omlf3NXEbTos+L6VMRCPU6CENltmVVdpx7fLrQWd:MFs060lVXu26ZU6CENlc7dpJLrQWd
TLSH
T12365AE2F67AC00D5D07ED17D8A97C91AF6B1746707215ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 dd823317c1365ece84b66f53c4452e9f25efd7f031170996c0eaaf51b07b7364
MD5 9d37ed424b92e686b79dd756f6e263f9
SHA1 bf4fd5189ab54af5f6ba8366a365506752ee97d0
SHA512 bdd3246fe9b001e64dc0f7a634eb1247d2bfc546ab5fc8a80e8e2d52cd3706091c152acb9bdc67e01b37535b7c1d150754ae1dd82bc9eb4ef11140dcd018dae8
SSDEEP 24576:cJnJ5D3WXh+L6VMRCPU6CENltmVVdpx7fLrQWd:cJnJ5DGX26ZU6CENlc7dpJLrQWd
TLSH
T1BE75D03DD2A810E4D4B7C274819A1796FE72387D2F226ACB2474D5353F22EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 58d1a4b02f85e8deebb85cec8be33e45dac2c0cfd7371672d39e2e6701708300
MD5 d2a9fe8f4a668c6cf0c4fa824780ac4f
SHA1 ea63bea001ebd89e6eb07e7598072c9014af9ac1
SHA512 c334193121b6ad917965f839bcb2fd6675f855b3f0bfe5e5b31e1342bbe88617819ec5ef28409d15aa21572d4a8e05022461350aba7d631eff697d7edd61faa0
SSDEEP 49152:Og06DIKdwc+eQnSt65aV46ZU6CENlc7dpJLrQWd:Hi69CEN6rV
TLSH
T1B6956C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 6c7d783bb953a275ea2211a6d3cf685a4db79b26f4e398690b259a20fd2f84e1
MD5 16477fe97f7ac7c1e2bb09f5e5a78113
SHA1 367fb62430e977b1a7f9d730a17a75373e6178e0
SHA512 d814194657817def9d2722e3ce630fefd2b2704b1f79da3ee2f69f291c656e749b259dd61276a1355af2064fe4f53955a52ed14fda9ca77f1b88f9f7cb2e1b3f
SSDEEP 12288:PEP3Rnu8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7Y:Un9+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12B55022D57AD30E2D279913C85A18255D772F4B52B122BEF52A2D13E0E379F82D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 689b4adfd79f4c2836933d4f0ea70972d9ad3ae03e512b5987cca685afdb7854
MD5 c240c88447d1249a086fd53c8e8e6be5
SHA1 de2cdf423c1791e72eb79d570c7b936efbfe70f3
SHA512 02b6d443eac894bcfeb607eba2303ff0f643c0625cdaa06d5460552963eec0920adddf177c5c0c920c69df571419aa05fe04eb4bea45e1db3c1202b8c08e3f90
SSDEEP 24576:XIyK+L6VMRCPU6CENltmVVdpx7fLrQWd:XIm6ZU6CENlc7dpJLrQWd
TLSH
T10155121853A82891E7F5023CD9A381E49E35BC616F105BDFA1A1F63F0F36AE46C36B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 b7184bc2d0badd6eebf63bf19ddb80ac54d8867c9c4b266e62a4a020286f95bc
MD5 53adcc024d3bbe4842bd1f5e6640b42e
SHA1 735c4a75b1a92c52d1250178fa8499f117ae333d
SHA512 c97df6e3de0816401feed91195fceeae0fbdce1337c1b9e984cb909affa5d2c2079b633a54400ce906ab961eb29806326f5aa3e68b77de921f01acfd81af4fe8
SSDEEP 12288:byj8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7s:GQ+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16445233C47693D52DBB40278D1A295B1A5657CE52B002DEFA1B6F43F0F3A8F4183BA18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0c8044c5942f8d1cf54b3d521e6082d7760a9f0a493aef14b614dc2a210d8f44
MD5 c30f4b973acd49da23c1dffa4b491723
SHA1 76552be7b06095188f0eb8b9d2996a1c7e26c234
SHA512 3236b2ef754027526d734df8dec8c7a10b818d6bae52222edc1c28dc19f986bd92468e4a046c23d5314566369af27e633012f402391bbaca838e0d1df239dd2c
SSDEEP 24576:IQ9MxZKdcz9dw3f+L6VMRCPU6CENltmVVdpx7fLrQWd:IVKZk6ZU6CENlc7dpJLrQWd
TLSH
T198558C2DABE9099AE177D23595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 0056c9f72a532f2b16ba39f7849eb53031edf2a469ec58d80706d2eccaa122bc
MD5 b4508e6aeb09eeaa573ad992e5c18242
SHA1 ad2190ca5a3a756356e3d067ca79f78224de521e
SHA512 e962f60bd764f0c68dd8a9a48d3ac2c569ca98611368dbf5a77afa8af9d6375a74a8ce58cfdf027732e8496626b103216447bc6fbb08604f7dee080976a8424e
SSDEEP 24576:uyocDApW+L6VMRCPU6CENltmVVdpx7fLrQWd:zocDApF6ZU6CENlc7dpJLrQWd
TLSH
T1EC65E01FBB6E00A2E176813C89858255E773B4705B6257CB6292C33E4F379E8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 34ae10aee944daad998b00ef49268aa7f5743f1626ca97f6b9b4f80db5a56cc9
MD5 bba2ee44b0935a94a1a3d925a1230bca
SHA1 9a1d7cfb00ffc204707aa2bdad523966a328649f
SHA512 0fbdee331dfd8b84eddef792be44f1d6afa6034f3f406e5d83a0fe510684a69423e742b5678b2419db5bfd551cdd35d79380fb0a1d610ed01b0a69dc4838aff0
SSDEEP 49152:PWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKF6ZU6CENlc7dpJLrQWd:30zuNIb69CEN6rV
TLSH
T119A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d66116e2c05f48229dc589ee65e67ee1cd4826df11253deaac919a84601f0a24
MD5 ef69f75e750805e61b3d8a835f36be76
SHA1 8c32dfa7458933c3e832179df28c82797ad2e177
SHA512 dd078ccadee96a0a39bbf66f7de7ce685439351712da9d9366b8cb26362ef29f960a71c6b9d3f5ac9938e72318518ad04b50ccceb27cfddf830fb1c82febabfa
SSDEEP 24576:n1QT7EcpfxR+N5AWAz3ooiYtjMqb9+L6VMRCPU6CENltmVVdpx7fLrQWd:aTDxR+N5YzTfjMT6ZU6CENlc7dpJLrQw
TLSH
T17855B02EA7F915E5D1BE85789A23C512FA727861033193CF42A0C17E0E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-401-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/116-329-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/116-483-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/116-333-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/116-412-0x000000000CD70000-0x000000000CD78000-memory.dmp

Download

memory/116-349-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/620-403-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/620-278-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/736-482-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/736-324-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/752-315-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/752-255-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/752-253-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/752-247-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/868-28-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/868-0-0x0000000140000000-0x0000000140132000-memory.dmp

Download

memory/868-26-0x0000000140000000-0x0000000140132000-memory.dmp

Download

memory/868-1-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/868-9-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/876-61-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/876-78-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/876-65-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/876-55-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1852-262-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/1852-261-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1852-319-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1852-267-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/1988-243-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1988-311-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2640-293-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2640-408-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2640-300-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2640-294-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2824-281-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2824-407-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2824-288-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2824-282-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2892-449-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2892-320-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2968-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2968-173-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2968-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3152-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3152-229-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3548-414-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3548-304-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3600-170-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3600-41-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3600-231-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3600-35-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3664-230-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3664-20-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3664-30-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3664-17-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3840-415-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3840-313-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4256-238-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4256-240-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4372-431-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-437-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-456-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-457-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-458-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-453-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-454-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-455-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-452-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-430-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-429-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-428-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-427-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-426-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-425-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-424-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-423-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-422-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-421-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-420-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-419-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-418-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-417-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-416-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-432-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-433-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-434-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-451-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-436-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-435-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-447-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-446-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-445-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-444-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-443-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-442-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-441-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-440-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-439-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-438-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4372-450-0x00000154E84E0000-0x00000154E84F0000-memory.dmp

Download

memory/4648-328-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4648-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4648-405-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4848-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4848-307-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4864-448-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4864-316-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4924-68-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4924-74-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4924-172-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5000-271-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5000-323-0x0000000140000000-0x00000001401D4000-memory.dmp

Download