stealc | 162d3806ae9fd480f19f55e22beef669400670599896493ae846ee54a143b773

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.1MB
Sample261002-krz75sec84
SHA256 162d3806ae9fd480f19f55e22beef669400670599896493ae846ee54a143b773
MD5 9216283f456db191cb8bb172cfc5dd14
SHA1 ce763637b27b35362f8430a65bc14f670b6adb43
SHA512 c57cd0a06f2d7a8481ed51d01da4065acd35191eff14a99c7b1f76e091538bbdb81fa90f18c1c93e0930faaa833322ed3ee7dcc2e979eec21d7e7ee7c3b83834
SSDEEP 49152:VTAtjNPJxkkevJKGUSO0xQF1Aae2yDJfEccfuDoUIMuT3jAR+IJk/wP3sZlErx:zH2adMmUsT8wvsZl+
TLSH
T1A9167B17A6B940E9C0BBD1798A579617FAB2780A873197CB4791471B1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/5480-41-0x0000000140000000-0x000000014042A000-memory.dmp	family_stealc_v3

Executes dropped EXE 21 IoCs

pid	Process
5548	alg.exe
5796	DiagnosticsHub.StandardCollector.Service.exe
3688	elevation_service.exe
3284	elevation_service.exe
5880	maintenanceservice.exe
4144	OSE.EXE
5804	msdtc.exe
5688	PerceptionSimulationService.exe
6100	perfhost.exe
4568	locator.exe
2184	SensorDataService.exe
4416	snmptrap.exe
1868	spectrum.exe
4692	ssh-agent.exe
1360	TieringEngineService.exe
5924	AgentService.exe
4132	vds.exe
5904	vssvc.exe
4304	wbengine.exe
5416	WmiApSrv.exe
2692	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\87225d4f227ba850.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\FindOptimize.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-journal	2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002962c704b52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009af856f4b52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6fa0f704b52dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000516d25704b52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001683bf714b52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2bd14704b52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3b4ce704b52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000516d25704b52dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5796	DiagnosticsHub.StandardCollector.Service.exe
5796	DiagnosticsHub.StandardCollector.Service.exe
5796	DiagnosticsHub.StandardCollector.Service.exe
5796	DiagnosticsHub.StandardCollector.Service.exe
5796	DiagnosticsHub.StandardCollector.Service.exe
5796	DiagnosticsHub.StandardCollector.Service.exe
3688	elevation_service.exe
3688	elevation_service.exe
3688	elevation_service.exe
3688	elevation_service.exe
3688	elevation_service.exe
3688	elevation_service.exe
3688	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5480	2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeDebugPrivilege	5796	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3688	elevation_service.exe
Token: SeRestorePrivilege	1360	TieringEngineService.exe
Token: SeManageVolumePrivilege	1360	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5924	AgentService.exe
Token: SeBackupPrivilege	5904	vssvc.exe
Token: SeRestorePrivilege	5904	vssvc.exe
Token: SeAuditPrivilege	5904	vssvc.exe
Token: SeBackupPrivilege	4304	wbengine.exe
Token: SeRestorePrivilege	4304	wbengine.exe
Token: SeSecurityPrivilege	4304	wbengine.exe
Token: 33	2692	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2692	SearchIndexer.exe
Token: SeDebugPrivilege	3688	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 5360	2692	SearchIndexer.exe	133
PID 2692 wrote to memory of 5432	2692	SearchIndexer.exe	134

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_9216283f456db191cb8bb172cfc5dd14_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5548

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3284

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5880

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5804

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5688

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6100

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2184

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4416

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1868

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5180

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5924

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4132

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5904

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5416

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5360
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 049402ba7bf522f502d9e08063b13e393aa54ad05202399f251f1bdf9f116c96
MD5 29a4341194973f99bc3f985e22ff83ba
SHA1 81d41e0e84a628dd50143249a349334757f56dbc
SHA512 303651456ac32a9ec3b5f55068f72f9b2ea14027924e715a882201c8868d05d9bbafedc4c4412c78d65ee84881a8b572db9e352610fa911b96db95cb6dff6007
SSDEEP 49152:vb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnQR+IJk/wP3sZlErx:t3q6tjBfT8wvsZl+
TLSH
T169D59D03F29900E9E06ED178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 e0f3086130a7ea08319d02b20201df1ec39dea43b10ec92cfc83a6b34d99c3db
MD5 dfdc3c69f80b9b8d887a1e455a653593
SHA1 934f8979fad1bdf36041ba88cda58aea70204db4
SHA512 3bb2503907cc79fc648b1c110a2963a81a395c5629e5dfe4c3bb5b4b1d9002a1890510978dcf727c069b28729f62617f3d56c51882966a78d9ccad7cf9bc6372
SSDEEP 24576:GXYfDtczAz1RDxYIJk/wPO4ps6EEZXH8VEtt7N:ltcKR+IJk/wP3sZlErx
TLSH
T168850139739404F9DD6B8239C8A28912E773B8964360E78B03F899661F337D85E3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 fe04067a02a5c746138681d4e4b79899a08f876b5a865831cf0291e159814565
MD5 57899bc1bf4928e864005e0d17afb06b
SHA1 76210d7c3a724537ce7a5acaea0a6d97035ff604
SHA512 6c8f3769bac6715469c4a7965d3b106b0c10f604b122e43ab3f3a4db6ccdebb97468df5d4dfa603f3c01a49b16484d29aaeda3a64e1f5f2c5e03c1368019ad04
SSDEEP 24576:l0Le5ji0hmxnrMC1RDxYIJk/wPO4ps6EEZXH8VEtt7N:lPji0Ax/R+IJk/wP3sZlErx
TLSH
T1A7A5AF26F6788331D073C0B9C5D2A69AE971308257308ACB4296D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fa14e53114080e4b9b365caaf8064fa91d7c79e93aa3cce62940ad196890cc1a
MD5 346f36f19933e5bc31ad3fe241babc0e
SHA1 17137fd6a5eb6bb9b01a976174b780543701e324
SHA512 516a7308a93531f04dd99382ae81a6641babe43da1012c2927b8678da98c8240b0ffdb9af7e606251739f3579e268b3f6cbb3c327fdcb57ac3e06e0f32c97450
SSDEEP 24576:ua7/ezSC6vUyDZaqgrvWx6q8wyuY1RDxYIJk/wPO4ps6EEZXH8VEtt7N:p/ezSC6vURPvMHjyDR+IJk/wP3sZlErx
TLSH
T15C755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 950419c41fa7b7e44613fbcca0d8ad5499a825c314c53cb4a9f8b9405e2cb093
MD5 8fcbe22de879bd333fea2ab10719dc29
SHA1 36b9f76a80173187b411a77858c50a90082b6c3e
SHA512 207c6450e914a2cb5afd91e51c4abaae9ee252d91efe022019a1a010e5f7c270972d9b699774f2b13eb1d02af51fc1e2b738748c8ef343cbdcade2f122df2345
SSDEEP 24576:5VbqPb88hv/lV7P1RDxYIJk/wPO4ps6EEZXH8VEtt7N:5VO88hXlVJR+IJk/wP3sZlErx
TLSH
T1A0559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 9428cdf3e71f35e9bec2fffea9c4ab0d174613393951b12b9041b1cbfcd63539
MD5 c06d0cf0ad1892182db95ab8f03493d7
SHA1 208b7bb2bfe93429c84126631ab6368eefd211ca
SHA512 9cd7c115de7029f775518f8ab0aa4704f503db7080a03cec34837671cd59c48154278b6b0f0e5a3b98fcd460d422ecef415daa0f40c2ba46f3f4e034f29bd335
SSDEEP 12288:eGgvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7Ng:eGu1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1697523B6430C80D3CE9F4F32F1A66E62A7B2DE97A094C901577D3847887CBD4ED6494A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 db82df923a3419d7e270e1fa1e63528f7b658d2d031a6295c429a0f0f0ba3f4c
MD5 efcbbbeb8d722c1b92282f5f82926475
SHA1 89a96b95404c09b286422dc7dc2bb687f392f489
SHA512 7a95e4e97de13bdb625711992c5430d799de3a844f516a901f41a5b007e19459fca989fdb3a13a57797cfcb223d279614ab2b9020d87daf12ec525204fd95def
SSDEEP 24576:/JIUX1RDxYIJk/wPO4ps6EEZXH8VEtt7N:/JIUlR+IJk/wP3sZlErx
TLSH
T17685DF3BEE28ECD2C67E8D7956918700E77278714B6193CBD178820EDE236E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dcf3dda7bfeb4721080e14009e389e28367257b3372c59ea7488d50681d0ab4d
MD5 26323e559969ca3c29b0354f3b848de3
SHA1 04f0d58b240f461ca3a5bb04d17d4f341934dcb2
SHA512 6369d8f3d9b92833f01c7420b95c33a1f49acb55722e3170a02a1c6e7bf8e6533de3f6f8335a09491b9c780a6fca8ad7f0d6872de091a58bc91af12f15558c88
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THD:bQvGAdlCEL8c/pRNw5CmT8wvsZl+
TLSH
T1E7266C656BF880F5E0A7E134897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 4568ce9d6bbfb32c600822634ac5614ac7018ff8f9176d582ac7516284362f26
MD5 10a3a7399b27742c8ed451a5d7c8125f
SHA1 d0ac2f5e885c3e329093a0b82e674d38cb8d8d33
SHA512 57775567ea94228cdb07dbd658254d5905740911c65025feb2bf010990a582537b4a32d15a5b3cacc96c3b390b3f9c444c0a0ce3d16b9ac91a2572367b459396
SSDEEP 24576:FwewsAj91RDxYIJk/wPO4ps6EEZXH8VEtt7N:OljPR+IJk/wP3sZlErx
TLSH
T14D95E031FA78D032C6BF0DB22B26C716147DBA614B611AC3E3B85D8E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a821dfebfbc05cc1791688926b0f0f0338c4c845f6952e1cf4838d14e0ad28fa
MD5 b179ac67f607fcb76002fbb74aa78ef1
SHA1 800eadacca7ab4d096e4b88dbac6867887eee01e
SHA512 0c62ee7dc0bbbc61f02424be164507c1854147d287e5e55ffde8253477d95b1b1bc575ae0a2708e1ff6ed0b2e3e1a44503d0add6db241f1d23298950917c3c00
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHh4wp:DUEtQevvqc2W1cpV29I32h4
TLSH
T105474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 87ac9832937530d153886e26cffbe65ab2477f3c0ee9a9100f27e1a08e3b085c
MD5 47c23882a312fac250c9b95fd0fea3b5
SHA1 27262b4f2f937e8ccd2f3047b3e3f73ab448a9a9
SHA512 fb95507ddcf3b36b2179208d3f21be0c481407bb5e2e60e9746d3eccc580e71a251fda026cef5f4554f7646d719d22eb797bc324dd4667c1d4b41938b2a848b7
SSDEEP 49152:TCbRquA/m2yL5zQfFiV+XenmE3/zvR+IJk/wP3sZlErx:soqtVjnmyT8wvsZl+
TLSH
T100D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 32a8aaaab0041d03e1e7ab5c2479d95f44ae752695423c63621689d1bbde53c8
MD5 1837b36bc43312fcc55f7ffe885a7043
SHA1 80924cf82f2ff48c8aa9fcee678d265bd90e841a
SHA512 699df684b8a94af95a1bc4e16c2ca388ae70a934a565b06b1d9e04ade00c506706cc5f4cc6f7201cb2ccdcbf490a2661aba355d34a8016f85b5411c24bba10d2
SSDEEP 24576:SAhGLmIFoiwtA5l7S53c1RDxYIJk/wPO4ps6EEZXH8VEtt7N:SAM1Foiq5+R+IJk/wP3sZlErx
TLSH
T10A359D91E7F945D4F5B3AA7899B69571EA72BCA65E30C20F2164D10F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 440c0291d568135e6bcef2bbf50ffb55ce3516e3144206cc54dfe657f2a2dd86
MD5 c6d680ca4576695eff8a7f54102b36f4
SHA1 269844ccd863678c1d4045b97c5f9510df065edb
SHA512 c649cc5378a8d19b2b793e30e37a03782c1024d742cfa605a82adec09de9a0f71f263d3ad481e20caa5885d96990befcb885811cdf68c91d7ae354d1e53273e6
SSDEEP 24576:nwuXOWh1RDxYIJk/wPO4ps6EEZXH8VEtt7N:nwQOSR+IJk/wP3sZlErx
TLSH
T16485F15633A808F9E9A78639C197C532F7F2BC422621CB1F1764C65B5F37361AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 ed67304f603feb22256376c55753e3a05bcf4e51e1ac54893eeade1703aea79f
MD5 f47d3c7bf5afc75c0ef221d6d4fc6f18
SHA1 40c56cf848cf110346eda80cc1a73ef9859048b7
SHA512 87e56bc55fe282bc80b521b561bd737600febdd617dfdb91c7a0c3ba43cc5c300fe4cc8ac2000bb6d00898b59f3a81e189a4ef8aa0b2f003066d13b77a92250e
SSDEEP 24576:KZuK1RDxYIJk/wPO4ps6EEZXH8VEtt7N:YR+IJk/wP3sZlErx
TLSH
T15F7512AA239C50F6D9AB4739D5E15A42E7B2B893637183CF137802571F36BC15D38B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 618aabfb92d87ffbe018166558bb2f990fddb072d447b4ec1c5eb1b2cc9ef7e6
MD5 9b380881dc900c8d32b497782b9b3acd
SHA1 dfd474ac22e7ea2c7f72d9f5a68ba0123efa0233
SHA512 e397775e40a006413961e474250ea5b68724f007c097f4fe0b40297c712bd556cd4fb2f8fc987fdd0f1b3294af6c1b46a7b84a0536b2ed63d34a670e66718895
SSDEEP 98304:pQRQyi36YOcPuLvw2gAf+PN3TT8wvsZl+:AQyiKakX+PND4wp
TLSH
T1B4667C13F3A501E8E05ED974CF3956229B357C4B8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 87cf420210618f3f25989c579ab155a0465cb41ed7ae18bc81e8359c68e06389
MD5 b468a21674c1238e9016a2d7271d9e61
SHA1 4a49ff764197d16961cc036d3e5ce58d0e961d3b
SHA512 6b5c68a5642855eb02f40ba33b8e668c299e52c765d5378714d6850d3e648f7ee9288d06efd153e01201d3dab84ec7abd87d0142afe9b23a5e875fec204c6058
SSDEEP 98304:kQRQyi36YOcPuLvw2gAf+PN3TT8wvsZl+:rQyiKakX+PND4wp
TLSH
T1C9667C13F3A501E8E05ED974CF3956229B357C4B8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 72c36b21570822841a2c804b10cb8794d84ee5effb33668203c4c54f323e2fc6
MD5 3411d5c521292c297ea6c9eb0d5a50d4
SHA1 abacdf112a695f96414da46dc68830f47e6889c7
SHA512 b1f10ea0d2eba2fadba299366b74789b3003e81b5130d7602c23eada053fd6610cad1b5de71546054301642a184cbd9ce4dc1badbe7d112e306c98bfb6cd6bd9
SSDEEP 49152:d68Qg55nhxeWu7PNU3//R+IJk/wP3sZlErx:bthGRc/5T8wvsZl+
TLSH
T1B9B55A33B2F60099C44DE1769F4A873196E27C758FE0E3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c24a6a210189032960b1495259326d499a440efe6c2ced89e8eb355b8332d9bb
MD5 b84c019fa638db6ae1ff3c08dc707c9a
SHA1 aa2addb6fe44cdb341453b8bb9931d820f3514ae
SHA512 6a8dffb44b4b17c8527705c4546615c423f2e9b06ff29add0323aea8289bdca66210c0cfc0b9a80bccb9cfbdf8f11ac307252f26c1f6e1d15194a6728e928439
SSDEEP 98304:py5112gYy5azzVvD69nLKnhZYT8wvsZl+:ELIH+WhK4wp
TLSH
T137167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5cc7074462ea52a49b5a9c642b72750f6d85c0cedc5c849af5c3640609bc0f10
MD5 80b30ddc128663819921872ec9943797
SHA1 26898d9f3e37aef9cbd7dde242a6371e74fc333c
SHA512 a3654ab13077d557ee1542500bfafd7874f5a3b29e557246a5832fc3bce0b798104ab04e95cb3ac12a373048773f4dc61ffad81d3edf070e67d1746d784be61f
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glRR+IJk/wP3sZlErx:0u6JmQxd2dbT8wvsZl+
TLSH
T18ED59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a3b4ba168d2e26f753aca9c77dd8f640cc1870bc9a434fd63509b212f3ab5875
MD5 2f7cad6b50f4a28d65608c61fe3e89b4
SHA1 8cba7d2caa53c4b81d9021a0de2bf9944f9850b9
SHA512 bbc5bce6357192a972398098e078ea1b44d4fef898c4e9ad4f2b65af7bb9eea70f1614d0ef059ce8b9797acf822ff6ae115e1dc29536f9ac49e9ac23acb15628
SSDEEP 49152:W1hpsNoJpF1A6yU44CwH7R4xFR+IJk/wP3sZlErx:WmifPVRyT8wvsZl+
TLSH
T167B5AE13F29900E8D05ED17887569632EA72BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6e68b09355df29245c0d648f77d6b4c3bd95b6861b3fb409e0fd7ff0bbd32140
MD5 5f784349923ee44bb2b1c370fde17f95
SHA1 b11c0b50bc5834ad32f36d3f1a73defd0c0fbd56
SHA512 36a626f85cce24ed1c1af1ee5992b14dd0939cc64e23df950c8c48caa30a615d59b059453cccd66b3c34df2604910972a1c3e2dfcf41a192b41c4d79276bfc47
SSDEEP 49152:KSuZQIY0Be2KIRVtOnks6NMHqgR+IJk/wP3sZlErx:U5dKOi61MT8wvsZl+
TLSH
T1A2C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 05fe593d4e86ee04e659110f0b4484d7ffad794a62a1e1c78c9d22605f3b7d54
MD5 84c8c2c24c341da464610e7cadbc2aae
SHA1 cce36e681869cdc402d622019cfbeb9a3e2524e7
SHA512 4aa523694f2f67e1bead119324dce3d10ceed69208638de3db2642afc03b4da14cf93856f9695549c7bf63179210212dc9f65ba667eac577740e2fd65775c4e0
SSDEEP 49152:KhtSn8EApI0figGgiDn0AP5whR+IJk/wP3sZlErx:rX2i/ph+T8wvsZl+
TLSH
T10695BE13F2D900E8D05ED174C7468632EA72BC160B34AAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 22b4c10aadec4fb1b7173a43dfb5a74b66c5c98a8cefc4df7538aae8ebe7434c
MD5 47a1f555cb4cd96fb98482d77010bf82
SHA1 f53c0698b83b3061c3fc84d0ae76603a6ce7aedf
SHA512 cfa46f4744cde6e9db9fdc3b4801021f2e36ecde81444eeeba64c39d2758200fe45ad0bfe417e9bbe0569f78311f92ff9d521fa4014d15b4a70cda44c36e8085
SSDEEP 12288:T4vX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NB:TW1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1A97523B6530E80D7CD8F8F33E1A26E92A7B29FC7B050C541277D24039ABCBD46D64999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 2ac5a636ac44b956c6d44c49d79e9ce312f364aacacb1304ff0bab76e333736b
MD5 a137391c424c27e25db47d1dfa479483
SHA1 df776df3e4a3c389882c22f1229fff7e84baf838
SHA512 e5dcf788a640a86398a6136760944ac66306b5dd5f3c96e264736e5d0384266b6a2cf7089ca059b293659034ed731765dfa502376341fe378495bf0583941522
SSDEEP 12288:oBvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7N9:o51RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1727523B6520D80D3CD8F8F33E1A26E92A7B2DFD7B050C541277D24039ABCBD86D64999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 57657b10624b1728b11057588d366207630907d7b57b9b604bf43a6ec173df5f
MD5 57cbadffe7b16f435259a3642c85a391
SHA1 ae04f6ac9e7a5dd4f7f2ffdf2eafda66fd305bf0
SHA512 bcff988b5898f81633bb4051ff1d55b0528ab8e9c237298608b2ded6fc497e69a9f4f42699c19deabf9e56a7b7fd2a208b2917130cd2ee7f858e931dcf76699f
SSDEEP 12288:ynvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NP:y/1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1567523B6530E80D7CD8F8F33E1A26E92A7B29FC7B050C541677D24039A7CBD86D24999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 8e7d85283ee75131d490c95a17ebf46d8bfe224da9c526f16b8725bbb619b448
MD5 65361371212934ec2f1824131f014b26
SHA1 11bc95495cd2bcc52079ac96704a98ece6e7b288
SHA512 4ef5d7447616f1ff9b8c72b30e4f7807d1cbf11a0e65c21430058127780ddf5337c273e22043bc825ebe4f5afc31be0a4283dcc5e584f178e093b81ef057d77e
SSDEEP 12288:OVWvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7N0:d1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1A67522B6231D40D3CC9F9B32E1A25A52E3B2FED7A121C68B572C28470E787D4AD34E55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 3f55862f0a9aab15fa0c304efb03e3e6d1ab9cec767d5ed77393f785710f6434
MD5 af3710b20e96e6e619bc765f1e775495
SHA1 71b69dfcb6c316fad0b7ef9e837e174d11aa03c7
SHA512 8ebdaf06b639a3ff7cb269fc93859a9dbfa53d3394758eb8fdfd04e31cfb6bc88b31291ead707bf8c741422bc95c55f5c70204bda1d2e29ed267597667a59be8
SSDEEP 12288:N+vX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7Nq:NU1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1757523B6520E80D7CD8F4F33E1A26EA2A7B29FC7B050C541677D24035A7CBD86D24999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 61e70ee6206a2d180ee80cf33dfedda4fe8c81bdf18e848cdc68087d14fd111d
MD5 4264a01457ea8037d22862599250f4fe
SHA1 8502131c149b7fc0fbf1bce8cc3f33cb6b17cc3a
SHA512 594aaf790ce116b4a3e215fffdd991cd3bf332fd0989e9de8e6c27b620df1d87c054e0bf1f8e1a500f1f966e3a0600f868a2d6bbb1c0c79e22c7d879f60ba0f1
SSDEEP 12288:rVvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7Nq:rF1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T13D7523B6530D80D3CD8F8F33E1A26E92A7B29FCBB050C541277D24039ABCBD46D24999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 ef53fe3c7499633bde4a317f5b887fadfc101baca5a386582fb0d06155556a35
MD5 29418287f595d282cf880588fa597169
SHA1 e9fe3efdbedf9858e4e04a96241cf7c742474ad1
SHA512 a58d934afac23c1752999c83fe9546a10e1c5f7ee2d6678a840497143a0fbf4d9835aed63d978c7afdb74f0b5248175e0d413196e01c78009244d0f653df673d
SSDEEP 12288:uJvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NC:uR1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1727523B6530D80D3CD8F4F33E1A26EA2A7B29FDBB050C541677D24039ABCBD46D24999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 20c7a7332325d73224b6a0277c44420f360724a4156676448490912c6ad9d48b
MD5 9e9a6a239621dd98d5f0990486566a0b
SHA1 c55ae05b7e1de9c2e0885746a61192c440963bb0
SHA512 1ca8a10ae4c7714d6b6bb2722a74c34a3c2fde8f87c578ea9688a62f9c116aa1890d2adbce0df66b4a9147e2553df61be007493ad3370882db7bae076b0fae12
SSDEEP 24576:0ZMJzFVSOZ1RDxYIJk/wPO4ps6EEZXH8VEtt7N:0ZMJzfXR+IJk/wP3sZlErx
TLSH
T16A8501A5B35408F5DCA7863AC9658902E6B2BC5B1660C60F13B836275F373A11C3DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 dd30899ed8ce8628dfb011399909741c4239d042fe866d3eaa48f59cd50a11e4
MD5 deb6d05e4f5b0d89a0735d56406308e6
SHA1 35668b9d96d97539ccc5d597df41d55369b0ea95
SHA512 96153e2cb6f54f3da06870a0ac05bad80e9c45d90d5901547dfecc1592e8a9944e8379678482e530325f9d4d9b3b41364fefb65898505390825432cea8d463c1
SSDEEP 12288:6kvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7ND:6a1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T14D7523BA520D80D7CD8F4F33E1A26E92A7B29FCBB050C541677D24039A7CBD86D24999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 c3c721e191287e85e8832ed15490faa0dac0c4261908a5734ec6ed4d7e6ed947
MD5 fa456e7d4fc0308a0c9b20c178246f92
SHA1 52581d374d541a73de6affe13ee589f19668bb07
SHA512 84ee30c20ca3d696dd5e59e619a49175f4369d68034963758b1b20ef8ff9721fe981ec17e80f8f3d9ae7ead301ad398e207c339899e0086de7796292c5018e42
SSDEEP 12288:IwvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7Nb:I+1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T13B7523B6520D80D3CD8F4F33E1A26EA2A7B2DFCBB050C541677D24039A7CBD86D64999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4d84f6cf5bab2db25103316581053be991948af20e447d6a5174e46aad6e9b00
MD5 bec1930524661ef5f71de67bbe763710
SHA1 541f8bdc24c126cc51043e55d781800a2268d988
SHA512 4b726afd049b40d389f4a4b8a23d49bc2b1504e10d85f6736280488bd028d49e7fcb2da8fbd6f164031089d87e54d4420bff6e7e2908d53ed2ca0686a4852579
SSDEEP 24576:ezyN1RDxYIJk/wPO4ps6EEZXH8VEtt7N:eyR+IJk/wP3sZlErx
TLSH
T124850267736920FAD56B8235C4A21E02F772B8775720CA9F13A806771F367D09E39B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 066dffc4979bb5a45eca66efe33df837751e0e41703901228fe13d1e14d65050
MD5 06de8ccd5db5918c0e850860053b04fd
SHA1 f0cbe6396def343e3e2acb21734b24b1d05ba371
SHA512 df0a1a727e2934c1c6de384ae50e4848f2ff97c11b342a5da687ae35d77e8941585393ea896e2915a64393a7312f33241fb5cb8fdd31c2de942b291c2892c454
SSDEEP 12288:2kvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NB:2a1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T19F7523B6520D80D7CD8F4F33E1A26E92A7B2DFCBB050C541677D24039A7CBD86D24999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 92bfc66312217c3b7778a5c61ea917aff864664dccd6e9c0698112daff7262a1
MD5 8bc900ac4ffb4fdb5273db6dd2730ba6
SHA1 37317d23e542343044730590524554f5c6f6c5ac
SHA512 08e9d1a36555ac95df25e9a625bcef0c7fbbfad1e5e498fdd9389211f424ac1c4e731cd352818811271f7781e526dfcab6240d7d6df2d067229b76ba122e4c25
SSDEEP 12288:3kvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7Nk:3a1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1387523B6520D80D7CD8F4F33E1A26EA2A7B2DFCBB050C541677D24039A7CBD86D24999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 ffc550c02e0bcf8080f0f60b230fcaad0c711113a4098fe7909d71d1a36374d4
MD5 7de88f9d5b67ceb5e08c22264989d4d3
SHA1 99b61b7e8431a677888577384cb4f31b6ef84a31
SHA512 4967837d34397e8ee4f13cc856e48ef1f11588e6ae26bb24512f2d356358165804484596883457a9aa886e56541dfb55c4f1412938c191029db68b2306b74e06
SSDEEP 24576:QzyN1RDxYIJk/wPO4ps6EEZXH8VEtt7N:QyR+IJk/wP3sZlErx
TLSH
T1DE850267736920FAD56B8235C4A21E02F772B8775720CA9F13A806771F367D09E39B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 62630e9e026cd99074b12152f4ff2139504d25f3dd9a3b27113950fc48ff81b2
MD5 a96d940318f809af63b6127bf5c2e559
SHA1 e0b6264718fc76d04dd0f485f7ef30f0f4be9622
SHA512 18ed1db4ee6c1599b1ebf18e09d26399cb711a1626215cb6083c7098926c73364dd62b0af538f8ff67b2938c954ea22bc22a6fb8f1a0f2f4e10038f56d54c124
SSDEEP 24576:2TuaLl3z0zDv1RDxYIJk/wPO4ps6EEZXH8VEtt7N:2TdLljaR+IJk/wP3sZlErx
TLSH
T1368501A5B35408F9DC6B863AC9668912D2B2BC5B0670C61F03B836575F373A11C3DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 13dd86a027e23bfa7172b5c6602805f83a65f5b2fa1f6efc220e6920c6891578
MD5 75d9340f5d1c099e6e5d6fa6180186d2
SHA1 21ecb2fa85ad092bf7daf9c65657cadf47c4b75b
SHA512 6efe703d68c8aebe12a5484ad17f6861a1def66ff83f3f2ef69f69576afd74fd7f48c078e9a7d39f52e2fb10d994fc581f8e61c7d2278fa2077c080eb5ae1eb1
SSDEEP 24576:+3xd9CHKy7GZb1RDxYIJk/wPO4ps6EEZXH8VEtt7N:Axd9CHKyaXR+IJk/wP3sZlErx
TLSH
T1A995CF90F3E810E5F4B79A35C9765511DAB67C9A5B31CA8F03A8251A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 8de1d2c7fe7de79f846dd8374c5e3762860d553f87b77c1fa07d2451561d662d
MD5 d958f2825628aeea10b2cc5c90ef142d
SHA1 e5c523370f293a817de017ef20ae8bca0a80620a
SHA512 38376038739a34cc918c7fdb2a20a2ab96b8e7de8fbeeabfdcbda15bf311e184ed1974e3bbe2c4c8877293d1d793df3b6061ed7abca89f6f9aa2cbec46fdf709
SSDEEP 12288:iHvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NJ:if1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1C67523B6520E80D7CD8F4F33E1A26E92A7B29FC7B050C541677D24039A7CBD86D24999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 c1f6e6839f873f89b51440a21e9024e32c5767b3a83cebaa4b391cec82828618
MD5 2d2c272f2837d7c44d4a2f1a45c42e94
SHA1 58114f333eb06075467619f8cc0739bd23ff42f7
SHA512 ee32074ac7d5c02e4d284efbfc9e7f6513eb8c4b611dec74477a9e24c640eea6af0b1514577f4e4f9e50af53e305fbeca37b8f7f8df59897e2e380c1db047c39
SSDEEP 12288:5tvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NR:5t1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1F27523B6531D80E7CD8F8B33E1A26F92A7B29FCBB050C641277D24035ABCBD46D24959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 673aec235c225cfae7461337dfd46a1c31fe3e753850f8f13d4344a12bf7b6dc
MD5 7ad4b9a9444d3cc8ec1a88297fab4b38
SHA1 0076988af488900060194e068a9c8ac5748bf393
SHA512 bdbe77135636dde47d0d0f5d11d230a7881fb030b5d1572d963a8368aea82be4672a539d97c256327e4a3b57f0986fa6945a63d6f6364697fd04b7dad886add5
SSDEEP 12288:CyvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7Nd:Cw1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1C57523B6521D80D3CD8F4F33E1A26FA2A7B29FCBB090C541677D24035A7CBD86D24999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 3a4a5f6448469b1b777ac2b39e11747725c3c0e016eb4ea14f719ab4f7cb756c
MD5 3d562a9c97e010640cf96826c9d45ce7
SHA1 033e46a5abc9b3c337aa4866471586763b32b84f
SHA512 f3dacb29f24cf7acf58a4f12fe0d32caf69c0faa6bb03ad7e53476180151043218a33e763dabf9b5da15e9b18ab88fe7a4fee1f802c78b5ae79e9437a9e419a3
SSDEEP 12288:ckvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NV:ca1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T10C7523B6520E80D7CD8F4F33E1A26EA2A7B29FCBB050C541677D24035A7CBD86D24999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 37eb6320e941552fde0ce08808dc2360b0af9d9eda568fdb7966a32d576ee9f9
MD5 7772ba6a667e82e9aba008770a2ead3b
SHA1 b361a17b814681189e09351d6186af507037000b
SHA512 71ee890918f2cf5ab16ae5401e597eb3c2c44bce0e0d8e4d8fd811f0179ab7a5c6f3ba506823db2b47d676d2d4180fc9f550f8da9948a2d7184ee38fa1fa61ba
SSDEEP 12288:zksfUvX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7N4:fK1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1F185F06AD25801E9C4AE6236C3965A41B3337C6693E1D3CB53E4F43E0F796D09DE9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 d82b089d67ba46a24391e85b9f52068e3531a5ac19c1a7b63e1baca9893fbcae
MD5 63fe05c2c76e93a5ccd496a85867df07
SHA1 9354f2aa2adfa042c73f0d6c7347e4213f52470c
SHA512 847e1a6a2cf58ee8c206d7aed85070b9d0392c5d7012089ef18215fe9f6eb70f03d575bcd00a7fc96f1a09d32f0202242a14302bbaf7decc54f1688abe002c7e
SSDEEP 12288:FcX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NH:Fs1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1BD752376930C8097DDAF5F32F0A29A227332EFA7A950C547772D2047597CBD4AD34A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1251d4e64d6bac75b8f5892749554696544163edd20cd7bfb8ce34dc93fda168
MD5 056719e9cab36bfa103787ca4e487f5f
SHA1 e3de15e3e4714cf71c5343a0eb7307e32e61fe9f
SHA512 62bcd4196320e3f0a7bff17a36e0aee55b16925eefdf5028983cc02680d5b30443f6be2a721f67bba5051ebd946056de1858597f9525d41883349ab7dd3d09b4
SSDEEP 49152:+a0h2GEkuAe73q3pp46zwwQYR+IJk/wP3sZlErx:+a0hNYG4JwrT8wvsZl+
TLSH
T11F85AE1E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 f3cbb4a6ff15143029342e66388d7b5468775f57ae1d55d3319045a14aa244c5
MD5 c872ce3bb692e68fa3219b13a0878dcf
SHA1 7173c3959e2fb2756f728c8d0da085dae78c1cbd
SHA512 da4880bd0ee7a786b8445b502ba2c7fb52b31967c2c9f4d93d3f4a047262445cb1165205be02d9b889a04d36890edc531c58f80bd809f132069ef741ecfdfeb1
SSDEEP 24576:BhbHjPR1RDxYIJk/wPO4ps6EEZXH8VEtt7N:BhbHjLR+IJk/wP3sZlErx
TLSH
T14375127E13AC10D6E976A63AD1928A06D331BC67271193DF23A9817A4F3AFE45C34F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 4398bc676735d65c7190019db2980bed66194e75552c24022a4b09807c71ece3
MD5 72fea4333a7d3d2e7fc0291a1a13b80e
SHA1 aec65b6c63757f4259c7c68528972bdb9a980d09
SHA512 0d7a0ba2fda698e18f351550510bdeed190543be57aab78e25a1fae420e2f91f01c438909e17c329ff3d6ef27ce98004dde1e71ea9d614b0d20438b3d8196062
SSDEEP 12288:K4X1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7Na:Ko1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1CF7523B6530D80D7CD9F8F32E1A25E62B3719B876260C6C3277D24035A7CBD96D34949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 b482c5805c394d9913e43dafc05f1ba4601166d09dd7b1ccbfe311672bf1beea
MD5 527c4ac4656e9081f963f6b1435b0df2
SHA1 30c4b4f15e166152810b7b68346070e4e113fd3a
SHA512 705c435867a85ac3317743b4f77c44332bc5a6605c8b2f4ce3dfe270ba32f744528e7ba8b0fae17e0b0331482f0bb5ca24df2bce4ec840d08c25116284c984b1
SSDEEP 24576:2tL3UT11RDxYIJk/wPO4ps6EEZXH8VEtt7N:2tL3UzR+IJk/wP3sZlErx
TLSH
T15D95F155E79800F9DD6B823DC5A29A12E372B89E1364E7DF03AC4A561F237E14E3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 7a091ab498a7d58bba2014a65e5104926154654cd803fd746d1035a4de1d0f79
MD5 a8075185f4502e1bd69a89189067990b
SHA1 3ea67d8a0a26190fead298bf9409ee81603e4f33
SHA512 461c1bf1c3152714e379592e494f2bcb16f1e208f3b647e73d25dcf4872409413a6eb4b1607f0ff57768b37a44370f135d6c5af172413f02a5fe126bf02aa5ac
SSDEEP 12288:OpFtUOVX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7N7:NOR1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T11675022A339C00E5D97AA639D192470AE372B8A7172187DF03A4406F5F77FF86C39A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7e11414aab40566a0c1fadb836aad01cf4bbe9ae830568fb9a595c951591055f
MD5 bfaa7ef8451350b0656703148e5be8c7
SHA1 f7689c5b93d1d3fa197848ef06d9f3e74f997fc7
SHA512 09a2b10f6217b1f82437a6e6539a93f3877e4a4e9833414f3c3a8a6da8896a90598cc373b25435924567b62d372c3783c722c22efe6bcda8a24f04c264e459cb
SSDEEP 24576:J7NM9YqZqmWMUkPjZM48Mv6bEhs81RDxYIJk/wPO4ps6EEZXH8VEtt7N:J7cBWMpPjN8DbEhtR+IJk/wP3sZlErx
TLSH
T12565AE2E6BAC81D5D477D13DC5E28606F6F2B4611B318ACB1262833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 bf6458a7171871d55bdb017b39c6ff85740dfd4f181305a26a5854f38eaf4892
MD5 49a81eade66c544bcd4d0a898a5459ae
SHA1 6fcb266a79be4c51a0eb924845137ba8ca0b187a
SHA512 7aa0221ca1afdb9362bcaf2ff8a4370e26ddeb516f82a44cb793519db0ab23445166821efa6507adae5c124a7592628de6d20726ea97431000c5a867c77da642
SSDEEP 49152:/F2YuHNETovAvNYf8kmOR+IJk/wP3sZlErx:G6BCf8klT8wvsZl+
TLSH
T179857E6927ED80A4E0BBD27D85B7D246FAB2B8511B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9dea4623c278cc6edd211d161cc7a9f19f6ddd8b37aec1747aefe828c77bbbe9
MD5 cbdc517641f3e1a809b3f0d85dc13a7b
SHA1 3cfaaba8db690718e1df6348fa07e5017ec35add
SHA512 24df63dc638da8ce01d2afb6e81ba858a20d673051a56781bc6b38e5b8c50345bf4a67b5455b272f61d584a6449dc5d1df32fc5d84bd6c4a3150d59613a2bbf6
SSDEEP 24576:nAFs06+Omlf8NXEbTod1RDxYIJk/wPO4ps6EEZXH8VEtt7N:AFs060lYXu4R+IJk/wP3sZlErx
TLSH
T1E265AE3F62AC00D5D47ED17E8997C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 f94247508c031af16955c042983c4122ae9161298ea4b0af92f869d0c12741c6
MD5 f7aec1e76edf09300cf1d4d06e0d5d72
SHA1 4a0703bb7f5be7fb66bd73fbe7e4fb0ebf2c442a
SHA512 906aa8074286484cfd638b6106df322feadddffae2a1be6c1887a430de7309e2909cd61d6f356c9a1690df29836e3a6edcefb8470dce33cc2cc87fadbe6c0ce3
SSDEEP 24576:JJnJ5D3WXS1RDxYIJk/wPO4ps6EEZXH8VEtt7N:JJnJ5DGX4R+IJk/wP3sZlErx
TLSH
T13995D03DD2A810E9D4B7C274819A1B56FF72386E2B2269C724B8D5353F12FE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 53c18d9a873bfd332c90027bb6001dcb5c52ce36a448eebecbcd9572ada65651
MD5 7c6ba1998f77141aa3f32bbe8aa459b3
SHA1 911206cc7c768dbd1e6e65c37b51b9c39834a50d
SHA512 2bff3e72e71c208735522498f83cde09a9a5f239332c74d79834ea555c7d83b7f4403123a5b1e74f78d93473e464eb6796c6ac4e9b26c4778ec1a00e403fee92
SSDEEP 49152:lg06DIKdwc+eQnSt65aVCR+IJk/wP3sZlErx:+wT8wvsZl+
TLSH
T10E956C16B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 4711e954a3a4f3602208bb9f8a8c35e0c468ef4a7b855d0a86bf8dc2d92004dc
MD5 970d66198970db55f6f1d20e0e177d6f
SHA1 eb6efbb2593c1183c45e85de84ff65f4d5ed9e3a
SHA512 fc05253c3bd4db795191ec01f48db022efc39aca0bc1fdf1013a32bc6ac1e7b920ce6e0735d865bd662f6beb03a578015e9a5d7f08cc7b1fce1d69dc60578a1f
SSDEEP 12288:hEP3RnMX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7Nt:Snc1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T19175127E275C60E6C96B923AD1918A41E372F0B2275157DF13A5813F4E7ABE92D38F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 bf513bf6cfdb0482441c8d6aca976b198cb5430ca2a039fb2f826b0201e34c7b
MD5 92811a3d3f544665f9602fe1a8d6a157
SHA1 82542a851322f126d541933f2c64269cad47a9ef
SHA512 279ee36e6b85f6132b94722ff7a6420879f3cbefe5704a8c62d48408d5699fecee63d3dae368a2ea57ff3d7880e2963437e0c5f6835fe9ba9c5e390a01602939
SSDEEP 24576:/Iy/1RDxYIJk/wPO4ps6EEZXH8VEtt7N:/IIR+IJk/wP3sZlErx
TLSH
T142851215235C80D6DDBA4B35E1A346919B71FC626B2083CF62A4B62F5F39BD4AC30F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 31cd6a9fdd3ffc88aec283edd8b30dd7fb836e83dea8c45ff01d779a23570a73
MD5 72c3ce21836420750d61d2d11e7a0b13
SHA1 68e54b50e170b7205e4299475d96c7ca6cdac3eb
SHA512 212a37f51cf8c9f7e6b6532f16d942c5a281dc9911dd13e8c3a5a11bb568dee4380f51acfb1076116ee660b7020757b2b67ecd9206cb414bf2e8668d219c16de
SSDEEP 12288:cyFX1RDV7cZcYIF8zggIk/RaPHu4psFME3k573VZtHL8zVEAIt7NC:JB1RDxYIJk/wPO4ps6EEZXH8VEtt7N
TLSH
T1E27523B9131D80D7CD9F4B32E1A25F92A371BAA7721095DB23BC60238A7CBD46D34D45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 27e4ef8552c42d0f427647071c590be2ca8eaadaf674ccda64d9d64eb5875950
MD5 d36038909b5dc76327a79173c9b47260
SHA1 3b341a826d0bf940f6d168507a728cf7056464fd
SHA512 17860917d6d48585c19a27bfff3a1f2a16f55bfc902ec678b72c08734e8478706256d14cb93ce5bf04e02eb6f10b777f0e409806a7d5dd8f319b02611074d81e
SSDEEP 24576:rQ9MxZKdcz9dw3E1RDxYIJk/wPO4ps6EEZXH8VEtt7N:rVKZmR+IJk/wP3sZlErx
TLSH
T12F558C2DABE9059AE177D235D5A250C3A673B4311B31C6CF2448D03D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 a5bcab9b3fd747a8da208fe051da5f921461d8a165b8c10cbab59b8a1d7374e2
MD5 5596db823b890546d3a3144c8b82644a
SHA1 1546cf2bee4025f39a20a8de84f736af2174482e
SHA512 281b62953c2d2fa416c35da94dca00578d9cfd9599dde90c4a38377a38490ed815e766e9fc6a85e2bf4c9b5a451b142f81d81e9049b275c1779b142e6c564cd5
SSDEEP 24576:RyocDAp71RDxYIJk/wPO4ps6EEZXH8VEtt7N:8ocDAp5R+IJk/wP3sZlErx
TLSH
T10485E02FB76D40E2D166823CC5858745E7B3B0716B6253CB6695C33E8E27AE8BD34B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 819368501f7de24f2e0d57ed21f244efa9c1e66e8de82b57c0496f5345e358ea
MD5 04c5a5ac9982f7a7b446d61fde73d3ec
SHA1 a94f8428124451d98acba5be347d36a7a8e16669
SHA512 e29ddeff4c8f7728e183bf0a9d8269a36ce1cd74aaa20624e2b65e426d5f13df79adf1011dcabb16a2122b2a4141bfa60184a83da859dbf6edbb4669058ac03f
SSDEEP 49152:zWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK5R+IJk/wP3sZlErx:z0zuNIhT8wvsZl+
TLSH
T1F7A57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 40f979199db49b601b528588527adcd8c7cc2a023cd36aabe3287239721f3e30
MD5 e22139ade1e7c478e789f5ba34980b2b
SHA1 d530d6caf58c94aac6aaa02c57692543f4c47717
SHA512 f450591dd53d460d4884bd05b89b43a9cd378fd30d168e089161089a5894d77a080bd6bedbe32058df23d6486b2f18a7259e6986af856bcfb42ea8fdfc64d358
SSDEEP 24576:L1QT7EcpfxR+N5AWAz3ooiYqjMqbc1RDxYIJk/wPO4ps6EEZXH8VEtt7N:2TDxR+N5YzTEjMZR+IJk/wP3sZlErx
TLSH
T1BF55B02EA7F805E9D1BE85799A23C512FB727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 db521d81aaeee4e6028a9d72dfcf9f30026cdbb42da5c49cee01ecbe3db5335d
MD5 7b1f271579d74a2527c34ae4366a5f7c
SHA1 f9497c7ed9c9532033a59a2e58e78e1060158590
SHA512 4f0619cf31e94cbcec3f15052149e7782a912a2335f8c1c70610550250e874de26604c4fc34fb323ddb35e6565710e7bc6d11071e4ef9414b1f461e9b6f3b38f
SSDEEP 24576:03YgnJcRTk4yti+R5dBR/p1RDxYIJk/wPO4ps6EEZXH8VEtt7N:0IgnaTk46pBR/7R+IJk/wP3sZlErx
TLSH
T1EB45BF2DF3B910B9C8AAD236810147B5FB71782E1F209AC70174C539AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1360-414-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/1360-309-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/1868-292-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1868-412-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1868-286-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1868-294-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2184-340-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2184-409-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2184-279-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2692-406-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2692-341-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2692-374-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2692-503-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2692-418-0x000000000D210000-0x000000000D218000-memory.dmp

Download

memory/2692-390-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3284-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3284-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3284-148-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3688-53-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3688-52-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3688-240-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3688-44-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4132-317-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4132-420-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4144-80-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/4144-86-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/4144-149-0x0000000140000000-0x00000001402B2000-memory.dmp

Download

memory/4304-328-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4416-283-0x0000000140000000-0x0000000140279000-memory.dmp

Download

memory/4416-408-0x0000000140000000-0x0000000140279000-memory.dmp

Download

memory/4568-276-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4568-329-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/4692-298-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4692-304-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4692-413-0x0000000140000000-0x00000001402E5000-memory.dmp

Download

memory/4692-307-0x0000000140000000-0x00000001402E5000-memory.dmp

Download

memory/5416-331-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/5416-454-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/5432-452-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-441-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-455-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-432-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-445-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-446-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-447-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-457-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-460-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-448-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-444-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-459-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-458-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-449-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-450-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-451-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-463-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-442-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-453-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-440-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-462-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-456-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-439-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-461-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-443-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-438-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-422-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-423-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-424-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-426-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-425-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-427-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-428-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-429-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-431-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-430-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-437-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-436-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-435-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-434-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5432-433-0x0000022F2F550000-0x0000022F2F560000-memory.dmp

Download

memory/5480-9-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5480-37-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5480-8-0x0000000140000000-0x000000014042A000-memory.dmp

Download

memory/5480-0-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5480-41-0x0000000140000000-0x000000014042A000-memory.dmp

Download

memory/5548-239-0x0000000140000000-0x000000014028D000-memory.dmp

Download

memory/5548-14-0x0000000140000000-0x000000014028D000-memory.dmp

Download

memory/5688-253-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5688-252-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/5688-320-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/5688-259-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5796-25-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/5796-26-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5796-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5804-248-0x0000000140000000-0x000000014029C000-memory.dmp

Download

memory/5804-316-0x0000000140000000-0x000000014029C000-memory.dmp

Download

memory/5880-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5880-76-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5880-78-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/5880-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5904-421-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5904-321-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5924-314-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5924-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/6100-272-0x0000000000700000-0x0000000000767000-memory.dmp

Download

memory/6100-267-0x0000000000700000-0x0000000000767000-memory.dmp

Download

memory/6100-266-0x0000000000400000-0x000000000067A000-memory.dmp

Download

memory/6100-324-0x0000000000400000-0x000000000067A000-memory.dmp

Download