45f5bdd9da1c2fc60ab93c4780cf180ba5adfda1f7b8580087efdae93bcecee5

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.0MB
Sample261113-ver14sys6r
SHA256 45f5bdd9da1c2fc60ab93c4780cf180ba5adfda1f7b8580087efdae93bcecee5
MD5 1631d96ed8f58b705a736d294204cb78
SHA1 1f8ed4233f5fe2bed7261e99a0351269065ef6d9
SHA512 0f46644d26df9f84f25ff63c89bcdf85844863b73ad69ab7f54442b4234fbb4751df5d6190412c2284a9fe00a99428e54da3803e0571e30fea9ce45415842792
SSDEEP 49152:9UVaItbsnUaFIn+Er29ac5EVyq6rQKUTBgcVHVHfYK2YTkVdIR+ft983Dl3gEe8H:kqGTB5tR+l9EDl3VxA+
TLSH
T17A167B47E7B940E5C0BBD13D8A579657FAB2784A877197CB03A0861A1F237E09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1492	alg.exe
4748	DiagnosticsHub.StandardCollector.Service.exe
2064	fxssvc.exe
224	elevation_service.exe
1096	elevation_service.exe
2284	maintenanceservice.exe
4276	OSE.EXE
4684	msdtc.exe
2424	PerceptionSimulationService.exe
2476	perfhost.exe
3376	locator.exe
1572	SensorDataService.exe
4304	snmptrap.exe
2236	spectrum.exe
3532	ssh-agent.exe
1212	TieringEngineService.exe
3816	AgentService.exe
628	vds.exe
2568	vssvc.exe
4852	wbengine.exe
4256	WmiApSrv.exe
4516	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\87920fae862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018c607ec8f73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004cdafbeb8f73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a79fe1eb8f73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca01e4eb8f73dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f1516ec8f73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f34d4fec8f73dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a997cec8f73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028d558ec8f73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074cc12ed8f73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4748	DiagnosticsHub.StandardCollector.Service.exe
4748	DiagnosticsHub.StandardCollector.Service.exe
4748	DiagnosticsHub.StandardCollector.Service.exe
4748	DiagnosticsHub.StandardCollector.Service.exe
4748	DiagnosticsHub.StandardCollector.Service.exe
4748	DiagnosticsHub.StandardCollector.Service.exe
224	elevation_service.exe
224	elevation_service.exe
224	elevation_service.exe
224	elevation_service.exe
224	elevation_service.exe
224	elevation_service.exe
224	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4516	2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAuditPrivilege	2064	fxssvc.exe
Token: SeDebugPrivilege	4748	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	224	elevation_service.exe
Token: SeRestorePrivilege	1212	TieringEngineService.exe
Token: SeManageVolumePrivilege	1212	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3816	AgentService.exe
Token: SeBackupPrivilege	2568	vssvc.exe
Token: SeRestorePrivilege	2568	vssvc.exe
Token: SeAuditPrivilege	2568	vssvc.exe
Token: SeBackupPrivilege	4852	wbengine.exe
Token: SeRestorePrivilege	4852	wbengine.exe
Token: SeSecurityPrivilege	4852	wbengine.exe
Token: 33	4516	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4516	SearchIndexer.exe
Token: SeDebugPrivilege	224	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 5092	4516	SearchIndexer.exe	121
PID 4516 wrote to memory of 3724	4516	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_1631d96ed8f58b705a736d294204cb78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1492

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3672

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1096

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2284

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4684

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2424

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2476

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1572

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4304

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2236

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2348

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:628

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5092
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e5f650bdbe62260415d3730c3645e626f2845189b62c558336534d8ee62e2680
MD5 30e92bb2fee2584bf0da64adfa0631f8
SHA1 5c87515f9072e95d80cee5a9657e44567680fec9
SHA512 d58654e004daaf5152b416bbc3965e1e6f48ded972ff6020677c05f368a497818e9f99aac2b0e872373ada4286b49f22a5b6fd6ad4104b85bc8cfaa4fe90a5a3
SSDEEP 49152:Sb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnRR+ft983Dl3gEe8xA+:03q6mjBeR+l9EDl3VxA+
TLSH
T1A0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 1927ccd9154bd384b03656b659e5c68a95e290bdae0b67ecead7fc33d7b8a6a9
MD5 eda4632ac6915349da6410d60454698b
SHA1 ee77167c2216c0dd1a566dc335cca9d2890b7cb0
SHA512 b641b2ab3c4239e3e6adedc9a14a7d840d19f311d928060e0cbdd479e951b480e1dddb04be1e9834e7112f71c2d48d41b7815ee5f9d53d237977288d2ccb2624
SSDEEP 24576:kXYfDtczAyRPWxNs298r3OCDIjG3gE9ow+8xA+:DtcrR+ft983Dl3gEe8xA+
TLSH
T18195F1287B9408F5ED6B817DC9A28512E633BC4547A0E7DB03A089665F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.1MB
SHA256 955daf04104849aaefca1cb68df0f5100cadf1744f297a607a000b6dc54ad04f
MD5 068f103bd113c3fffdefa1590755632a
SHA1 bb151208a369a30f02692bb814e8e537cbe10615
SHA512 942a024a5534970668c2ef3b730b53f8116bb790db6e91632ca6983d8d36753bf7a12840a6d47fcb4f9894bfec0bf468570c10c4b0e887890a7d9bfe15485556
SSDEEP 24576:J0Le5ji0hmxhrMZRPWxNs298r3OCDIjG3gE9ow+8xA+:JPji0AzoR+ft983Dl3gEe8xA+
TLSH
T14DA5AE16F5788371D073C0B9C5D2A69AE97230861B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 47c1b7229635fe008a97d880a37e9afd17d6362c742ccdf1384bb55de57a35cc
MD5 f4bed95756aefad861634b4022199af5
SHA1 a38343f0a135cac471ce26a1cdc436af7f0748d8
SHA512 3e4a6b4d6c3dc1f78576570a8074b23e7c605d72ef02f4b2b9da42c8184759d46d1340394ed00288d070c38b5ba7bb49ca4a9d7e0eb3d8327fe1e74dfcbb4f88
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWj6q8wyubRPWxNs298r3OCDIjG3gE9ow+8xA+:B/ezSC6vUzPv+Hjy8R+ft983Dl3gEe8H
TLSH
T1E3755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 86924e00222614e87e812b2c001bd9af818361ea06d7c3753b0c3f33fed90c4c
MD5 734f6b9a1e764e7d5c2f829c0917c119
SHA1 6adfa5f4d501fd3130d295ef08ff8493bf8b2da2
SHA512 9a39b39af5762e2b545c27962aa2143da1620f06d58a9cc5394e65fea8d6fc5a8995398f6042f3f9513ab64c88eff60cd523946f312058eaf178fa3380db141f
SSDEEP 24576:XVbqPb88hv/l+BORPWxNs298r3OCDIjG3gE9ow+8xA+:XVO88hXl+IR+ft983Dl3gEe8xA+
TLSH
T18255AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.6MB
SHA256 b19b3e2899c64544a9f1f5284a66bd8e38c7a1a517820654aa83b4e62d496def
MD5 da35c5f5f14cab65d778e60fdc876f59
SHA1 f81df3f8e6d6da731afb078a1fbce7c6d9582aa9
SHA512 767ae8b5dd536d243746af7efd60c8ecabf686669aa750b050d0939cb42d3f7dd8dbfd40b5a78554aecabe4f5dca48ec37622e2a231ff5a9efba27f2cbf8ee23
SSDEEP 12288:HGVRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:HGVRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T14F7523012C4C75C2DB2F81F9998AF0E2A1339D4D38F829F3D461AEA1AD7D25ED980177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 0856147c34bba19af17432a239cd947a080fc897f019d003304e5cd9d7ced5ce
MD5 59224ebfcb9b9649ac8548b728120af5
SHA1 2e988163a686adca173de7d1b38d30772e482af6
SHA512 99e7c9c6ad06f4dc5c8ead00d9d42b584da678fbc7a5e0af90ac8e8868b203ea339d1a7c6c2bb31de5b525433dcec42c34eac475cfd33763641835c104ebb4ff
SSDEEP 24576:DJIU2RPWxNs298r3OCDIjG3gE9ow+8xA+:DJIU2R+ft983Dl3gEe8xA+
TLSH
T13B95CF3BAE28FCD2C27E8DB95A91C240E77278304F61A3CBD165820EDE235E55E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2c292a0bee3243d1720fca2149bc28728c5aa4bd1bfd67cb17d97ca4eb50d224
MD5 f4f91043e703b79c47cc73f4b1db49b8
SHA1 16a51372a8e6b9dc2a21f167cb104dc4e195874a
SHA512 0d256e052e89ee08be1555a059fd862ac3ac05d0f2e8359bf57dad49797b02b20e6721e3e89cc7a2fae8badf05fab9fa33be9177d8726459a1d61e4c0e3b95bd
SSDEEP 98304:MQvGAdlCEL8c/WRNw5CLR+l9EDl3VxA+:xvyEYc/W3w8L4sDlF
TLSH
T193267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.9MB
SHA256 9c90745057bc44addf6743392f2263d1f314c77f8800a7813d892cbd67f7ebc0
MD5 623c9302cb0fb25e30872af2eed5aedc
SHA1 c5852ede6adb2045ccb4192ea47ec50dbc865784
SHA512 c803ce2169fca16ec0bdc7acfe098227a4c231acb8e7d4735f5b19dda3c404f02b7e0f1d97ce54c8a0ea20f8399c219f66ed2d1fb953a380170a7f64db2ebce5
SSDEEP 24576:ofewsAjYRPWxNs298r3OCDIjG3gE9ow+8xA+:iljYR+ft983Dl3gEe8xA+
TLSH
T17295E031FE74E032C77F0DB61B26D716543D79204BA11AC3E3A88E9E59342D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 760180bf7a9c55a22fc7def2165aeff0ddf47a348638cc0ce979b0d5a66c468a
MD5 0c98aada515a09b03ef5d4e4197c6a4b
SHA1 545b9b0fb532e1b5159f713d7be34b8e63b43500
SHA512 0b3ece3a97553783e31a403f6edd274866e90b164747c1089ff73763a281a8b3779a13f007c449de223ce53205e172e99fe0c85448f3da22e025943f20b5c369
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHw4sDlF:jUEtQevvqc2W1cpV20I32m
TLSH
T13E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f66c98998da235eba131f6bfa1efde814057151e66be45598dd6d07c3153fae1
MD5 41571ef3f3aa5e776fdd875466f0c0c1
SHA1 fd602044f0468fe0267b87fc6e7d38d17ffbc890
SHA512 4f976b97add3870b5552f80460e0cc27d6ac83964639ce25269712167e9dae031eddfce9ee711d73aeaca0eb8402279684df09dcf485d67c26fd10f1ee980f66
SSDEEP 49152:DCbRquA/m2yL5zLfFiV+XenmE3/z4R+ft983Dl3gEe8xA+:8oq2Vjnm/R+l9EDl3VxA+
TLSH
T174D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a28f2addb3591ddae70f8f55e4216d1e76f790c25d89d476e81d1e4593aaec79
MD5 7d566640ee76e4b42e440ec81a6ea538
SHA1 e514ba81fc3943c35f95019a13fe9dfa52354c85
SHA512 81beade0dddc60c8bb30a2840b152ba07e7cfa13779b20351db75e4a056b7a29a4cd415011113f1492b612b0c21be5ecfe3f9e732f3270c0dd30187a32a82d88
SSDEEP 24576:hAhGL6IFoiwtA5l7S53fRPWxNs298r3OCDIjG3gE9ow+8xA+:hAM5Foiq5vR+ft983Dl3gEe8xA+
TLSH
T11835AE80EBF955D4F5B3AAB899B69171EA76BCA65E31C20F2150C11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.8MB
SHA256 6f7f923c6a1d6eb6a890f5c80ece6936e72c7030660fcaf869df98644cefec38
MD5 9dc0a0ce31c32fe48d274398634dd7b6
SHA1 36690d8388ca18c9e4ebea53b70a2b6e42f48963
SHA512 b8146f66a125aacf0a205cfecbc06eda5eec9f6d444d43cadefbc225eac627c8cdf2b89fdb0a4617f73157f4ffd6c6319ecf5f99564ac0ca67c71b8e057a07ca
SSDEEP 24576:jwuROWcRPWxNs298r3OCDIjG3gE9ow+8xA+:jwSODR+ft983Dl3gEe8xA+
TLSH
T1E785F1453A981CF5E96B81788587D132F7B3BC022A75DB2F4760C65B6F37321AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 a0eb1c9fb9c7d2cc5de3b683a1ebcf9dbff47455fe5f5a677dda69a84de5e084
MD5 4672eab5e0148c4f0b464ea51b40c8a2
SHA1 f1c640254bac64c760b99cbb4c14ed53f63dda54
SHA512 7e1a23d32cde72abcedbdf60ea7d09be852445b87523c26a223d0cebf55084978aa02678276cba4e3e0dee06007095e2918384ea47693e28495c2d470f945784
SSDEEP 24576:jZuBRPWxNs298r3OCDIjG3gE9ow+8xA+:UR+ft983Dl3gEe8xA+
TLSH
T12B8512493A9830F2D66B82BCCDE59141E373784627B513DF542086A66F37ACA9E35333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5df114c583c59acd04e94f16d6b6cd59ce2c913aadbcef7d9a7b11278fdf0a4a
MD5 e21b14e708d7f34e2d49dd811d4c452e
SHA1 fe4c3ac7ef77ab0cf5d34db1117337905e34664f
SHA512 71ec003f1147473b962b266068ad296a0543af41e3b5d6bdef706f69c0fd2b30861d4907103834a553c7dc72df55eb2b5cea662c619e90b5aed429aec87a3410
SSDEEP 98304:eQRQyi36YOcPDLvw2gAf+PN3aR+l9EDl3VxA+:FQyiKanX+PNq4sDlF
TLSH
T120667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fac7e16da0b2aead0a714075ec647b2258ba6e7d34dcf08cd3b1334b5fb3d8c3
MD5 6bd08f8b3feec4835a4eed2c9a6522c3
SHA1 72a10ca51cc4d86d49e711bf296a0d2e3efcb4bd
SHA512 4f4c8193fb85c9e05de9db3faa11c8d2d95be12c1c8228aaa9f7ca7220b1fe648b90ea95d25e44925bd0f8259ae110e25f4f06924a8d88e60194d45c1ddf0aaf
SSDEEP 98304:OQRQyi36YOcPDLvw2gAf+PN3aR+l9EDl3VxA+:VQyiKanX+PNq4sDlF
TLSH
T136667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 90ae385eaaff706e577c33a1cea638d087c601f1021fb3a4715737842bddf1b4
MD5 46bf9a9ffc589ad8cfdf87e2c57dda41
SHA1 164d4ad69020f0661d357adc1673af0aed2f2cac
SHA512 e5b2a9de33665ee260b7bdcbd71c81e6bc58580c0a96c5d76b5e368cc4dd2f1a86e7aa2391940f9f5d09255163e469e8a14b63089da81580df2ceeea05f6bc4a
SSDEEP 49152:K68Qg55nhkeWu7PNU3/oR+ft983Dl3gEe8xA+:4thTRc/oR+l9EDl3VxA+
TLSH
T114B55933B2F600A9C44DE1769F4A973196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 252083ff4124043db7f9c3d35ca9bb3d1c655cd5e25f758e3a5214642cd6f0e2
MD5 8862b3e2b5a405d4fa1b1dfcd4941a19
SHA1 5d0f7609fe6e6201a994c12c2570a41107129d9d
SHA512 4939fa65d83fbbfd5920e483d90bc42027b5f26a4fd79db64124cfe2dfb82b13171b82b07db083bcc7a7b71df2baad1fce6896f74181506142b62fc8cf7e3f7a
SSDEEP 98304:sy5112gYy5azzVvU69nLKnhZVR+l9EDl3VxA+:tLIHRWhX4sDlF
TLSH
T1D3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 39e067b4eee141de50636b674b50b178ba0ddc78415cbbaf955eaa836d078231
MD5 bb7d0fda35683dce6f3cbd221fa46948
SHA1 cca1bce8144cae8cdc781d93411c93feec9e8896
SHA512 0436297827e044c14c4242a6131e168bda95103616f1e3d8ffe9415ed195c23f542377a0339274caaee900b62ebf5d7acdcd534dd64f723ddeba8d6449b08995
SSDEEP 49152:SB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glCR+ft983Dl3gEe8xA+:gu6JmIxd2dCR+l9EDl3VxA+
TLSH
T1B2D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 864b341fc088a838f94e2db8ceea07f08d9b02aa34d07fb42407563bb87e7ac8
MD5 ca75338242b748bd5ecd4e93373fcfa5
SHA1 551614012fe508092d88b2671dad623a7a3aface
SHA512 b201ecc1d816106578e98bbb107ce0d7f78730e7e4963b4ab3ff58d75bec7f1b79d7b93ebe23c8853da606e9c036ea2aec710928c52362555570f25dcf28c11d
SSDEEP 49152:B1hpsNoJpF1A67U44CwH7R4xWR+ft983Dl3gEe8xA+:BmifPqR/R+l9EDl3VxA+
TLSH
T1E4B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b2c59da7633f741c3a409ba3a8fd60fbd44b4cffde8db72ceb2203b335ce642c
MD5 8266f0f14af6b9a68a0016abc097a8fe
SHA1 e3cbe29ab22ca1866c5a140fa30b736226a3f48d
SHA512 c0b7b7cf0079a1ce80eb8390854a62ea956a328aa6a1eb0a06e5fb59221996e78f976cefad0d7fc9510aa1ec0dd15d20e8485dc40152a92c10ece735f98d6f49
SSDEEP 49152:0SuZQIY0Be2KkRVtOnks6NMHqBR+ft983Dl3gEe8xA+:m5dKqi61BR+l9EDl3VxA+
TLSH
T18EC5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5751d006dcf21b3f62911bd9a03b15a0ea93c1daa6a79613fdf297413689bbdd
MD5 81598ad0141df3fb3ab62cf067f80973
SHA1 05894458b7e3386cbd911e492bea0534c12c038d
SHA512 582cf16885f0a3229b2222ac8e64d59014b569b861833c897c757cdf70398940738bcaea889a4abda96bead45bd34d23405c35ff2461bbb44ad4030aa6be0141
SSDEEP 49152:9htSn8EApI0figjgiDn0AP5wyR+ft983Dl3gEe8xA+:sX2iWphjR+l9EDl3VxA+
TLSH
T18A95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.6MB
SHA256 80ad3e36c9fb726de2fb25d6cb2ceb7da31ab6bfa7f5427638c68dc0fb7f80d0
MD5 c0b7c924da91e5387619f3069fa0093b
SHA1 415a59490a5d3e3fea00a6fec4353c7c4271e4db
SHA512 cfeaf54eb91391a7f59a1b10eccca3c0dff1da86236bf166e06b96d205eca58fedbeaf5f3e1671bc5ebd67ffee4859847f87cc1ee54585a2bd30ea23b0ce76a4
SSDEEP 12288:w9RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:w9RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1027523043C4D75C3DB1F81F99986B0E1E0275D4F78F925F3E4618962BE7A25EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.6MB
SHA256 84b771912575130a98ceedf17aa979dbd5303651449775caddb1ba16c987a033
MD5 d2b8dadaf489c0362f8ffe40205ef821
SHA1 8f64a29900b3ff117a7721faacca819916b2619b
SHA512 4fbb58edb17128f8c3b9ce69574949f00a13b21d098039f170857dbe612332c8f63776fbafbbb6e7719537f92423fe0191fceef2b44f1944434a6f408b42de75
SSDEEP 12288:KURPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:KURPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1BC7523043C4D65C3DB1F81F99A86B0E1E0235D4F38F925F3E461C961BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.6MB
SHA256 e4d29d83dad93d5701aefae8f3ea1c82e344cf144da399a0f2feb001b87a824e
MD5 bc3d4ce7734e75cab607dc68d8cd7763
SHA1 fc38a689d2cc7cbe80774679ad26107ca2144acb
SHA512 e49f9189ea5a7133ea5eb12f7fb147cb5eb7bd48ab56082d6bf3250310a0f296cdff4901a5dec0f916dd25ff59a580b19d9cf08b3439f67ab2fa6a788afa0d65
SSDEEP 12288:reRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:reRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1B27523003C4D65C3DB1F81F99A86B0E1E0335D4F78F925F3E4618961BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.6MB
SHA256 00b1b3999dbd77abad6f29e1b9e5ab2116f80a9b4b421dbd73e0b56338a285e9
MD5 41a34f4c5ccccf0bfe1aea875799dab7
SHA1 2246eec5a85be260d0a5023e24e04fabd67dbdb6
SHA512 8f0e09d49fd821cd6194474844e056526090b6374663a725c58959ecd0e292886f71966a43247c3e1bc7449b4402a55b91ae8902ab8cf07f5ab9e90ffb761ee0
SSDEEP 12288:kV/RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:qRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1567523013D4D21C2D92FC1F9C986E0A2F233BC8E79B526FBD41049625E7639DAD60A76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.6MB
SHA256 60487ffd9b7ee889c4e78815c3003eb80b929154953e97e770b29269b2917279
MD5 843b9c83d509a2fcb0194c412cf143c9
SHA1 4befc0b442a0bfb02f7efbcdbef5ecd46715bbc3
SHA512 64d7f865052054c5f05667025fc82dfcd04a6653e90b942c7acbe9c05e21fd34f01f3cdd32f532af3fdbe160108f10338668ecd7cefb46e4e5fb197ae56b77af
SSDEEP 12288:a3RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:a3RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1047523043C4D65C3DB1F81F99A86B0E1E0335D4F78F935F3E4618961AE7A25EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.6MB
SHA256 22ffb76105327cc4be340263b842ef3b75f550f7c64d2cdd7b1399a822283276
MD5 bcf56faacde548bc886feed4983959ab
SHA1 709914a60f0072566bf2508d0e9e7cdb977167ec
SHA512 1c2f535afa14a2e2421575ba48a6a5ab0f55bf20e12ef35e1716d87ef71c39136b3cdad51e7a1419809308a7d70e9755569e7bc84fd5dc246e29776e37dde479
SSDEEP 12288:zgRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:zgRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1BE7523003C4D65C3DB1F81F59A86B0E1E0235D4F38F925F3E451C962BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.6MB
SHA256 ebda565469a3e2ba70e4692059b9cd14c019a43df17504f74fd6e1bd5568f187
MD5 968d92de802d9e4cf6d5119c5004a58b
SHA1 f4cf630ff7af2ecbbb036f892298e9b55bc0a059
SHA512 689f3893981accad2993ece8e0902f5cc439d1f95b451645e47f66837660719e0966e99ee086f35c0f26f47b0cc64f2bc95f56446f10e05d3da80c4e1a68ca99
SSDEEP 12288:ZsRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:ZsRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1EA7523043C4D65C3DB1F81F99A86B0E1E0235D4F78F925F3E461C961BE7A25EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 1ee011a87118acd759832bc4cbbb36b158b9fd78b276e1cd0711a0dc40a2edea
MD5 5466cda7552103024de8e0cf328f1b1c
SHA1 7c465e18ad86c430ca92e795059c35056e78202c
SHA512 e34f9127b9470ebc25db4a21c7dda81cb0375b3e2f91e0fade65cd728d68cf44cbf835122332e633c6ea997275273bdfa03400ade3c1bfe9c4e326141ade6d07
SSDEEP 24576:nZM3zFVSO0RPWxNs298r3OCDIjG3gE9ow+8xA+:nZM3zfQR+ft983Dl3gEe8xA+
TLSH
T119950194779418F0EC67817ECD559912E2B27C4A1AB0C66F03B036675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.6MB
SHA256 bcc6785605f352ec69beb4083e672576a637a99c6a1ad65cd145037ffbc0e896
MD5 80bc05bc1993a3ca6bd731197100d509
SHA1 856fdf0a93da1b5aa0533288247adc30c81198e4
SHA512 f0e8a35c276a62bdfd3ee64c64ee3aa2d96fc4cc78a30be1aca79ed7a9648788609fd51f7db809d2471ff1bf7bc55b79abdf7af4ada57be704e4a17b1850d860
SSDEEP 12288:kxRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:kxRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1F47523043C4D65C3DB1F81F99A86B0E1E0275D4F38F935F3E4618961BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.6MB
SHA256 aff903014e728ee11745e5bb5ad32598c0d9c9d28897e72110e0bf61d67aca02
MD5 5b97162b47354f3904f40f6211c9405b
SHA1 859b94e6ad1bb7c017a30aa2aa040dbdecd77925
SHA512 b1a7cbce0582ccb399a8ce867ca88a0b2f20db5c6bfbfd70c1bd7354cbae78d9aef514a9e50b0073581fb45878b3b15f9e4e5a5cb0270c44cebe1d6b38fda0ac
SSDEEP 12288:oFRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:oFRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1047523043C4D65C3DB1F81F99A86B0E1A0275E4F78F921F3E4618961BE7925EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 ccd8ef3e4a26ca0bc0700066ba6dedd5242bc8e7cbf09731ef6a217ee47e4eab
MD5 577e5c9f0e1a1ab0cfe50bdba926e7a2
SHA1 4344416480e8205524cd33d0490dac9f9f85f2eb
SHA512 508a0d5f0885ab1c9a299b4ba9d6a4365f0995ea9f0d52f02aface9b80f66a92f1a927e29a17efd9ca4be74c2755a516aea6b390ebd2cbda73ecf8312960e6f7
SSDEEP 24576:pzyIRPWxNs298r3OCDIjG3gE9ow+8xA+:pjR+ft983Dl3gEe8xA+
TLSH
T12D8512073A9930F5D13B8278C8921952F372BC361B749AEF526046722F373959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.6MB
SHA256 1caee8bc4820f3df58a46dde47f45765458b97e660ba4b44089dfaf5b01bd9be
MD5 c8329bc4574dcf243f6a8fe097cc1b0f
SHA1 0e3129307af6d4ac13e342a3ce4faf92d1404c85
SHA512 b6d7f790dcbea67598cae573cab3f13b7cfa5908331a368c3ccf731a499d8a04895d930c33e032b3141466e30813a6670ed9486b3263ee59fd3f766d3743ca25
SSDEEP 12288:+xRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:+xRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1D87523043C4D65C3DB1F81F99A86B0E1E0275D4F38F935F3E4618961BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.6MB
SHA256 51e67fa845d292dd9cefcd9cddf494f45e041d4ccf0e67cfbb663eb04e2fa9b0
MD5 03d1705a9c9374bf48bcd3b9cddcd200
SHA1 82f3d1535db2e328f90d30826682c1021c2ee221
SHA512 dd985304470c800d1ebf354e9625d32400c69f927dba68afd8524ddaf9a4bd3d6724797a97b58c2336be6369d4f95966807cb5bc50d93bf2f92b7e8d2ad2e4e8
SSDEEP 12288:AxRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:AxRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T17A7523043C4D65C3DB1F81F99A86B0E1E0275D4F38F935F3E4618961BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 e3888727701ffa3100832513674f81851123c8826fa984974951d0e798bffcec
MD5 643aada03cba6ffe9ccfb2510bc61e2d
SHA1 93c440e867f41d293cac78811cdfa1ecb245e742
SHA512 e99b9ae4359a265ce90b35647ee52800233ba0e8efb573bf1f7e00cafec6aaee8cc5e5705d575e06d89e39e83e9eed0b43f11f8333e481157639ae8e0098b41a
SSDEEP 24576:2zyIRPWxNs298r3OCDIjG3gE9ow+8xA+:2jR+ft983Dl3gEe8xA+
TLSH
T1288512073A9930F5D13B8278C8921952F372BC361B749AEF526046722F372959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 ab6158d458356e030163f8be7dfe5ed000f387bcdbcd714280c91bf722a52557
MD5 25afea2e330ac7c46c9a485ab5f574b6
SHA1 55d7f83a54a492bbe34f19b6c07dcaaa41b59512
SHA512 43a02a755a74c32d752a128d49efcfafbc88a00c909162c2e308ecd3d7685364b5daf6e3dda36743ea37de4064b21e079300ead02e1e782c803fec8f34b6f942
SSDEEP 24576:gT8aLl3z0zDuRPWxNs298r3OCDIjG3gE9ow+8xA+:gT7LljbR+ft983Dl3gEe8xA+
TLSH
T1B2950194B75418F4EC6B817ECD569912D2B27C4A0BB0C66F03B036675F333A15C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 4b2f22cd799056270342b7058d3d1f6350be885d134c52a1207643a152ec051c
MD5 de698afebcb16fb70708e107f6d22b45
SHA1 822681f7d4cbfd13d3748b144f0add669695007b
SHA512 2f1f61bd08ad0bf64365a8c9e79f668d7e7c06322968e6b678c12510d7a4f9c9b48600c093020ed016b3c76ea9cd9f86cb398a2b59f94ea5b05c13e4d68fe199
SSDEEP 24576:b3rd9CHKy7GZ6RPWxNs298r3OCDIjG3gE9ow+8xA+:7rd9CHKyaQR+ft983Dl3gEe8xA+
TLSH
T143A5CF90B7E810E4F0B78A75CD669512DA767C5A1B71DE8F03A4261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.6MB
SHA256 1df63ec995d43547663c7d9708435c091a375569030d6099a8aed3728d877013
MD5 acf649ecdc29de3fca178b46ad2e6d2b
SHA1 8bbb5ed9b072f58bc58566c2846bf11e1f5d5cad
SHA512 c936a32b20d25caafff2270bf28ca36fe7c814cde2732a34f095008bbe097c5660d8f3226329c9370016d0b7ac9fea2000cbaf07ada176e1bc55a26086487eaf
SSDEEP 12288:y+RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:y+RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1147523043C4D65C3DB1F81F99A86B0E1E0335D4F38F925F3E4618961BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.6MB
SHA256 89ed2838373c4d3dcd3ee9bbaa6e704a47f3a841b9a17eb2cd68c166fbe544e4
MD5 891e03f61304f28fc0a604f414485582
SHA1 1f469ba161b17e8b613cd7dab3747b76ae321863
SHA512 afec36721848d933d582ed549cf68fd030778d4b654433092239f7f81d626bb527c823c345b10fead32339306d2ce94a32d2539ed2477a366b7c38a0adafa7da
SSDEEP 12288:zoRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:zoRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1877523043C4D65C3DB1F81F99986F0E1E0235D4F78F935F3E4618962AE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.6MB
SHA256 f1f4d81b0169d0c96bb14cf89176292e6323d8b7bb6366b7aa1ccbecf8835492
MD5 33e22be6237fee6769e523ac86810b8f
SHA1 8a8200042c39e0c066b2857fa62e72f635b02536
SHA512 641c5cd8e6b93b3f2c0cba6fbda116e8f11f9fe73ebde07da8c24dd848d7f88f5746f06315d1cde484cc66f3a7f0228a854825324ee921539ed7cebf9ba8593d
SSDEEP 12288:8TRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:8TRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T15C7523043C4D65C3DA1F81F99A86B0E1E0275D4F38F935F3E4618961BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.7MB
SHA256 59965dcc7f016aa56389c8ba01a2f9deb25496deab9e048f55d4dd3da06c14c1
MD5 afa7742a2aa2568173bc06e64db0dcd2
SHA1 e5bc4a2a6d3de84b4d6a56112ccbe9284f4179df
SHA512 991f3998b2c76140a31804f47768e83f7180f3abeba989bbe310c8d19efcf59be65e15d7d01b2ad973080d22ef18c03d6f363f38c8ece69b5136c76451241b5f
SSDEEP 12288:0psfBRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:lBRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T12E850109D68812D1C02EA1B9CB469641F3337C1A97F1A3CB92D0F93E1F7A6949DE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.6MB
SHA256 bd0f5d8c116a499c93374ee0b9f7d633b31963da302b6f8d4e81aad32eeefe20
MD5 8f382944a3b20917e02fab8b74ac1996
SHA1 f132ecbfc58ccf6279c21b415e20921990bfa11c
SHA512 18ad16238dfdd8f0738350f84c8d55a3711b8cbd7fe298cd96ff46d3ec5b574c18314349644c0c0334af6f444b8a27e8965075c124fce9cb501ff6bb9471de92
SSDEEP 12288:8iURPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:8JRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1AF7523012D4C79C3EA3F91F4598AE0B1B03B7E4E3DF465E3E4108A61AD7969EDD6012B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1fc8493ea646af3f5223bb7fb03353aa400ac2de0c7bea4a2c7bbef69cd1e719
MD5 93161c57ec0d6545c7a26fdb8ae73997
SHA1 d3f01c04ffd486d184570a844c92f51205162083
SHA512 bc27338850036261e2dee939efc025ff76d674510b121948e868d69c8c4d07b95dee38514b98b59cd226fc4cdd1161860cdcc986aaaad7e2dabbb9fd76853087
SSDEEP 49152:Aa0h2GEkuAe73q3pp46zwwQDR+ft983Dl3gEe8xA+:Aa0hNYG4JwoR+l9EDl3VxA+
TLSH
T15485AF1E67DC82B1D0BAD278C9A6814BE6B2B4261B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 1b604124963506b6cb125594a5d2ddeabaa294cf7a5847b86dc259d31ccd1b9b
MD5 17d578aac12f530da7ccc0a04c7f971a
SHA1 9502626dbb917b22169310e3e8489e738d36e190
SHA512 7e1cfdefa248b984b0a5efddb05954b7f82ac09795643c27fb62dc9d93777f246c1de8071fda0e1ef3a7443b853de3822fb3d106c082d19811e026d582f4a45c
SSDEEP 24576:dhbHjPMRPWxNs298r3OCDIjG3gE9ow+8xA+:dhbHjER+ft983Dl3gEe8xA+
TLSH
T1D485123D2A9C20C1E636D1BD85869146D332BC1A276163FF62D1827A5F3BEE95C30F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2cef1f4b4cf98adf4bcc3df27abbd542eef29c054490413c01a6dfcb9863da90
MD5 9eacea0a63039e25ce4f130e4a0e4425
SHA1 1e5801d90721571080e9b82eaaec7d9127985980
SHA512 549e985033bd07c30fdee144947985f81c0889235e4fff624b623d3c5e5be2fe64c19a73a9a5348e3b22ec73f2c6281385f865b0a05c1ad00c3223a8360f8173
SSDEEP 24576:03YgnJcRTk4yti+R5dBR/0RPWxNs298r3OCDIjG3gE9ow+8xA+:0IgnaTk46pBR/0R+ft983Dl3gEe8xA+
TLSH
T1F545BF2DF6B910B9D8AAD136450143B5FB71782D1F209ACB0170C538AF1AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.6MB
SHA256 cbb017fb3f4409ed426a34a765f9101752011df06bf5d8fdae08230daef10b4a
MD5 14cda4716c8d54ded2f78dc1079e1bc5
SHA1 ef890ba25301dd1fa7433c39f1b8568421729dac
SHA512 c89bf9e1dd5511228b6ab483e5b9da59d5ad1855c9c56f51e19c21b2dd2c0bf2cd831c23cf9d9d83f276dd097a342d127293de9a8a0b3996de8f1457ccb5d883
SSDEEP 12288:2eURPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:21RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1497523042C0C79C3DA2F81F95986F0A1B0226E4A3AF536F3E461C561AE7A6DF9970177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 2ca4b6ccf6ae113747e03350e2a44d644cebdc4dcb77306ff525906a83820a3e
MD5 2b3b22b2e91c268945e5b67c0999f668
SHA1 89ca0004a0c9bda0117dd1e02958f7d482d714b7
SHA512 fd440c977515948ba0f5af336b4b67b5726c2bffc8404cd254f194128ec30d54697251baa58aa3f21a53ab32e5a440eaf082df204be09a52ae60701d64b5ed19
SSDEEP 24576:BAL3UTWRPWxNs298r3OCDIjG3gE9ow+8xA+:BAL3USR+ft983Dl3gEe8xA+
TLSH
T1A6950114FA9800F5E97BC17CC9A29512E272B84D1764E7EF03A48B651F237E64E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 8a4b1e8a419a0b75dc7ad050434c533a082e45c57924765b5052eacd0f25cbfd
MD5 dbbe045ffa20d7bc0527b6ee93e08f84
SHA1 34d1af9e923568ee65c03f65c4735c9b45be9dcc
SHA512 23f29b53b2b97b65d29d824d65e27703928b566e971524335c29192798f8364ca9c448001b9e9414b123240fc82ce9f4c99790b23649143b0405e6fe33a5733b
SSDEEP 12288:cpFtvORURPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:kOyRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1748512193ADC20E1D53A917C8A829249D372BC56176223EF41D081BE5F77FFCAC35A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 430ba989d29b4c6d32b718be8727015fee2a7e6920d7e29412979dc7371f195b
MD5 0da6f83f5cb239948976cf6a1641f02f
SHA1 391197d59d7c8b88f2128fff97cefb84034cb469
SHA512 a572408489f5a551a04791aacf70ba3ab2287481b1d11c1589d886d6d1dea0ba20c14ee4e0338732a052589f3aa3de29ca27b1332b253c944a313f25b27d7e43
SSDEEP 24576:G7NM9YqZqmWMUkPjZM48Mv6bEhsZRPWxNs298r3OCDIjG3gE9ow+8xA+:G7cBWMpPjN8DbEh0R+ft983Dl3gEe8xF
TLSH
T1FB65AE2E6BAC81D5D577D13DC9E28206F2B2B4611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 272112fb3894a7c08868ce9dca11749581816abb73d9159c5ca70808a31effce
MD5 940603d5503907726388bf905cf69234
SHA1 b9aca765905f0d7bcf97783cb1628eb768bbcda8
SHA512 de7190db9145fa3584451d4858031968890bd49092c9427468dcfe996b1b727961668018b39fb446a18316da3807052ede8d067e95c4277387454896151518c8
SSDEEP 49152:BF2YuHNETovAvNYf8km5R+ft983Dl3gEe8xA+:E6BCf8kyR+l9EDl3VxA+
TLSH
T12A858E2927ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF4255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f8c0f1f74a0cf25216e25c8cd28491f1b808a5fded93387b64fe76705c07b293
MD5 273e6e69dc8c78bcb784c0754788bd3a
SHA1 f6443c9c208b129e92f65116ad97e7664800dbca
SHA512 33d12d1266d6e9ede4bca568369b22883ed8f83e18b87eb68ca8bfd2351b5e84f985dbf8174abf425130fd40d1f2e6242b3dd45f88a7eb3f31fb1c17299078cd
SSDEEP 24576:UAFs06+Omlf8NXEbTouRPWxNs298r3OCDIjG3gE9ow+8xA+:ZFs060loXujR+ft983Dl3gEe8xA+
TLSH
T19065BF2F66AC00D5D07ED17D8A97C91AF2B1746707256ACB0160C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.9MB
SHA256 30c2f54b2b187dbd422ab08527ef0a1b2858ac5649491996fd4b8f9b6b793b38
MD5 2708f41b079557b5267fc241ee6354cd
SHA1 1be1045f2bdc82ddab044ae78b4583e73d2b55a9
SHA512 fc32170c985e7e24992e672e3bfe0b0bf9c5a0434573cc9fa500ad9b259a2931628916c3f55ed7ba910ef0cf9ae8d72494ac9ea765b2b19125ed3255daa42b42
SSDEEP 24576:7JnJ5D3WXjRPWxNs298r3OCDIjG3gE9ow+8xA+:7JnJ5DGXjR+ft983Dl3gEe8xA+
TLSH
T14695E12DD29810E4D4B7C2B4819A2796FF72382D2F226AC768B4D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 164afe7694fa54ff30de5c7b36820a4c6fd1f77db5023dbf4d2674ba9a00d880
MD5 f189aef68ce8ef04c5eca9e6e2fca255
SHA1 ddb7888b2a4b3c672a5da91accb1e081a356ac9c
SHA512 9ad30d3d3056fadd852007a643cb38d3d266e2043bf8fad18fd340521c58724a713c28f59ae2de23aed5ef12aab379b4f46b4c88acbde72fd88a9f47b964aeee
SSDEEP 49152:rg06DIKdwc+eQnSt65aVtR+ft983Dl3gEe8xA+:knR+l9EDl3VxA+
TLSH
T14A955C15BBEA5294E9B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 71cbc55e088a0544773b243da7ed41b087bc41d85f81c2579a85ac446e471e85
MD5 838a3f04a25b395d93ea6ccef6acdf17
SHA1 b813ff689af96a6e7bea57f6db47f5de1c55f649
SHA512 b0d942e80cd67267d9f232bac5ae5d33c8d888394df40ae74da3e574f6c1614f576cfc6752584682bcb70fcc3ba136d0ebdc6178eac632ca35ec8652d6aeed62
SSDEEP 12288:WEP3RnfRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:VnfRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1C785121D3E8C70D2D52B90BD85818141D372F4652BA227FF95A1C23E8F77AEE6D38A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.7MB
SHA256 d55ab23834c2c0d6c83dae3266d80f8a02ee1be5e55a75d20176520a4135d442
MD5 82eadd79d092729f57d4e9071570fc33
SHA1 0387c5ca456dd8ea1c2586fab529b63501eeadf3
SHA512 2b35194af5dc260a6c82705ea6654e5e47b081159340d9305c94b46697a1330365e52db6853d58caa0747bc63ea687ae3ea9d1be00fd7e3a4aae103aad82d561
SSDEEP 24576:XIyERPWxNs298r3OCDIjG3gE9ow+8xA+:XIzR+ft983Dl3gEe8xA+
TLSH
T1B78513042B8C60C1DA7E41B8D99391A19632BC156F7163EF9090E63E6F377D9AD30B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.6MB
SHA256 9d899608c09cc1257bc4a67f1c45418e48dc650b12714ca69aaae838577b7e58
MD5 e3f26e3b55066982199f2de533574efb
SHA1 cb8a0ab2f9a765ca22f6fd59ffbadb9588aba2ba
SHA512 a233c1d0b6d206e1a2d70d14a2b79968182a1101965bfe7c88ffe825088b1da97c6e35a335a2f7673336e50b3e4268b09be88c283ba1d6ede169085ead7fd852
SSDEEP 12288:/yhURPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:KiRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T17A7523082C0D74C2DE2F81F94A46A1A1A1327D0E3BF535F7E4A0D971DF7A6CEA570866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 551fcd567e0922fb64c6e9abf447b4bcf882b826c2b2a8377262d5eca94562af
MD5 c42befe20a253fbea352b1ee4ef2010b
SHA1 427da66e911fb6cf8effe187bff8b5a3f2d7d328
SHA512 fd81e641600b8fafb36deeff9350ad4be694d646d288d68b0f8eee6ab7f01c1e9930bb5384c9d5be55597d2577f7535cca5b5916d2477f965a0de877dd41274e
SSDEEP 24576:0Q9MxZKdcz9dw3xRPWxNs298r3OCDIjG3gE9ow+8xA+:0VKZxR+ft983Dl3gEe8xA+
TLSH
T1DC558C2DABE9058AE177D27995A250C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.8MB
SHA256 1997a000e938ad9e8ccf4a31698cf8b454a35d9c7c79224d1f8163eeb17252ef
MD5 f3f1e1483c095fdc29985f6d49e4563f
SHA1 b6d64d49f710cabb25709a6a1be29ed1fef29ac5
SHA512 a414ad2428ce8ba04a1965f181567de5711d01d695f04f21a3a171c8a533d96ed3f361107ef112b2f89746b0e4b848c17f3fcb2cee125eadeecc09b0474924b9
SSDEEP 24576:0yocDApgRPWxNs298r3OCDIjG3gE9ow+8xA+:pocDApgR+ft983Dl3gEe8xA+
TLSH
T19E85E01F7B6D40E2E136813C89858245E773B4342B6263DBA591C33D8E27AEDBD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8d1596c75c3bbe1fe69d1184b97432dfe3ab7f019cffd094c44755f66894236d
MD5 196c64b15329c7fed4ad94c23b9a1e23
SHA1 d4446d1c5a4a023e1068bda35fc48f2c6c9bc822
SHA512 ba30746a51f0ae4bc3e115677b6375e6eac915777004514eb2146fcbd87c4825f95574f03c752c3211b2de5367c05350f09c8c78093ed8a29bb16c494c24f088
SSDEEP 49152:dWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKgR+ft983Dl3gEe8xA+:90zuNIWR+l9EDl3VxA+
TLSH
T1A6A57C3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 86c6deae7a0a8dd56b5b52ee80a37ccaa76a55e42f5253317c2800cc3dbd878a
MD5 a82d18d46312c6aca69d2fe668fafb52
SHA1 4b3f9b5ba8442a0e53cf3919383382ad872b8a27
SHA512 7a8b3d1dbf61ea2d833f0a6d77bb921aa9eedd488fd7d10ee221777f0d473d3ce5d9a379b054f2ff5c68c267f14bd10bb099ba00f2c41d2add3852fc65bb402a
SSDEEP 24576:p1QT7EcpfxR+N5AWAz3ooiYzjMqbfRPWxNs298r3OCDIjG3gE9ow+8xA+:8TDxR+N5YzTBjMOR+ft983Dl3gEe8xA+
TLSH
T16E55B02EA7F815E5D1BEC5798A23C512FA727821033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-47-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/224-48-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/224-54-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/224-244-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/628-324-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/628-489-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1096-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1096-245-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1096-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1096-66-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1212-440-0x0000000140000000-0x00000001402E1000-memory.dmp

Download

memory/1212-316-0x0000000140000000-0x00000001402E1000-memory.dmp

Download

memory/1492-13-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/1492-234-0x0000000140000000-0x00000001402A9000-memory.dmp

Download

memory/1572-340-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1572-417-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1572-286-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2064-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2064-83-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2236-416-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2236-294-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2236-293-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2236-300-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2284-82-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2284-80-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2284-77-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2284-75-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2284-69-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2424-265-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2424-259-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2424-327-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/2424-268-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/2476-270-0x0000000000400000-0x0000000000696000-memory.dmp

Download

memory/2476-331-0x0000000000400000-0x0000000000696000-memory.dmp

Download

memory/2476-274-0x0000000000870000-0x00000000008D7000-memory.dmp

Download

memory/2476-279-0x0000000000870000-0x00000000008D7000-memory.dmp

Download

memory/2568-490-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2568-328-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3376-335-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3376-283-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3532-423-0x0000000140000000-0x0000000140301000-memory.dmp

Download

memory/3532-305-0x0000000140000000-0x0000000140301000-memory.dmp

Download

memory/3532-307-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3532-312-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3724-427-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-443-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-457-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-458-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-459-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-460-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-461-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-462-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-463-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-464-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-465-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-441-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-442-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-444-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-445-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-446-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-447-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-448-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-449-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-450-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-451-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-452-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-424-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-425-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-426-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-429-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-428-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-453-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-430-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-435-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-437-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-439-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-438-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-436-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-434-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-433-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-432-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-431-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-454-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-456-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3724-455-0x0000026D3DC70000-0x0000026D3DC80000-memory.dmp

Download

memory/3816-319-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3816-321-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4256-497-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/4256-338-0x0000000140000000-0x00000001402C5000-memory.dmp

Download

memory/4276-91-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4276-246-0x0000000140000000-0x00000001402CE000-memory.dmp

Download

memory/4276-85-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4276-93-0x0000000140000000-0x00000001402CE000-memory.dmp

Download

memory/4304-414-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4304-290-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4516-341-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4516-43-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4516-498-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4516-44-0x0000000140000000-0x0000000140404000-memory.dmp

Download

memory/4516-8-0x0000000140000000-0x0000000140404000-memory.dmp

Download

memory/4516-389-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4516-357-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4516-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4516-421-0x000000000CB10000-0x000000000CB18000-memory.dmp

Download

memory/4516-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4516-373-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4684-255-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/4684-323-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/4748-25-0x0000000140000000-0x00000001402A8000-memory.dmp

Download

memory/4748-26-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4748-17-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4852-332-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4852-491-0x0000000140000000-0x0000000140216000-memory.dmp

Download